DCOM lateral movement BOF using Windows Installer (MSI) Custom Action Server - install ODBC drivers to load and execute DLLs

How Entra Connect and Intune can be abused via userCertificate hijacking to bypass conditional access and compromise hybrid domains

How Entra Connect and Intune can be abused via userCertificate hijacking to bypass conditional access and compromise hybrid domains

The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make i...

Introduction

ALT: a man with a surprised look on his face is standing in front of the word awesome

TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via ...

ALT: dwight schrute from the office is holding a business card in his hand .

Now that we know how to add credentials to an on-premises user, lets pose a question:

We’re hiring consultants; Check out this overview of our recruiting process!

Lately I’ve had an opportunity to experiment with the Timeroasting on an engagement, so here are my thoughts on the applicability of the attack in real life conditions with some examples along the way...

Python implementation of GhostPack's Seatbelt situational awareness tool - 0xthirteen/Carseat

Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijack execution flow - 0xHossam/KernelCallbackTable-Injection-PoC