Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s! blog.balliskit.com/tutorial-… #redteam

You can now coerce HTTP authentication from Windows targets that are running MS-RPRN, using impacket with PR #2361! The PR added a new opnum from the MS-RPRN spec, OPNUM 88 and an example script to make the process straight forward. Letting you now coerce and relay HTTP authentication from remote machine targets Shoutout to sudonoodle for the BOF that inspired this and for the technique(at least I think it was them who found it) :3

Short post on an alternative method for obtaining Microsoft Entra refresh tokens via Beacon. Proof of concept BOF is available on my GitHub 🙂 infosecnoodle.com/p/obtainin…

Updated my Entra authcode flow BOF to be more reliable (despite Microsoft's recent anti-phishing updates) and also included Outflank C2 support. Got a beacon, and want to quickly pivot to Entra without using PRT? Give this a try. 🙂 github.com/sudonoodle/BOF-en…

Coercion BOF via IPP printers 🖨️ Useful for relaying HTTP —> AD CS, LDAP, etc. GitHub Link: github.com/sudonoodle/BOF-co…

BruteShark Extracting Files and Credentials from Network Traffic with BruteS BruteShark can extract credentials and media from live network traffic and PCAPs. If you're stuck during a pentest, the network traffic may hold some secrets. It saves VoIP calls and hashes in hashcat format. You can also build a map of hosts from the PCAP files hackers-arise.com/network-fo…

Active Directory - Timeroasting Users While timeroasting usually applies to machines, domain admins can modify attributes of user accounts and temporarily convert a user account into a domain machine account. Then the DC returns hash for it. The idea here is that DCSync and other noisy attacks are well known are often monitored, while this isn't hackers-arise.com/powershell…

In a recent IR case, we observed successful NTLM-authenticated Exchange Web Services (EWS) requests against an on-premises Exchange server, despite Hybrid Modern Authentication and enforced MFA. A short field note on how legacy authentication paths remained accessible and what we found during the investigation. dfir.ch/posts/field_note_mha…

A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret (SDS) from Chrome process memory, and the decryption of synced GPM passkeys. github.com/0rcruxe/pass-ta-k…

The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)

New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts hunio.org/security/abusing-c…

A fork of ntlmrelayx is available here github.com/grayhatkiller/imp… with the LDAP signing bypass implemented. If anyone wants a quick win to fully compromise a domain…here you go!

Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research. Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you. github.com/redteamfortress/K…

New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇 ghst.ly/3VSdm7h

While looking for MSBuild alternatives, I came across VisualStudio's TextTransform utility which can execute C# code embedded in `.tt` files - something I haven't seen in the wild before, so naturally, I had to make a tool around it to run shellcode ;) github.com/whokilleddb/TTs

What happens when Chromium becomes an offensive tool? Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders. Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW

I wrote up a way to defeat enforced SMB signing for relay. It abuses a documented SMB re-authentication behavior. I'm surely missing nuance and prior art. Corrections welcome. Writeup: blackfield.ch/blog/defeating… PoC: github.com/aas-n/reauthx

Crazy cool blog I saw on linkedin about an SMB signing bypass technique TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included. blackfield.ch/blog/defeating…

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed! Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

New post: Writing a Beacon Object File from scratch in C. COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers. Plus why execute-assembly lights up every EDR while BOFs barely register. by7e.dev/blog/bof-from-scrat…