Just in time for our DEF CON workshop “Constructing Kerberos Attacks with Delegation Primitives”, Microsoft failed to meet the disclosure deadline, and so we publish another primitive that can be abused to achieve Windows Local Privilege Escalation (LPE).…

Posted by Tavis Ormandy, Security Research Over-Engineer. “Sometimes, hacking is just someone spending more time on something than anyo...

With the rise in offensive .NET, particularly C#, tooling, we are seeing a great expansion in operational capability, especially with…

Lateral movement is the process of moving from one compromised host to another. Penetration testers and red teamers alike commonly used to accomplish this by executing powershell.exe to run a base6…

The Cobalt Strike Blog. Read new featured content, get updates on the latest patches, and insights into the future of red teaming tools.

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits. - WithSecureLabs/C3

2 years ago I wrote a post running a process in the  TrustedInstaller group. It was pretty well received, and as others pointed out there's...

In this blog post we will look at a somewhat familiar, but extremely limited window of opportunity which may come in handy when reviewing a fresh Active Directory forest deployment.

Sysmon is an incredibly powerful tool to aide in data collection beyond Windows’ standard event logging capabilities. It presents a…

Let me open this with a few questions Do you have your own penetration testing lab? Have you installed Windows Server 2016 before? Do you have Active Directory at home? What version of PowerShell a…

A dive into Windows processes, access tokens, SACLs, WinAPI and access token manipulation.

Upon gaining access to a system, what level of access is granted to an attacker who has yet to elevate their privileges?