iiinova — where your digital self keeps evolving

Reposted by mpgn

Alex Neff @al3x-n3ff.bsky.social · 03/03/2025

This looks off to you? Yeah... In the default configuration, NFS exposes THE ENTIRE FILE SYSTEM and not only the exported directory! This means that you can read every file on the system that is not root:root owned, e.g. /etc/shadow. But it can get even worse 1/4🧵

NFS escape to the root directory with NetExec

NFS downloading the /etc/shadow file from a system with default NFS configs

184

Reposted by mpgn

Raphaël DUCOM @rducom.bsky.social · 02/03/2025

🔐 Purple Team job alert ! 🛡️🚨🔥 Lucca ouvre un poste dans sa team sécu ! TL;DR : Du web, du k8s Talos, des millions de users, un prog de bounty mature, un ADN branché scalabilité dans une boîte qui cultive la transparence, l'expertise et la culture du challenge. Bref, vous en saurez plus ici :👇

jobs.lever.co

Lucca - Confirmed / Senior Security Engineer - Purple Team

🎓 3 à 8 ans d'expérience requis en pentest et/ou red team 💼 Bac+5 💰 Salaire prévu entre 63 et 75K€ fixes bruts par an, selon l'expérience 📍 Nantes, Marseille, Paris ou Full remote (localisation en Fra...

137

mpgn @mpgn.bsky.social · 28/02/2025

🇫🇷🎙️Nouvel épisode du podcast Hack'n Speak ! C'est la partie 2 du relais Kerberos, avec une section dédiée à SCCM et un petit supplément Red Team 🥷🐊 Bonne écoute à toutes et à tous 🎶 creators.spotify.com/pod/show/hac...

creators.spotify.com

0x2C @croco_byte | Relai kerberos partie 2, SCCM, redteam ! by Hack'n Speak

Twitter: ⁠https://x.com/croco_byteTwitter: ⁠https://x.com/mpgn_x64⁠Blog post - ⁠https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx- https://www.synacktiv.com/publication...

042

mpgn @mpgn.bsky.social · 20/01/2025

Generate a valid krb5 conf file directly from netexec 🔥 Not that NXC needs it, but sometimes you gotta help other tools for them to work. 😂

0154

mpgn @mpgn.bsky.social · 13/01/2025

DCsync a domain when you find a user in the Backup Operators group using netexec, very simple and no need for a custom smb server 😛🏆

071

mpgn @mpgn.bsky.social · 06/01/2025

So you want to exploit ADCS ESC8 with only netexec and ntlmrelayx ? Fear not my friend, I will show you how to do it 👇 NetExec now supports "Pass-the-Cert" as an authentication method, thanks to @dirkjanm.io original work on PKINITtools ⛱️

0147

mpgn @mpgn.bsky.social · 02/01/2025

awesome as always 🔥

010

Reposted by mpgn

Dirk-jan @dirkjanm.io · 02/01/2025

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

github.com

GitHub - dirkjanm/BloodHound.py: A Python based ingestor for BloodHound

A Python based ingestor for BloodHound. Contribute to dirkjanm/BloodHound.py development by creating an account on GitHub.

22914

mpgn @mpgn.bsky.social · 02/01/2025

ldap socks on netexec / nxc 🎃

072

Reposted by mpgn

Clément Labro @itm4n.bsky.social · 04/12/2024

I updated the diagram representing the different Point and Print configurations and their exploitation on my blog. Hopefully, this should provide a better understanding of the whole "PrintNightmare" situation to both defenders and red teamers. 🤞

Diagram representing the various Windows Point and Print configurations that reintroduce the PrintNightmare exploit variants.

0188

Reposted by mpgn

0xdf @0xdf.bsky.social · 29/12/2024

This is the paradox of security and it. Doing your job well results in nothing (in a good way). Mistakes are blown up and noticed (in a bad way).

262

mpgn @mpgn.bsky.social · 31/12/2024

hear me out, pass the certificate auth on nxc 🔥

073

mpgn @mpgn.bsky.social · 30/12/2024

Thanks to Xiaolichan, NXC is now capable of scanning your network without attempting SMBv1 first by using the flag --no-smbv1. This reduces unexpected errors and scan time on large networks. 👺 A new module has also been added to scan hosts vulnerable to the Remove-MIC vulnerability 🔥

073

mpgn @mpgn.bsky.social · 18/12/2024

bye bye smb on ldap proto, coming soon 👺

131

Reposted by mpgn

Andrea P @decoder-it.bsky.social · 25/11/2024

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

36343

Reposted by mpgn

Nicolas Grégoire @agarri.fr · 16/12/2024

Vous savez quoi ? @mpgn.bsky.social est désormais sur Bluesky ! 👀 L'occasion rêvée pour reposter le lien vers mon intervention sur son podcast Hack'n'Speak 🎙️

031

mpgn @mpgn.bsky.social · 17/12/2024

Two new modules for MSSQL on NXC, thanks to the contributions of @lodos2005.bsky.social and @adamkadaban.bsky.social 🔥 - rid-brute from mssql - mssql_coerce from mssql github.com/Pennyw0rth/N...

0157

Reposted by mpgn

Nicolas Grégoire @agarri.fr · 16/05/2023

Pour mes followers francophones, voici mon intervention pour le podcast Hack’n’Speak de MPGN podcasters.spotify.com/pod/show/hac…

021

mpgn @mpgn.bsky.social · 15/11/2024

If you want to first blood a windows box in @hackthebox.bsky.social every minute counts ! 🩸 I've added a special flag --generate-hosts-file so you just have to copy past into your /etc/hosts file and be ready to pwn as soon as possible 🔥

031