X-Technobro retweeted
The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)
X-Technobro retweeted
New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts hunio.org/security/abusing-c…
X-Technobro retweeted
A fork of ntlmrelayx is available here github.com/grayhatkiller/imp… with the LDAP signing bypass implemented. If anyone wants a quick win to fully compromise a domain…here you go!
X-Technobro retweeted
Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research.
Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you.
github.com/redteamfortress/K…
X-Technobro retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
X-Technobro retweeted
While looking for MSBuild alternatives, I came across VisualStudio's TextTransform utility which can execute C# code embedded in `.tt` files - something I haven't seen in the wild before, so naturally, I had to make a tool around it to run shellcode ;)
github.com/whokilleddb/TTs
X-Technobro retweeted
What happens when Chromium becomes an offensive tool?
Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.
Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW
X-Technobro retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
X-Technobro retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
X-Technobro retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
X-Technobro retweeted
New post: Writing a Beacon Object File from scratch in C.
COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers.
Plus why execute-assembly lights up every EDR while BOFs barely register.
by7e.dev/blog/bof-from-scrat…
X-Technobro retweeted
A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems. github.com/bsdrip/COM_Hijack…
X-Technobro retweeted
Token Theft in Microsoft Entra ID, by @insinuator
Part 1: Threat Landscape and Attack Techniques insinuator.net/2026/08/token…
Part 2: Continuous Access Evaluation insinuator.net/2026/09/token…
Part 3: Token Protection insinuator.net/2026/10/token…
X-Technobro retweeted
But it doesn't just affect Intune + NSIS - any MDM solution that allows users to self-install apps, and other installer packaging frameworks could also be vulnerable.
Details on the @AmberWolfSec blog:
blog.amberwolf.com/blog/2026…
X-Technobro retweeted
🟣 Weekly Purple Team: DLL Sideloading
Adaptix Beacon hidden inside python315.dll. Legit process, malicious payload, C2 up and running.
Then we show you how to catch the sideload 👀
Red vs. blue breakdown 🎥
youtu.be/szXFXvaXiEs
#PurpleTeam #RedTeam #BlueTeam #DLLSideloading #AdaptixBeacon #C2 #DetectionEngineering #MITREATTACK #CyberSecurity
X-Technobro retweeted
Some additional strategic moves from @_CobaltStrike!
The @OutflankNL acquisition was a key step, and offering this course as a Cobalt Strike add-on is another indicator that, with sufficient customisation, Cobalt Strike remains effective in 2026.
A good reminder to everyone who claimed Cobalt Strike was dead because of signatures and detections.
✨New Training: Cobalt Strike Certified Operator II ✨
CSCO II goes past the basics into advanced evasion, with in-depth guidance on UDRLs, Sleep Mask, Beacon Gate, UDC2, and more. Ideal for those who are ready to level up their Cobalt Strike skill set.
cobaltstrike.com/blog/cobalt…
X-Technobro retweeted
With PR 2325, you can now expand your ESC8 relay targets in impacket to include CES web enrollment endpoints 🚀
github.com/fortra/impacket/p…
X-Technobro retweeted
Carefully crafted LDAP tactics to stay under the AD detection radar.
A post by Baptiste Crépin.
Source: cravaterouge.com/articles/ld…
#redteam #blueteam #offcoding
