KeyStrOke @KeyStrOke95

Security Researcher | Red Teamer | Malware Developer | CTFer lsass.exe Joined December 2014

Tweets

103
Followers

347
Following

2K
Likes

2K

Yuval Gordon @YuG0rd

4 months ago

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️ Read Here - akamai.com/blog/security-…

22 373 867 159K 454

Download Image

Synacktiv @Synacktiv

10 months ago

You can now relay any protocol to SMB over Kerberos with krbrelayx.py and the latest PRs from @hugow_vincent. Thanks @_dirkjan for merging it! Here is an example from SMB to SMB:

9 206 602 45K 295

Download Image

Andrea P @decoder_it

12 months ago

Administrator Protection, introduced in the latest Windows Insider Canary build, is a solid security enhancement... uhh.. really?? can be bypassed with @splinter_code's clever SspiUacBypass tool. Check it out here: github.com/antonioCoco/Ss…

4 78 230 66K 129

Download Image

🕳 @sekurlsa_pw

12 months ago

CVE-2024-38124: Predict the name of the New Domain controller and become Domain Admin. Reminds me of sAMAccountName Spoofing. To predict the name would be easy in some domains: ▪️DC1 ▪️DC2 msrc.microsoft.com/update-guide/e…

1 86 292 30K 160

Download Image

Simone Margaritelli @evilsocket

a year ago

Attacking UNIX Systems via CUPS, Part I evilsocket.net/2024/09/26/Att…

180 1K 4K 1.1M 2K

Andrea P @decoder_it

2 years ago

HTTP/Webdav variant explained here ;) decoder.cloud/2023/11/03/loc…

Antonio Cocomazzi @splinter_code

2 years ago

HTTP/Webdav variant explained here ;) decoder.cloud/2023/11/03/loc…

1 35 107 21K 30

0 11 27 8K 12

an0n @an0n_r0

2 years ago

sometimes in hardened AD env they disable (actually remove) SeDebugPrivilege globally (via GPO) in order to prevent malicious things targeting process memory (like token stealing, etc.) even as local admin. good (or bad) news is that the bypass is easy: pentest.party/notes/windows/…

5 122 343 40K 170

Grzegorz Tworek @0gtweet

2 years ago

By-design AV bypass with "dev drive" 😅 I really like this feature! Update your detection rules if you want to spot this...

14 246 921 242K 388

Download Image

Spencer McIntyre @zeroSteiner

2 years ago

My F5 exploit landed to @metasploit earlier today. It includes unauthenticated code execution as root, with admin hash dumping and account cleanup. buff.ly/3shIKNX

6 145 573 68K 82

Download Image

BlackWasp @BlWasp_

2 years ago

New tool by @Prepouce_ and @hackoura for local privilege escalation on a Windows machine, from a service account to NT SYSTEM. Should work on any recent versions of Windows. Watch out the explanatory blog: blog.hackvens.fr/articles/Coerc… And the tool : github.com/hackvens/Coerc…

2 109 273 23K 91

mpgn @mpgn_x64

6 years ago

How to defeat Hashcat !? 🛡️ Well, I think I found a workaround😈 Use a password with the following format : ⚔️ '$HEX[xxxx]' ⚔️ (where xxxx are only hex characters) Unless a specific flag is added to hashcat, the attacker will never be able to crack it ! #hashcat 1/5⬇️⬇️⬇️

8 212 631 0 116

Download Image

SkelSec @SkelSec

2 years ago

As promised, at @porchetta_ind we release all of our tooling to the public at semi-regular intervals. Here is my part...

7 39 112 29K 21

Hillai Ben-Sasson @hillai

3 years ago

I hacked into a @bing CMS that allowed me to alter search results and take over millions of @Office365 accounts. How did I do it? Well, it all started with a simple click in @Azure… 👀 This is the story of #BingBang 🧵⬇️

258 3K 15K 3.2M 5K

Download Image

Oliver Lyak @ly4k_

3 years ago

Today we're publishing new techniques for recovering NTLM hashes from encrypted credentials protected by Windows Defender Credential Guard. These techniques also work on victims logged on before the server was compromised. research.ifcr.dk/pass-the-chall…

34 686 2K 215K 506

BlackWasp @BlWasp_

3 years ago

Many new adds on my AD and ADCS cheatsheets: the @M4yFly 's mindmap, initial access techniques, important CVEs to test, Kerberos relay, Pass The Challenge, SCCM attacks and so on - AD : hideandsec.sh/books/cheatshe… - AD Python : hideandsec.sh/books/cheatshe… - ADCS : hideandsec.sh/books/cheatshe…

7 122 321 23K 107

Cedric Halbronn @saidelike

3 years ago

🔥You like Exploit Development and you want more? Good news, NCC Group (@NCCGroupInfosec) has been sponsoring the release of a Windows Kernel Exploitation training, that you can attend for free... If you want to get access (beta testing), apply here ASAP docs.google.com/forms/d/e/1FAI…

9 115 349 0 88

Ellis Springe @knavesec

3 years ago

Fresh off the #WayWest2022 Toolshed, dropping my new Office365 userenum technique against Federated tenants, check it out below! B: whynotsecurity.com/blog/o365feden… G: github.com/knavesec/o365f…

1 38 82 0 14

Download Image

Andrew Oliveau @AndrewOliveau

3 years ago

Lateral movement with Outlook + WMI COM objects

2 129 475 0 97

Download Image

Pixis @HackAndDo

3 years ago

Check out new lsassy release! 🔸New dump modules 🔸Usable TGT are displayed alongside credentials 🔸DPAPI Masterkeys are retrieved For more details you can check release 3.1.2 description github.com/Hackndo/lsassy…

1 38 118 0 16

Antonio Cocomazzi @splinter_code

3 years ago

My blog series "The hidden side of Seclogon" continues with part 3: Racing for LSASS dumps 🔥 Enjoy the read :D splintercod3.blogspot.com/p/the-hidden-s…