@SecIDFR Interesting! I think it would be a good idea to check IsCanonical on the DACL
English
Robin Granberg
401 posts
Robin Granberg
@ipcdollar1
Works @ Semperis, Tweets are my own. Blog: https://t.co/XdICuDKHxR Project: https://t.co/Z7OT8sQOep
Katılım Eylül 2011
298 Takip Edilen379 Takipçiler
@ipcdollar1 Recently debug a delegation issue. 3 Ou with the same Deny. On one Ou the Deny was not effective. May be related to your finding. The next time I will use your article :).
English
Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't!
Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated.
New post: managedpriv.com/blog/acl-canon…
English
The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity.
If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. bit.ly/3Rl635L
English
Robin Granberg retweetledi
A tool you would use when you cant use BH :P
github.com/canix1/ADACLSc…
English
Robin Granberg retweetledi
English
@ipcdollar1 @oryair1999 @ShahakMo @safebreach You need to know the port where interface is running(that's why bind failed). You can use rpcview, then choose lsass.exe from the list and top left corner will show you the port.
English
Excited to release LDAPNightmare!
The first PoC tool exploiting CVE-2024-49112 that I created with @ShahakMo !
Check out the repo and blog post detailing about the vulnerability: github.com/SafeBreach-Lab…
Honored to be a part of the @safebreach labs team once again🫠
SafeBreach@safebreach
Starting 2025 strong! We’ve developed a PoC exploit for CVE-2024-49112. Read the blog and check out the GitHub repo: hubs.ly/Q030X5Y00 Just the beginning of the great things SafeBreach will deliver this year; stay informed at hubs.ly/Q030X2pM0. #CTEM #whatisPropagate
English
Robin Granberg retweetledi
M'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub: github.com/decoder-it/Krb…
English
Robin Granberg retweetledi
A short and light post on one of my favorite topics: spotting and exploiting GPO misconfigurations, nothing too technical, just the basics! 😅 decoder.cloud/2024/11/08/gro…
English
Robin Granberg retweetledi
@decoder_it You’re worth more… You’re awesome and I’m grateful to be working side by side with you 🙌
English
Robin Granberg retweetledi
Is Kerberos relaying so limited? I'd say no, thanks to @tiraniddo CredMarshalTargetInfo trick. In this case, I'm relaying SMB to HTTP (ADCS) with a modified version of @cube0x0 krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)
English
Robin Granberg retweetledi
🤫 The part I’m most excited about with my #BHUSA talk is secretly teaching everyone about identity components of #Entra multi-tenant applications and service principals. 🤓
If that sounds boring, pretend you didn’t read this.
#BlackHat2024 #infosec #EntraID #foreshadowing
Eric Woodruff | MVP | CIDPRO@ericonidentity
If you are curious how some lesser privileged admins in #Entra could have pivoted to Global Admin in a greenfield tenant, and you're going to be at #BHUSA, the knowledge on my important severity privilege elevation will be dropped 👇 #aad #m365 #azure #unoauthorized-a-technique-to-privilege-escalation-to-global-administrator-39231" target="_blank" rel="nofollow noopener">blackhat.com/us-24/briefing…
English
Robin Granberg retweetledi
Are you also on a conf bridge in the middle of the night dealing with Crowdstrike's bullshit?
English
Robin Granberg retweetledi
Utmärkt inlägg av Staffan Dahllöf (@StaffaniDK) på @SvDDebatt om regeringens massövervakningsförespråkande.
svd.se/a/jQlM4o/staff…
#ChatControl #GoingDark #svpol #eupol
Svenska
Robin Granberg retweetledi
Detecting Lateral Movement in Entra ID 😍
Threat actors can perform tenant-to-tenant lateral movement by abusing Cross Tenant Synchronisation.
Full blog 👇
xintra.org/blog/lateral-m…
You can detect lateral movement from specific logons abusing this feature in Entra ID 😝
This blog covers:
> Attack methodology
> Detection methodology
English
Robin Granberg retweetledi
Just published a short blog post on abusing the SeRelabelPrivilege ;) decoder.cloud/2024/05/30/abu…
English
I have written a new blog post about Entra ID PIM and how Sensitive Actions are supposed to protect privileged objects. But there is a situation you need to be aware of when working with PIM.
managedpriv.com/blog/breaching…
#EntraID #Cybersecurity #PIM #PrivilegeIdentityManagement
English