| X | @_xpn_ |
| Blog | https://blog.xpnsec.com |
| Mastodon (redirect) | [email protected] |
| BSky | https://bsky.app/profile/xpnsec.com |
Thanks to everyone who attended my talk at #39C3 - it was great fun đ
Hereâs a slightly modified video of the demo at the end of the talk.
#whitedate is still down. #whitedeal and #whitechild show a front page but arenât functional - letâs see how long it stays that way.
Many thanks to DDoSecrets and the antifa for their work and support.
Not all details will follow right now -we gotta keep a bit of the magic alive.
A more detailed report will appear in due time.
Up until recently, we've enjoyed in-memory loading of Mach-O bundles courtesy of dyld and its NSCreateObjectFileImageFromMemory/NSLinkModule API methods. And while these methods still exist today, there is a key difference.. memory modules are now persisted to disk. So in this post we'll take a look at just what was changed in dyld, and see what we can do to restore this functionality... hopefully keeping our warez in memory for a little longer.
Bypassing #Kerberoasting detections by using TrustedSecâs new #Orpheus tooling.
This changes the request for the juicy SPN youâre after so that the Kerberos options (0x40810010) and
ticket type (RC4 0x17) are no longer used and therefore detectedđĽ 
To counter this, create and alert on âHoney SPNsâ and hope that the attackers query one of these instead - these accounts should never be queried.
https://www.trustedsec.com/blog/the-art-of-bypassing-kerberoast-detections-with-orpheus/
back2theRoot
Mark 
Johnathan Norman
Dominic White
Moanos