During automatic client push installation, an SCCM site server automatically attempts to map WebDav shares on clients, starting WebClient when installed.

During automatic client push installation, an SCCM site server automatically attempts to map WebDav shares on clients, starting WebClient when installed.

Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.

After Microsoft patched Yuval Gordon’s BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still abu...

TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to LD...