Hello again. In my previous posts I detailed how to manually get SYSTEM shell from Local Administrators users. That’s interesting but very late game during a penetration assessment as it is presumed that you already owned the target machine.

A C# penetration testing tool to discover low-haning web fruit via web requests. - rvrsh3ll/SharpFruit

In this post I wanted to look at a technique which is by no means new to .NET developers, but may prove useful to redteamers crafting their tools... exporting .NET static methods within a DLL... AKA using RunDLL32 to launch your .NET assembly.

As offensive toolsets continue to move towards using C# as the language of choice for post-exploitation, I thought it’d be useful to think…

Introduction

Introduction

Hello Everyone,

An Example in Getting Around CrowdStrike Endpoint Protection

Virtualization technology is fast becoming the backbone of the security strategy for modern computing platforms. Hyper-V, Microsoft's virtualization stack, is no exception and is therefore held to a high security standard, as is demonstrated by its $250,000…

While security products are a great supplement to the defensive posture of an enterprise, to well-funded nation-state actors, they are an impediment to achieving their objectives. As pentesters argue the efficacy of a product because it doesn't detect their…

Microsoft Windows - DfMarshal Unsafe Unmarshaling Privilege Escalation. CVE-2018-8550 . local exploit for Windows platform

For years Microsoft has stated that the forest was the security boundary in Active Directory. For example, Microsoft’s “What Are Domains and Forests?” document (last updated in 2014) has a “Forests…

During DerbyCon 2018 this past October, my teammates @tifkin_, @enigma0x3 and @harmj0y gave an awesome presentation noscriptd “The Unintended…

Presented at DerbyCon 7.0: Legacy in Lousville, Kentucky in 2017.

SpecterOps: https://www.specterops.io

This post is going to go over a very quick domain compromise by abusing cached Kerberos tickets discovered on a Linux-based jump-box…