Onelogon: Taking over Active Directory Accounts via Netlogon🔑 We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

SPN-less RBCD with NetExec🔥 While classic RBCD requires a computer account, you can use User-to-User (U2U) authentication to perform RBCD with a normal user account, if a computer account is not available. Thanks to azoxlpf, you can now perform this attack with NetExec as well🚀

SMB share enumeration via ACLs with NetExec🔥 NetExec now detects share permissions via ACL enumeration, instead of trying to write a file. In addition, we can now detect if a user has indirect access to the share, e.g. by having ACL write permissions! Made by @PytelJack🚀

Small QOL update for NetExec: Ctrl+C will now immediately exit NetExec without any weird stack traces🚀 However, keep in mind that this still does not exit gracefully, but immediately kills all existing threads. Only do so if necessary. Made by T1erno

Targeted Keberoasting with NetExec🔥 If you have Write privileges over a user, you can temporarily add an SPN to your target user, request the service ticket, and then remove the SPN. Voilà: a crackable hash without interfering with potentially critical users. Made by azoxlpf🚀

@cookietheft.ioc.exchange.ap.brid.gy and I have been accepted to speak at Troopers this year🎉 Hope you all are eager to learn a thing or two about ADCS and ESC17. See you there!

Modifying group membership with NetExec🛠️ A classic situation: You have obtained a privileged user and want to add yourself to one of their groups, e.g. the Domain Admins. With NetExec's new modify-group module you can do that now via both SMB and LDAP. Made by termanix.

A new module just got merged into NetExec: get-scriptpath📜 This module queries all users for the scriptpath attribute. If you have write privileges over one of these scripts (or they e.g. try to mount a network share) you can easily compromise these users on their next login. Made by 0xwyndo.

Crawling MSSQL databases with NetExec: mssql_dumper💾 The new mssql_dumper module, created by LTJAXSON, enables you to crawl MSSQL databases for a predefined set of keywords, including classic credential phrases, or to search using your own regular expression/keyword list.

New NetExec module: mssql_cbt🔥 Relaying to MSSQL can be a hidden gem when you are out of (relaying) options. The only protection against relaying to MSSQL is to enforce Channel Binding Tokens (CBT). Thanks to Defte, NetExec now has a module that checks whether this CBT is required.

Netexec has some really nice NFS capabilities. I found a some weird behavior in one of them, which turned out to be a bug that just got patched. Let's walk through it.

Collecting ADCS data with NetExec🔥 Thanks to the addition of CertiHound, developed and implemented by 0x0Trace, we can now collect ADCS data using the --bloodhound collector of NetExec. As before, the data is exported as JSON files that can be imported directly into BloodHound for further analysis.

Releasing one of my research tools: EVENmonitor🖥️ Inspired by LDAPmonitor, I implemented a monitoring tool for the Windows Event log in pure python. You can just attach it via the network and then filter for specific event IDs or keywords. Available at: github.com/NeffIsBack/E...

Using ADCS to Attack HTTPS-Enabled WSUS Clients: @cookietheft.ioc.exchange.ap.brid.gy and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients. 1/2🧵

Yep. Pretty much 😂

NetExec v1.4.0 has been released! 🎉 There is a HUGE number of new features and improvements, including: - backup_operator: Automatic priv esc for backup operators - Certificate authentication - NFS escape to root file system And much more! Full rundown available at: github.com/Pennyw0rth/N...

Happy #BloodHoundBasics day to all who celebrate! Easily RETURN computers, users, and certificate templates created in the last X days where X can match anything you want. In this case we are looking for objects created in the last 365 days. 🧵: 1/3

This looks off to you? Yeah... In the default configuration, NFS exposes THE ENTIRE FILE SYSTEM and not only the exported directory! This means that you can read every file on the system that is not root:root owned, e.g. /etc/shadow. But it can get even worse 1/4🧵

Finally, two new options by @Defte_ got merged into NetExec🔥 --qwinsta: Enumerate active sessions on the target, including numerous useful information --tasklist: Well... enumerates all running tasks on the host Update & enjoy the new reconnaissance flags🔎

Generate a valid krb5 conf file directly from netexec 🔥 Not that NXC needs it, but sometimes you gotta help other tools for them to work. 😂

DCsync a domain when you find a user in the Backup Operators group using netexec, very simple and no need for a custom smb server 😛🏆

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

So you want to exploit ADCS ESC8 with only netexec and ntlmrelayx ? Fear not my friend, I will show you how to do it 👇 NetExec now supports "Pass-the-Cert" as an authentication method, thanks to @dirkjanm.io original work on PKINITtools ⛱️

Crazy and mind blown 🤯 If you have read access to an NFS share, you can basically read all files from the same filesystem. - Research: www.hvs-consulting.de/en/nfs-secur... - Tooling: github.com/hvs-consulti... - 38c3 CTF Writeup: hxp.io/blog/111/hxp... #pentest #nfs

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

Two new modules for MSSQL on NXC, thanks to the contributions of @lodos2005.bsky.social and @adamkadaban.bsky.social 🔥 - rid-brute from mssql - mssql_coerce from mssql github.com/Pennyw0rth/N...

The @trustedsec.com BoF dev class is up learn.trustedsec.com/catalog

NetExec has a new Module: Timeroast🔥 In AD environments, the DC hashes NTP responses with the computer account NT hash. That means that you can request and brute force all computer accounts in a domain from an UNAUTHENTICATED perspective! Implemented by Disgame 1/3🧵

Small technical update: Impacket and therefore NetExec now support LDAP Channel Binding🔥 Finally you can use all the great features NetExec has to offer even in more mature environments

Awesome new addition to krbrelayx by Hugow from Synacktiv: www.synacktiv.com/publications...

TrustedSec Tech Brief 00:30 - NTLM Hash Disclosure Zero-Day 01:45 - Task Scheduler Vulnerability 02:30 - Exchange Server Issues 03:15 - AD Certificate Services Flaw 04:00 - Vulnerability Breakdown 04:45 - Palo Alto Zero-Day 05:30 - FortiGate VPN Update www.youtube.com/watch?v=3mSD...

If you want to first blood a windows box in @hackthebox.bsky.social every minute counts ! 🩸 I've added a special flag --generate-hosts-file so you just have to copy past into your /etc/hosts file and be ready to pwn as soon as possible 🔥

Hello world :)