Giulio PierantoniADCS Exploitation Part 1: Common AttacksActive Directory Certificate Services is so widespread and easy to misconfigure it deserves a spot among one of the internal pentester’s…Aug 4Aug 4
Giulio PierantoniAttacking Not-So-Protected User SessionsMany people know Protected Users defends its members from credential theft, but it’s not enough to properly shield privileged users: its…Jul 11Jul 11
Giulio PierantoniAbusing ADCS NDES For Privilege EscalationThis blog demonstrates how ADCS NDES can be used for privilege escalation, and how to avoid its exploitation.Apr 19Apr 19
Giulio PierantoniNTLMv1 = Domain CompromiseIn this blog we see multiple scenarios where NTLMv1 is leveraged to compromise a domain through the bypass of SMB and LDAP signingApr 17Apr 17
Giulio PierantoniFinding Weak AD Computer PasswordsComputer accounts are given weak passwords in a variety of situations, here is why it happens and how to find (and exploit) themApr 41Apr 41
Giulio PierantoniA Practical Guide To RBCD ExploitationResource-Based Constrained Delegation is an interesting attack, in the right conditions it allows users to take control of computers and…Feb 24Feb 24
Giulio PierantoniAttacking Group Managed Service Accounts (gMSA)Another day, another Active Directory feature to put under the microscope. This time it’s Group Managed Service Accounts. I’ll exaplain…Feb 17Feb 17
Giulio PierantoniExploring Confidential Attributes in Active DirectoryConfidential attributes are AD attributes only a privileged user can read, while very important data is stored inside them not many people…Feb 16Feb 16
Giulio PierantoniDecrypting Pending BitLocker PartitionsTwice in a row now I encountered BitLocker installations noted as “pending”, requiring to be activated despite the disk already being…Feb 15Feb 15
Giulio PierantoniDumping LSASS Remotely From LinuxThere are a lot of ways to create a dump of lsass.exe to harvest credentials, but what if we wanted to do it from the comfort of our Linux…Feb 151Feb 151
