Nice new #coercion method from @filip_dragovic
using Microsoft's Distributed File System (MS-DFSNM) protocol on \PIPE\netdfs.

PoC: github.com/Wh04m1001/DFSC…

It works nicely👌 @filip_dragovic [#thread 🧵] Here is a complete explanation of what you see here:

On the left I have my attacking machine and on the right I have a Windows Server that I use as a Domain Controller.

[#thread 🧵] I've released a tool to automatically extract, parse #windows build numbers from #ISO files in order to automatically sort them 🥳🎉

This is pretty useful if, let's say, you have a few Terabytes of ISOs 😏

github.com/p0dalirius/Win… [#thread 🧵(2/4)] With this tool, you can automatically sort your ISO files in folders sorted by build numbers like this:

[#thread 🧵] Last week in #Microsoft #PatchTuesday, a critical vulnerability was patched that theoretically allows attackers to achieve Remote Code Execution on a target #IIS server (CVE-2022-21907). I'll explain how it works in this thread ⬇️ [#thread 🧵(2/9)] A bit of History !

First of all, it is important to know that this vulnerability is a sibling of CVE-2021-31166 disclosed in May of last year. These two vulnerabilities occur in the parsing of HTTP headers of an incoming request, within the http.sys driver.

[#thread 🧵] For this 23rd day of #CyberAdvent, we will talk about the LDAP structure and its naming contexts. 🦋 [#thread 🧵(2/10) ] LDAP is a directory structure (a tree) containing objects with their attributes:

[#thread 🧵] For this 20th day of #CyberAdvent we'll be talking about the Local Admin Password Solution #LAPS of Microsoft, and how it can be used to reduce the risk of network pivoting of attackers. [#thread 🧵(2/6)] One of the common vulnerabilities found in Windows domains is a distributed local administrator on the workstations (sometimes even servers). This means that if an attacker compromises one machine, all the machines with the same administrator password are owned.

[#thread 🧵] For this third day of #CyberAdvent (3/24), I'll tell you a story. The story of how I gained root access to a server by leveraging a really fun feature in a web application. This #pentest #writeup will explain the complete process from recon to root. 🦋 [#thread 🧵(2/9)] In the recon phase of my pentest, as usual I was performing a port scan. In the output from nmap, I saw an uncommon port 86 with an HTTP server running "Micro Focus DSD 1.0.0":

[#thread 🧵] For this second day of #CyberAdvent (2/24), we will be talking about a common #PrivilegeEscalation when using the * (wildcard) in shell scripts. Almost everyone has used at least once the * (wildcard) in a shell script but what really happens with the #wildcard ? 🦋 [#thread 🧵(2/7)] We will take as an example this shell script, performing a backup of a website using tar and a wildcard:

[thread] Did you know that ssh tries to authenticate with stored keys BEFORE the key specified with -i in the command line ? I just noticed this, the hard way 😐.

Let's imagine you have more than 5 keys loaded in your ssh agent. When authenticating to a remote server, you get: After this message, ssh tries to authenticate with the keys in the order listed above. Why is that a problem ?

Because most servers have a default configuration with MaxAuthTries set to 6. After 6 tries, you will get a "Too many authentication failures" error.