Rémi GASCOU (Podalirius) Profile picture
Security Researcher & Speaker | Microsoft Security MVP | Developer of security tools | Coach of the CTF team @OteriHack 🎬 https://t.co/QaAENc4NcY
Jun 21, 2022 9 tweets 8 min read
Nice new #coercion method from @filip_dragovic
using Microsoft's Distributed File System (MS-DFSNM) protocol on \PIPE\netdfs.

PoC: github.com/Wh04m1001/DFSC…

It works nicely👌 @filip_dragovic [#thread 🧵] Here is a complete explanation of what you see here:

On the left I have my attacking machine and on the right I have a Windows Server that I use as a Domain Controller.
Jan 19, 2022 4 tweets 3 min read
[#thread 🧵] I've released a tool to automatically extract, parse #windows build numbers from #ISO files in order to automatically sort them 🥳🎉

This is pretty useful if, let's say, you have a few Terabytes of ISOs 😏

github.com/p0dalirius/Win… [#thread 🧵(2/4)] With this tool, you can automatically sort your ISO files in folders sorted by build numbers like this:
Jan 18, 2022 10 tweets 7 min read
[#thread 🧵] Last week in #Microsoft #PatchTuesday, a critical vulnerability was patched that theoretically allows attackers to achieve Remote Code Execution on a target #IIS server (CVE-2022-21907). I'll explain how it works in this thread ⬇️ Image [#thread 🧵(2/9)] A bit of History !

First of all, it is important to know that this vulnerability is a sibling of CVE-2021-31166 disclosed in May of last year. These two vulnerabilities occur in the parsing of HTTP headers of an incoming request, within the http.sys driver. Image
Dec 23, 2021 10 tweets 6 min read
[#thread 🧵] For this 23rd day of #CyberAdvent, we will talk about the LDAP structure and its naming contexts. 🦋 [#thread 🧵(2/10) ] LDAP is a directory structure (a tree) containing objects with their attributes:
Dec 20, 2021 6 tweets 3 min read
[#thread 🧵] For this 20th day of #CyberAdvent we'll be talking about the Local Admin Password Solution #LAPS of Microsoft, and how it can be used to reduce the risk of network pivoting of attackers. [#thread 🧵(2/6)] One of the common vulnerabilities found in Windows domains is a distributed local administrator on the workstations (sometimes even servers). This means that if an attacker compromises one machine, all the machines with the same administrator password are owned.
Dec 3, 2021 11 tweets 7 min read
[#thread 🧵] For this third day of #CyberAdvent (3/24), I'll tell you a story. The story of how I gained root access to a server by leveraging a really fun feature in a web application. This #pentest #writeup will explain the complete process from recon to root. 🦋 [#thread 🧵(2/9)] In the recon phase of my pentest, as usual I was performing a port scan. In the output from nmap, I saw an uncommon port 86 with an HTTP server running "Micro Focus DSD 1.0.0":
Dec 2, 2021 8 tweets 5 min read
[#thread 🧵] For this second day of #CyberAdvent (2/24), we will be talking about a common #PrivilegeEscalation when using the * (wildcard) in shell scripts. Almost everyone has used at least once the * (wildcard) in a shell script but what really happens with the #wildcard ? 🦋 [#thread 🧵(2/7)] We will take as an example this shell script, performing a backup of a website using tar and a wildcard: Image
Aug 2, 2021 8 tweets 3 min read
[thread] Did you know that ssh tries to authenticate with stored keys BEFORE the key specified with -i in the command line ? I just noticed this, the hard way 😐.

Let's imagine you have more than 5 keys loaded in your ssh agent. When authenticating to a remote server, you get: After this message, ssh tries to authenticate with the keys in the order listed above. Why is that a problem ?

Because most servers have a default configuration with MaxAuthTries set to 6. After 6 tries, you will get a "Too many authentication failures" error.