Writeup from @mael91620 is now available 🎉
From coerce into SPN less RBDC, gmsa decryption, dpapi, constraint delegation w/t protocol transition to ntds dissection ! 😈
Congrats to the one who solved it
🥇@rayanlecat
🥈@_bluesheet & 🐊
🥉@_sans23
➡️github.com/mael91620/Barb…
Writeup from @mael91620 is now available 🎉
From coerce into SPN less RBDC, gmsa decryption, dpapi, constraint delegation w/t protocol transition to ntds dissection ! 😈
Congrats to the one who solved it
🥇@rayanlecat
🥈@_bluesheet & 🐊
🥉@_sans23
➡️github.com/mael91620/Barb…
Made some changes to SoaPy to allow ADWS recon to be ingested into @Tw1sm 's BOFHound offline for upload to BloodHound. A blog detailing an operational perspective of ADWS collection from Linux with BloodHound is coming soon. For now, the changes are here: github.com/logangoins/Soa…
This is so much! 🔥🔥😎
Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.
github.com/warpnet/MS-RPC…
Onboard yourself - PaloAlto Global Protect edition:
1. Become local admin
2. Export device cert from original workstation
3. Import cert in your VM
4. Login with user creds
5. Enjoy EDR-free testing :)
🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live:
🪞 The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos:
blog.redteam-pentesting.de/2025/reflectiv…
Excellent article from @Synacktiv detailing CVE-2025-33073. It's an easy peasy LPE on any server where SMB signing is not enforced. I have already replicated it and works a charm. If you still aren't enforcing SMB signing... what are you doing?! Harden your environment & patch!
Excellent article from @Synacktiv detailing CVE-2025-33073. It's an easy peasy LPE on any server where SMB signing is not enforced. I have already replicated it and works a charm. If you still aren't enforcing SMB signing... what are you doing?! Harden your environment & patch! https://t.co/FCf3tSNhw9
Smells like authenticated (as any user) RCE as SYSTEM.
So not quite MS17-010 levels of bad (as that requires no authentication), but definitely "Domain User becomes Domain Admin in one step" levels of bad, if this is weaponized.
Smells like authenticated (as any user) RCE as SYSTEM.
So not quite MS17-010 levels of bad (as that requires no authentication), but definitely "Domain User becomes Domain Admin in one step" levels of bad, if this is weaponized.
114 Followers 641 FollowingI break things casu consulto. Red Team at CrowdStrike. My views and comment are my own and do not reflect my employer’s views.
4K Followers 404 FollowingCEO of World Cyber Health | Founder of @MalwareVillage | Creator of https://t.co/AKyp6xNeDy | Malware Researcher | Keynote | Banned from JSAC
5K Followers 32 FollowingOfficial account for Cobalt Strike. Benchmark red teaming tool known for its flexibility and powerful user community. Follow for new releases and other updates.
589 Followers 154 FollowingRed Team / Offensive Security, Cameo in @StrawHat_CTF for pentest. Web Security / Windows / Active Directory / Post Exploitation
4K Followers 2K FollowingBest-of-Breed #SIEM Platform
5X Gartner #SIEM MQ Leader
A New Era of AI-Reinforced CyberOps
#AIReinforcedSIEM #UnifiedDefenseSIEM and #UEBA
8K Followers 99 FollowingSharing resources from the cybersecurity community • Passionate learner and creator • YouTube: https://t.co/1BmE6QOd0D • Turn ON Notifications 🔔
48K Followers 2K FollowingSpecializing in pen testing, red teaming, and Active SOC. We share our knowledge through blogs, webcasts, open-source tools, and Backdoors & Breaches game.
2K Followers 68 FollowingPwned Labs delivers fun and immersive cybersecurity training experiences for individuals and businesses. Join the community: https://t.co/kyG413GZDa
No recent Favorites. New Favorites will appear here.