Posts
PRTremote: Extract PRT Cookies Remotely with InteractiveToken Scheduled Tasks ↗
An InteractiveToken scheduled task and BrowserCore.exe are enough to pull a live PRT cookie off a remote host over SMB.
klist.exe Revisited: Internals and Further Use Cases
A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, and examining behavior under Credential Guard.
Abusing klist.exe for Kerberos Post-Exploitation
Running as SYSTEM, the klist.exe that ships with Windows will dump every logged-on user's TGT. I convert them to ccache and build a TGT harvester out of scheduled tasks.
No More Implants: User's Guide to Splashtop C2
Lazarus barely bothers with custom malware, so I tried Splashtop as a C2. Dumping LSASS and requesting certificates through it set off no alerts in CrowdStrike or MDE.
Password Spraying ManageEngine and Other RSA-protected Logins
A ManageEngine login on a recent pentest RSA-encrypted every password. Pulling the public key out of the page's JavaScript made it sprayable again.
Please, Please, Please Stop Getting NTLM Relayed
Nearly every internal test I've run turns up an NTLM relay path. What to fix for SMB, ADCS, LDAP, and MSSQL, plus a script to find the gaps.
Extending Wazuh with Sysmon and LDAP
Domain controllers don't log LDAP queries by default. I turned that on, wrote Wazuh rules for suspicious queries alongside Sysmon, and caught my own BloodHound run.
AMSI Bypasses and PowerShell Obfuscation
How AMSI scans PowerShell, and how to take a public bypass that gets flagged, find the offending strings with AMSITrigger, and obfuscate around them.
Bookmarklets as XSS Attack Vectors
Someone went after a friend's Roblox account, whose items are worth thousands of real dollars, with a fake fan-art request and a bookmarklet that runs JavaScript on roblox.com to sidestep CORS.