iiinova — where your digital self keeps evolving

Garrett

@unsignedsh0rt.bsky.social

AdSim @ SpecterOps

Garrett @unsignedsh0rt.bsky.social · 11/04/2025

Had some fun with PDQ deploy/inventory credential decryption and wrote about it here: unsigned-sh0rt.net/posts/pdq_cr... thanks to @dru1d.bsky.social for writing a BOF out of the POC tl;dr get admin on PDQ box, decrypt privileged creds

unsigned-sh0rt.net

Decrypting PDQ credentials | unsigned_sh0rt's blog

Walkthrough of how PDQ credentials encrypts service credentials

096

Reposted by Garrett

SpecterOps @specterops.io · 06/03/2025

#SCCM forest discovery accounts can be decrypted—even those for untrusted forests. If the site server is a managed client, all creds can be decrypted via Administration Service API. Check out our latest blog post from @unsignedsh0rt.bsky.social to learn more. ghst.ly/4buoISp

ghst.ly

Decrypting the Forest From the Trees - SpecterOps

TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via ...

12215

Reposted by Garrett

Dirk-jan @dirkjanm.io · 20/11/2024

Awesome new addition to krbrelayx by Hugow from Synacktiv: www.synacktiv.com/publications...

synacktiv.com

Relaying Kerberos over SMB using krbrelayx

02914

Garrett @unsignedsh0rt.bsky.social · 21/11/2024

Claude.ai is so sick. I might actually fool people into believing I know how to code with this

claude.ai

Claude

Talk with Claude, an AI assistant from Anthropic

050

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

030

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

140

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

It's not limited to just ADCLI either...ManageEngine is probably the most familiar or recognizable tool that does this. It's true microsoft fixed creating them in ADUC but hardly fixed things where third party tools are involved.

140

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

So what's happening? The tool before would create the computer object without a password and then set it to a default after the fact. Now, that password setting is blocked and the object persists...with no password.

140

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

But now, you get a failure as you cannot change the accounts password. However, it STILL creates the object.

140

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

I had a hunch though that behavior might not be true for third party tools and third-party tools were arguably the biggest cause of their existence across all the enviroments I've tested over the years. An example of this is the adcli command line tool. Before it would set with a default password.

140

Garrett @unsignedsh0rt.bsky.social · 15/11/2024

Was doing some digging "What's New" in Server2025 learn.microsoft.com/en-us/window... specifically the changes to pre-2k machines. Oddvar and I had spoken previously about the changes being solid and demonstrated pre-created machines in ADUC could no longer be set with a default password.

1105

Garrett @unsignedsh0rt.bsky.social · 12/11/2024

Guess this is the place to be then

070