Escalate Service Account To LocalSystem via Kerberos.
https://github.com/wh0amitz/S4UTomato
#privesc #ad #redteam #pentest
https://github.com/wh0amitz/S4UTomato
#privesc #ad #redteam #pentest
GitHub
GitHub - wh0amitz/S4UTomato: Escalate Service Account To LocalSystem via Kerberos
Escalate Service Account To LocalSystem via Kerberos - wh0amitz/S4UTomato
👍19🔥6🥰1
Forwarded from APT
📄 ADCS: New Ways to Abuse ManageCA Permissions
The Certsrv service exhibits a race condition during the creation of CRL files, any standard user with ManageCA ACL and publish the CDP and carry out arbitrary file movements, ultimately leading to domain elevation of privileges.
🔗 https://whoamianony.top/posts/ad-cs-new-ways-to-abuse-manageca-permissions/
#ad #adcs #manageca #privesc
The Certsrv service exhibits a race condition during the creation of CRL files, any standard user with ManageCA ACL and publish the CDP and carry out arbitrary file movements, ultimately leading to domain elevation of privileges.
🔗 https://whoamianony.top/posts/ad-cs-new-ways-to-abuse-manageca-permissions/
#ad #adcs #manageca #privesc
👍10🔥4
Forwarded from APT
298559809-27f286d7-e0e3-47ab-864a-e040f8749708.webm
6.5 MB
This vulnerability targets the Common Log File System (CLFS) and allows attackers to escalate privileges and potentially fully compromise an organization’s Windows systems. In April 2023, Microsoft released a patch for this vulnerability and the CNA CVE-2023-28252 was assigned.
📊 Affects version:
— Windows 11 21H2 (clfs.sys version 10.0.22000.1574);
— Windows 11 22H2;
— Windows 10 21H2;
— Windows 10 22H2;
— Windows Server 2022.
Research:
🔗 https://www.coresecurity.com/core-labs/articles/analysis-cve-2023-28252-clfs-vulnerability
Exploit:
🔗 https://github.com/duck-sec/CVE-2023-28252-Compiled-exe
#windows #privesc #clfs #driver
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥19👍5🙏1
Forwarded from APT
Nagios XI 2024R1.01 has a vulnerability in the
monitoringwizard.php component, allowing authenticated SQL injection (CVE-2024-24401) that lets attackers create an admin account and remote code execution. 🔗 Source:
https://github.com/MAWK0235/CVE-2024-24401
#nagios #sql #rce #privesc #poc #exploit
Please open Telegram to view this post
VIEW IN TELEGRAM
👍25🔥11
Вот такой крутой ресерч сегодня подъехал. От учетных записей dMSA до администратора домена. А с учетом того, что dMSA можно создать самому (при определенных, но часто встречающихся условиях), это прям крутой Low Fruit. Особенно с учетом того, что Майкрософт пока не собирается это исправлять.
https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
Но! Стоит также отметить, что dMSA появились только на Windows Server 2025))
Soft: https://github.com/logangoins/SharpSuccessor
Soft: https://github.com/Pennyw0rth/NetExec/pull/702
Soft: https://gist.github.com/snovvcrash/a1ae180ab3b49acb43da8fd34e7e93df
#pentest #redteam #ad #privesc
https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
Но! Стоит также отметить, что dMSA появились только на Windows Server 2025))
Soft: https://github.com/logangoins/SharpSuccessor
Soft: https://github.com/Pennyw0rth/NetExec/pull/702
Soft: https://gist.github.com/snovvcrash/a1ae180ab3b49acb43da8fd34e7e93df
#pentest #redteam #ad #privesc
Akamai
BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
Akamai researchers found a privilege escalation vulnerability in Windows Server 2025 that allows attackers to compromise any user in Active Directory.
1👍30🤔7😱2
Полный гайд по эксплуатации ADCS от ESC1 до ESC16. Понятно, что материалов по этой теме и так много, но пусть будет под рукой))
https://xbz0n.sh/blog/adcs-complete-attack-reference
#ad #adcs #privesc #pentest #redteam
https://xbz0n.sh/blog/adcs-complete-attack-reference
#ad #adcs #privesc #pentest #redteam
xbz0n.sh
Breaking ADCS: ESC1 to ESC16 Attack Techniques
Let's talk about Active Directory Certificate Services. If you've been doing red team work for any length of time, you've probably heard about ADCS attacks. ...
👍37🔥17🥰1