RedTeam Pentesting

952 posts

RedTeam Pentesting banner
RedTeam Pentesting

RedTeam Pentesting

@RedTeamPT

Official RedTeam Pentesting GmbH account -- Impressum: https://t.co/pS9oK62Lsu

Aachen, Germany Katılım Ocak 2017
174 Takip Edilen8.4K Takipçiler
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
@buck_steffen @0xFunnybananas @Defte_ Before the patch SELF also only had DS-Validated-Write-Computer permissions for msDS-KeyCredentialLink. That was the reason why you could not have more than one KeyCredentialLink per computer account. Only the validation check changed with the update.
English
1
0
3
152
Steffen Buck
Steffen Buck@buck_steffen·
@0xFunnybananas @Defte_ @RedTeamPT As far as I understand the patch, yes. The patch removed the explicit permissions to write to the msDS-KeyCredentialLink attribute for SELF. The computer account still has implicit permissions via DS-Validated-Write-Computer, but has to follow validation rules.
English
1
0
2
264
Aurélien Chalot
Aurélien Chalot@Defte_·
Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D
English
11
30
133
43K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
Originally, Microsoft did not enforce their own specs for validated writes at all and only checked if a KeyCredentialLink is already present. Now they require a CustomKeyInformation field with the "MFA Not Required" flag to be present and the last logon timestamp to be absent.
English
2
3
16
1.9K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!
English
2
17
67
5.9K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
🔥Only 10 days left until the Haix-la-Chapelle 2025 CTF is starting on November 29! We're sponsoring the prize money for the best writeups and are excited to see your creative solutions. haix-la-chapelle.eu
English
1
1
1
591
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
@RedHatSecurity How can we get these Ghostscript RCEs (CVE-2025-27835 and others) that have been public for 8 months fixed in RHEL? We received no response on Bugzilla. x.com/RedTeamPT/stat…
RedTeam Pentesting@RedTeamPT

🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

English
0
1
16
1.8K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
Disclaimer: We did not discover this vulnerability (credits go to zhutyra🎉), we're just wondering why we can still exploit these vulnerabilities in pentests on patched systems 🤷 We received no response on the @RHEL bug tracker: bugzilla.redhat.com/show_bug.cgi?i…
English
0
1
4
675
RedTeam Pentesting retweetledi
🕳
🕳@sekurlsa_pw·
Why doesn’t pretender from @RedTeamPT get more love? It’s excellent for relaying.
🕳 tweet media
English
3
26
134
9.2K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
@SpecterOps found out that the EFS service (PetitPotam) can simply be activated by asking the endpoint mapper. Great research!🎓 Now our efsr_spray NetExec module is obsolete, but we're on it: This PR activates the service by default with coerce_plus 🚀 github.com/Pennyw0rth/Net…
SpecterOps@SpecterOps

Hosts running the WebClient service are prime targets for NTLM relay attacks, and it may be possible to start the service remotely as a low-privileged user. @0xthirteen breaks down the service startup mechanics, plus the protocols and technologies. ghst.ly/41QT7GW

English
0
38
138
9.5K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
Check out our Impacket PR that adds SMB signing support (NTLM and Kerberos) to smbserver to allow Windows 11 clients that require signing by default to connect: github.com/fortra/impacke…
English
2
12
46
4.1K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
Another interesting tidbit was that the share path can contain environment variables, which are expanded by the host. This could reveal system level variables, which could be interesting in some configurations.
RedTeam Pentesting tweet media
English
1
3
10
1.9K
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
👀Turns out MS-EVEN can do a lot more than NULL auth: In addition to leaking environment variables, it is possible to coerce authentication from arbitrary logged on users* 🤯 *If you are willing to trigger Windows Defender.
English
1
46
166
19.7K

Keşfet

@buck_steffen @0xFunnybananas @Defte_ @thomasrinsma @CodeanIO @aegixe_team @RHEL @AlmaLinux