Tessera
Folgen

Ivanlef0u

@ivanlef0u.bsky.social

ivanlef0u.fr

0 Posts273 Follower219 Folgt
SpecterOps@specterops.io · 2y ago

How are defenders leveraging SACLs to detect unauthorized access attempts? Check out our latest blog post from Alexander DeMine which dives into SACLs and introduces a new tool, SACL_Scanner, which allows you to adapt your tradecraft accordingly. ghst.ly/3D3kvbD

Don’t Touch That Object! Finding SACL Tripwires During Red Team Ops - SpecterOps

During red team operations, stealth is a critical component. We spend a great deal of time ensuring our payloads will evade any endpoint detection and response (EDR) solution, our traffic is obfuscate...

ghst.ly

Dirk-jan@dirkjanm.io · 2y ago

It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx @domchell.bsky.social for the heads up.

Bild
Gabriel Landau@gabriellandau.bsky.social · 2y ago

Woot j00ru just dropped another FFI CVE: project-zero.issues.chromium.org/issues/42451...

Project Zero

project-zero.issues.chromium.org

Gabriel Landau@gabriellandau.bsky.social · 2y ago

I had the privilege of hanging out with j00ru at REcon Montreal after my talk about False File Immutability. I just found out that his latest work, CVE-2024-43452, was directly inspired by my talk and our chat. Feels good, man. project-zero.issues.chromium.org/issues/42451...

Synacktiv@synacktiv.com · 2y ago

You can now use LDAP/LDAPs protocols with the SOCKS proxy of ntlmrelayx thanks to the PR from @b1two_ (now merged upstream). Here is an example with ldeep using relayed authentication from HTTP to LDAPs :

Bild
Dirk-jan@dirkjanm.io · 2y ago

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

GitHub - dirkjanm/BloodHound.py: A Python based ingestor for BloodHound

A Python based ingestor for BloodHound. Contribute to dirkjanm/BloodHound.py development by creating an account on GitHub.

github.com

Clément Labro@itm4n.bsky.social · 2y ago

I updated the diagram representing the different Point and Print configurations and their exploitation on my blog. Hopefully, this should provide a better understanding of the whole "PrintNightmare" situation to both defenders and red teamers. 🤞

Diagram representing the various Windows Point and Print configurations that reintroduce the PrintNightmare exploit variants.
Dirk-jan@dirkjanm.io · 2y ago

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

dragosr@dragostech.bsky.social · 2y ago

New DCOM lateral movement technique discovered that bypasses traditional defenses. Unlike previous attacks relying on IDispatch interfaces, this method exploits undocumented COM interfaces within MSI, specifically targeting IMsiServer and IMsiCustomAction interfaces. 1/7

Forget PSEXEC: DCOM Upload & Execute Backdoor

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

deepinstinct.com