Slides from my Track X Thotcon 2018 Workshop ennoscriptd:

"Fun with LDAP, Kerberos (and MSRPC) in AD Environments"

If you want the embedded Gifs/Vide…

Privilege escalation always comes down to proper enumeration. But to accomplish proper enumeration you need to know what to check and look for. This takes familiarity with systems that normally comes along with experience. At first privilege escalation can…

In the wake of the recent buzz and trend in using DDE for executing arbitrary command lines and eventually compromising a system, I asked myself « what are the coolest command lines an a…

Researched and written by Rindert Kramer and Dirk-jan Mollema Introduction During internal penetration tests, it happens quite often that we manage to obtain Domain Administrative access within a f…

Background Responder is a go-to tool for most pentesters. We use it quite often on pentests to quickly gain access to a client’s domain. However, when clients enforce strong password policies and their users don’t choose passwords like 'Ilovemykids2017!'…

Exchange privilege escalations to Active Directory - gdedrouas/Exchange-AD-Privesc

tl;dr   WMIC can invoke XSL (eXtensible Stylesheet Language) noscripts, either locally or from a URL. Local File wmic process list /FO...

If malware development is a cat-and-mouse game, then I would say that the industry creates some of the most terrifying hunters. Learn more.