Slides from my Track X Thotcon 2018 Workshop ennoscriptd:

"Fun with LDAP, Kerberos (and MSRPC) in AD Environments"

If you want the embedded Gifs/Vide…

Privilege escalation always comes down to proper enumeration. But to accomplish proper enumeration you need to know what to check and look for. This takes familiarity with systems that normally comes along with experience. At first privilege escalation can…

In the wake of the recent buzz and trend in using DDE for executing arbitrary command lines and eventually compromising a system, I asked myself « what are the coolest command lines an a…

Researched and written by Rindert Kramer and Dirk-jan Mollema Introduction During internal penetration tests, it happens quite often that we manage to obtain Domain Administrative access within a f…

Background Responder is a go-to tool for most pentesters. We use it quite often on pentests to quickly gain access to a client’s domain. However, when clients enforce strong password policies and their users don’t choose passwords like 'Ilovemykids2017!'…

Exchange privilege escalations to Active Directory - gdedrouas/Exchange-AD-Privesc

tl;dr   WMIC can invoke XSL (eXtensible Stylesheet Language) noscripts, either locally or from a URL. Local File wmic process list /FO...

If malware development is a cat-and-mouse game, then I would say that the industry creates some of the most terrifying hunters. Learn more.

Detecting a hypervisor on Windows 10 is relatively simple, but due to the simplistic nature of the currently published detection vectors it’s likely that they are also relatively simple to spoof or remove. In this article we’ll detail a few ways of detecting…

Domain user enumeration tool. Contribute to sensepost/UserEnum development by creating an account on GitHub.

BSides Denver Presentation on May 11 2018

On-demand IT services are being publicized as the “new normal”, but often times these services are misunder…