iiinova — where your digital self keeps evolving

Reposted by Matt Creel

SpecterOps @specterops.io · 27/08/2026

ServiceNow won't let you query cleartext discovery credentials, not even as admin. @tw1sm.bsky.social found a way to make the server hand them over anyway, no coercion or relay needed. Works on SSH keys, AWS keys, Entra secrets, and LDAP creds. Check it out: ghst.ly/4y37KVo

ghst.ly

Cleartext Credential Recovery in ServiceNow

Discover a technique for retrieving cleartext LDAP credentials from ServiceNow using script includes, and how to defend against it.

011

Reposted by Matt Creel

SpecterOps @specterops.io · 25/11/2025

NTLM relays failing because of EPA? 😒 Nick Powers & @tw1sm.bsky.social break down how to enumerate EPA settings across more protocols + drop new tooling (RelayInformer) to make relays predictable. Check out their blog for more: ghst.ly/4rqwpRs

ghst.ly

Less Praying More Relaying - Enumerating EPA Enforcement for MSSQL and HTTPS - SpecterOps

It's important to know if your NTLM relay will be prevented by integrity protections such as EPA, before setting up for and attempting the attack. In this post, we share how to solve this problem for ...

042

Reposted by Matt Creel

SpecterOps @specterops.io · 29/10/2025

NTLM relay research is evolving! Join Nick Powers & @tw1sm.bsky.social TOMORROW as they share new methods to enumerate EPA enforcement across MSSQL, HTTP, & more—and intro RelayInformer, expanding attacker-perspective coverage for key protocols. Grab your spot → ghst.ly/oct-web-bsky

084

Reposted by Matt Creel

Garrett @unsignedsh0rt.bsky.social · 11/04/2025

Had some fun with PDQ deploy/inventory credential decryption and wrote about it here: unsigned-sh0rt.net/posts/pdq_cr... thanks to @dru1d.bsky.social for writing a BOF out of the POC tl;dr get admin on PDQ box, decrypt privileged creds

unsigned-sh0rt.net

Decrypting PDQ credentials | unsigned_sh0rt's blog

Walkthrough of how PDQ credentials encrypts service credentials

096

Reposted by Matt Creel

XPN @xpnsec.com · 08/04/2025

Celebrating 1 year at SpecterOps, this was the first project I worked on after starting. Looking at SQL Server Transparent Data Encryption, how to bruteforce weak keys, and how ManageEngine's ADSelfService product uses TDE with a suspect key. Enjoy :) specterops.io/blog/2025/04...

specterops.io

The SQL Server Crypto Detour - SpecterOps

As part of my role as Service Architect here at SpecterOps, one of the things I’m tasked with is exploring all kinds of technologies to help those on assessments with advancing their engagement. Not l...

1153

Matt Creel @tw1sm.bsky.social · 07/04/2025

Nothing new, but formalized some operator notes on Entra ID/Azure tradecraft I've found to be exceptionally useful on ops. Overlooked this myself for quite some time and thought others in the same boat might find it worth a read! 📖 medium.com/specter-ops-...

medium.com

An Operator’s Guide to Device-Joined Hosts and the PRT Cookie

Introduction

052

Matt Creel @tw1sm.bsky.social · 27/12/2024

Worked through the CloudBreach Breaching AWS course and exam over the last two weeks. Didn't see a ton of info out there on it prior to buying the course so wrote a small review with my thoughts blog.tw1sm.io/p/breaching-...

blog.tw1sm.io

Breaching AWS Course Review

CloudBreach's OAWSP Certification

000

Matt Creel @tw1sm.bsky.social · 26/11/2024

Cool to see another AD enum method bridge BH compatibility with bofhound! 🦾

130

Reposted by Matt Creel

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

Was doing some digging "What's New" in Server2025 learn.microsoft.com/en-us/window... specifically the changes to pre-2k machines. Oddvar and I had spoken previously about the changes being solid and demonstrated pre-created machines in ADUC could no longer be set with a default password.

1105