Romern

39 posts

Romern

Romern

@Romerrn

Katılım Nisan 2020
289 Takip Edilen39 Takipçiler
Romern retweetledi
SafeBreach
SafeBreach@safebreach·
SafeBreach Labs discovered a critical RCE vulnerability in the MS-EVEN RPC protocol that allowed low-privileged domain users to write arbitrary files and run code on remote Windows 11 and Windows Server 2025 computers in the domain. Get the full breakdown: hubs.ly/Q043PMZ-0
SafeBreach tweet media
English
3
27
54
7.1K
Aurélien Chalot
Aurélien Chalot@Defte_·
@RedTeamPT So it's still possible for a computer to add a keycredentiallink to itself ? We only need to modify some flags ? Great work anyway 🥳🥳
English
1
0
4
345
Aurélien Chalot
Aurélien Chalot@Defte_·
Anyone know if Microsoft silently patch the Shadow Creds attack recently ? Looks like a computer object cannot write its own attribute anymore :D
English
11
30
133
43K
Romern
Romern@Romerrn·
@Defte_ @MGrafnetter From what I looked at yesterday there just weren’t any checks before, except if it parsed at all. I attached the new function and an analysis of it with pyghidra-mcp and Claude haiku at the end of the gist: #file-xclaude_haiku_analysis-md" target="_blank" rel="nofollow noopener">gist.github.com/Romern/69a60b9…
English
0
0
0
128
Aurélien Chalot
Aurélien Chalot@Defte_·
@MGrafnetter Alright so they probably modified who's able to write that attribute I'd say... Pywhisker does work with a domain admin so that's the only thing I can think of
English
2
0
2
1.5K
Romern
Romern@Romerrn·
@Defte_ @MGrafnetter WRITE_PROPS on keycredentials on a server 2025 (retrieved using bloodyAD --resolve-sd):
Romern tweet media
English
1
0
1
114
Romern
Romern@Romerrn·
@Defte_ @MGrafnetter Note that most administrator groups (at a glance at least Key Admins, Enterprise Key Admins and Administrators) have WRITE_PROP privileges on that attribute, so in that case there is no validation.
English
1
0
1
204
Romern
Romern@Romerrn·
@Defte_ I just installed a clean version of Server 2022 (20348.169), setup it up as a DC, and tried to create a keycredential. That worked. Than I installed the latest cumulative update (KB5073457) and now it does not work anymore. So it seems to be a recent change.
Romern tweet media
English
2
4
14
2.5K
Romern
Romern@Romerrn·
@Defte_ Could you increase the SMB timeout to show the error message or show it in wireshark ?
English
1
0
0
417
Aurélien Chalot
Aurélien Chalot@Defte_·
Anyone know wtf is happening ? Authenticating via NTLM on DC2025 seems a bit broken while working completely fine with Kerberos:
Aurélien Chalot tweet media
English
6
4
47
7.3K
Romern
Romern@Romerrn·
We just released my writeup for my first CTF challenge I ever created, "Ghostbusters" for Haix-La-Chapelle 2025 CTF. it involves some cool techniques for exploiting Ghostscript and PDF/PostScript file type confusion. pwn-la-chapelle.eu/posts/hlc2025_…
English
0
0
1
100
Romern retweetledi
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
🎄Care for some Glühwein and flags? The Haix-la-Chapelle CTF 2025 starts tomorrow! 🍷 @Pwn_la_Chapelle@infosec.exchange/115627727047022848" target="_blank" rel="nofollow noopener">mastodon.social/@Pwn_la_Chapel…
English
0
1
2
896
Romern retweetledi
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
🔥Only 10 days left until the Haix-la-Chapelle 2025 CTF is starting on November 29! We're sponsoring the prize money for the best writeups and are excited to see your creative solutions. haix-la-chapelle.eu
English
1
1
1
591
userlolxxl
userlolxxl@userlolxxl·
@Romerrn @KulinskiArkadi Download here giac.org/paper/gdat/578… and go to the page 18 "A second example is the lkpfye.exe file, which VirusTotal says communicates with ilo[.]brenz[.]pl at IP 148[.]81[.]111[.]12 ... (I renamed the PDF as you can read in in the path of the file that was found in app/temp
userlolxxl tweet mediauserlolxxl tweet media
English
1
1
2
100
userlolxxl
userlolxxl@userlolxxl·
hmm:)spy>> ghostscript ran in the background - I found tmp pointing to "ILO-BRENZ-PL_all-seeing-eye-sauron-powershell-tool-data-collection-threat-hunting_578.pdf" related with Copy of ilo brenz pl >>> wget-ilo.exe virustotal.com/graph/embed/g4… cc:@KulinskiArkadi
userlolxxl tweet media
English
2
5
6
933
Romern
Romern@Romerrn·
@nmatt0 I messed with that last month too, I got into the Android Browser through a link in Mini Metro. However the Android Settings were locked down, so accessing the local network was all I could achieve (no internet), and it was right at the end of the flight 😅
English
0
0
10
191
Matt Brown
Matt Brown@nmatt0·
Kiosk escape is so close
Deutsch
5
4
45
2.6K
Jeff McJunkin
Jeff McJunkin@jeffmcjunkin·
@RedTeamPT Great paper and blog post! Minor nit: > SMB relaying is possible unless server-side SMB signing is enforced. [...] on servers it is only enforced by default on domain controllers. SMB signing is enabled by default in Server 2025 now: learn.microsoft.com/en-us/windows-…
English
1
0
4
140
RedTeam Pentesting
RedTeam Pentesting@RedTeamPT·
🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live: 🪞 The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos: blog.redteam-pentesting.de/2025/reflectiv…
English
8
174
424
38.6K
LuemmelSec
LuemmelSec@theluemmel·
There was a post lately about SMB errorcodes being sent which resulted in Webdav being used as fallback plus a PR for impacket that implements this? Can't find it anymore...
English
4
2
22
4.3K

Keşfet

@Defte_ @RedTeamPT @buck_steffen @MGrafnetter @userlolxxl @KulinskiArkadi @elonmusk @BarackObama