Ralf Hacker Channel

Несколько часов назад была сильно обновлена утилита certipy. Обратим внимание, что в документации также появилось описание техники ESC16...

#redteam #pentest #ad #adcs

GitHub

GitHub - ly4k/Certipy: Tool for Active Directory Certificate Services enumeration and abuse

Tool for Active Directory Certificate Services enumeration and abuse - ly4k/Certipy

2👍36🔥7🥰1

17.3K viewsRalf Hacker, 06:25

Ralf Hacker Channel

Вот такой крутой ресерч сегодня подъехал. От учетных записей dMSA до администратора домена. А с учетом того, что dMSA можно создать самому (при определенных, но часто встречающихся условиях), это прям крутой Low Fruit. Особенно с учетом того, что Майкрософт пока не собирается это исправлять.

https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory

Но! Стоит также отметить, что dMSA появились только на Windows Server 2025))

Soft: https://github.com/logangoins/SharpSuccessor

Soft: https://github.com/Pennyw0rth/NetExec/pull/702

Soft: https://gist.github.com/snovvcrash/a1ae180ab3b49acb43da8fd34e7e93df

#pentest #redteam #ad #privesc

Akamai

BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory

Akamai researchers found a privilege escalation vulnerability in Windows Server 2025 that allows attackers to compromise any user in Active Directory.

1👍30🤔7😱2

16.5K viewsRalf Hacker, edited 18:37

Ralf Hacker Channel

Про принудительную аутентификацию Windows в 2025 году

https://blog.redteam-pentesting.de/2025/windows-coercion/

Вместе с постом несколько скриптов:

Софт wspcoerce: https://github.com/RedTeamPentesting/wspcoerce

Модуль NetExec efsr_spray: https://github.com/Pennyw0rth/NetExec/pull/718

ntlmrelayx RPC server and EPM: https://github.com/fortra/impacket/pull/1974

#ad #coerce #pentest #redteam

RedTeam Pentesting - Blog

The Ultimate Guide to Windows Coercion Techniques in 2025

Windows authentication coercion often feels like a magic bullet against the average Active Directory. With any old low-privileged account, it usually allows us to gain full administrative access to almost arbitrary Windows workstations and servers, …

🔥22👍8😢1

14.3K viewsRalf Hacker, 11:55

Ralf Hacker Channel

Полный гайд по эксплуатации ADCS от ESC1 до ESC16. Понятно, что материалов по этой теме и так много, но пусть будет под рукой))

https://xbz0n.sh/blog/adcs-complete-attack-reference

#ad #adcs #privesc #pentest #redteam

xbz0n.sh

Breaking ADCS: ESC1 to ESC16 Attack Techniques

Let's talk about Active Directory Certificate Services. If you've been doing red team work for any length of time, you've probably heard about ADCS attacks. ...

👍37🔥17🥰1

15.2K viewsRalf Hacker, 05:58

Ralf Hacker Channel

CVE-2025-49113: Roundcube (1.6.10) Auth RCE

blog: https://fearsoff.org/research/roundcube

PoC: https://github.com/fearsoff-org/CVE-2025-49113

#exploit #git #pentest #redteam

fearsoff.org

Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization [CVE-2025-49113]

A deep technical breakdown of CVE-2025-49113, a critical Roundcube vulnerability involving PHP session serialization. Learn how the bug was discovered, exploited, and responsibly disclosed with full PoC and recommendations for defenders and developers. Kirill…

🔥16👍7🤯3🥰1😁1

12.1K viewsRalf Hacker, 18:21

Ralf Hacker Channel

CVE-2025-32756: Fortinet UnAuth RCE

PoC: https://github.com/kn0x0x/CVE-2025-32756-POC

Affected Products: FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera

#exploit #git #pentest #redteam

👍23🔥5🤔5😁2🥰1

13.2K viewsRalf Hacker, 07:18

Ralf Hacker Channel

CVE-2025-33073: Reflective Kerberos Relay (LPE)

Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

Patched: June 10, 2025

Интересная LPE с релеем на себя... Даже CVE есть)

#lpe #ad #relay #pentest #redteam

RedTeam Pentesting - Blog

A Look in the Mirror - The Reflective Kerberos Relay Attack

It is a sad truth in IT security that some vulnerabilities never quite want to die and time and time again, vulnerabilities that have long been fixed get revived and come right back at you. While researching relay attacks, the bane of Active …

🔥15👍6

17.6K viewsRalf Hacker, 08:34

Ralf Hacker Channel

CVE-2025-33073: Reflective Kerberos Relay (LPE) Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/ Patched: June 10, 2025 Интересная LPE с релеем на себя... Даже CVE есть) #lpe #ad #relay #pentest #redteam

В продолжение все той же темы CVE-2025-33073...

https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

Еще один ресерч, на это раз от Synactiv. Вот только у них не LPE, а Auth RCE от имени SYSTEM (если подпись SMB на машине не требуется).

Even though CVE-2025-33073 is referred by Microsoft as an elevation of privilege, it is actually an authenticated remote command execution as SYSTEM on any machine which does not enforce SMB signing.

#rce #lpe #ad #relay #pentest #redteam

Synacktiv

NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073

🔥16👍10😱1

16.3K viewsRalf Hacker, 11:36

Ralf Hacker Channel

Сразу две статьи от SpecterOps, можно считать, одна - продолжение другой. В блоге разбирают атаки на трасты AD, но с упором на BloodHound CE.

1. Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound

2. Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA)

Даже если не собираетесь погружаться в BHCE, стоит просто бегло почитать))

#pentest #redteam #ad #trust #lateralmovement #bloodhound

SpecterOps

Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound - SpecterOps

The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make it easier to identify cross-domain attack paths, we are…

🔥19👍5

10.2K viewsRalf Hacker, 13:00

Ralf Hacker Channel

Reads blacklist.txt and blocks dlls from loading with option to unblock subsequently. Patches LdrLoadDll in local/remote process to return dll not found.

https://github.com/cybersectroll/TrollBlacklistDLL

#pentest #redteam #av #evasion

👍10🤔9🔥5😁2😱1

11.3K viewsRalf Hacker, 06:31

Ralf Hacker Channel

CVE-2025-32463: sudo 1.9.14-1.9.17 LPE

Blog + exploit: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

Patched: June 28, 2025

#lpe #linux #pentest #redteam

3🔥43👍9🤯6😁3

15.4K viewsRalf Hacker, 19:53

Ralf Hacker Channel

CVE-2025-48799: Windows Update Service LPE

PoC: https://github.com/Wh04m1001/CVE-2025-48799

Patched: July 8, 2025