Posted by James Forshaw, Project Zero And we’re back again for another blog in my series on Windows Exploitation tricks. This time I’ll...

Summary:



A weakness in the Microsoft ADFS protocol for integration with MFA products allows a second factor for one account to be used for second-factor authentication to all other accounts in an organization.

After being notified about the vulnerability…

C# Targeted Attack Reconnissance Tools. Contribute to stufus/reconerator development by creating an account on GitHub.

Home of Nikhil SamratAshok Mittal. Posts about Red Teaming, Offensive PowerShell, Active Directory and Pen Testing.

The Skeleton Key is a malware which is stored in memory which allows an attacker to authenticate as any domain user in the network by using a master password. The techniques that this malware was u…

Bypass Technique Description

Learn ethical hacking: www.sans.org/sec504
Presented by: Mick Douglas

Attendees of this talk will learn why attackers have latched on to PowerShell. Mick will discuss how bad guys use this built in OS component to dodge many defensive techniques.

Mick…

Use powershell to list the RDP Connections History of logged-in users or all users - 3gstudent/List-RDP-Connections-History

An analysis of the MBR bootkit referred to as “HDRoot”

Python tool to inject fake updates into unencrypted WSUS traffic - pdjstone/wsuspect-proxy

Last week, we covered how to enumerate anti-virus configurations on remote systems. The information that you could gather would allow you to create a much more targeted attack against any system you are targeting. The natural next questions might be: What…

I recently discovered an interesting behavior how explorer.exe handles defined icon resources for certain file types IconFile property ...

The newest Windows 10 update includes OpenSSH utilities, including ssh-agent. Here’s how to extract unencrypted saved private keys from the registry

Yes it’s still easy to get Domain Admin “before lunch” as it was when I first started.

In this write-up, Ryan Hanson describes his process for identifying and exploiting CVE-2018-0952, an arbitrary file creation vulnerability in the Windows Diagnostics Hub Standard Collector service, allowing for elevation of privileges.

I’ve spoken about DPAPI (the Data Protection Application Programming Interface) a bit before, including how KeePass uses DPAPI for its “Windows User Account” key option. I recently dove into some of…