| Homepage | https://www.redteam-pentesting.de |
| Jobs | https://jobs.redteam-pentesting.de |
| Blog | https://blog.redteam-pentesting.de |
| Impressum | https://redteam-pentesting.de/imprint/ |
Our tool for KeyCredentialLinks and Shadow Credential attacks keycred now works with updated domain controllers again!
It turns out, Microsoft violated their own specs.
Try it out: https://github.com/RedTeamPentesting/keycred/
#infosec #security
Another interesting tidbit was that the share path can contain environment variables, which are expanded by the host.
This could reveal system level variables, which could be interesting in some configurations.
If you already own the computer account, and want to coerce a logged-in admin, you can use an S4U2self impersonation ticket for that user.
So if Defender prevents you from executing code on a computer with an admin, just let it snitch on the admin with a relayable NTLMv2-Hash🤯
