Kerberos AD Attacks - Kerberoasting

Recently I've been trying to make sure that my redteam knowledge is up to date, exploring many of the advancements in Active Directory Kerberos attacks... and there have been quite a few! I finally found some free time this week to roll up my sleeves and dig into the internals of some of these attacks, and hopefully document them for other people to learn. This post is the first in a series aimed at explaining what is happening under the hood when you execute your favourite Powerview or Mimikatz command to attack Active Directory via Kerberos, and hopefully giving people some other methods or…

Read more »

ExplodingCan - A vulnerability review

A few months ago, my colleagues over at Secarma released a review of ExplodingCan, one of the many exploits released as part of the ShadowBrokers dump. At the time I was asked to complete a review of the vulnerability, specifically how this affected a vulnerable server and if anything could be done to protect users. My analysis of the vulnerability can now be found over at Secarma Labs: https://www.secarma.co.uk/labs/explodingcan-a-vulnerability-review/ Enjoy :)…

Read more »

Analysis of APT28 hospitality malware (Part 2)

In the first part of this malware review, we looked at the VBA code used by APT28 to drop a DLL onto the victims' machine as part of their recently highlighted hospitality campaign. In this post, we will look at the dropped file, and understand just what it does, and how we can analyse it using IDA Pro. So we know from the first post that we have a DLL, which is run using the following command: rundll32.exe %APPDATA%\user.dat,#1 Loading the extracted DLL into IDA, the first thing that we notice is that we have an exported function of load with an ordinal of 1: We know from the rundll32.exe com…

Read more »

Analysis of APT28 hospitality malware

This week, FireEye published a writeup of yet another APT28 campaign, this time targeting the hospitality sector: Exposing Russian hackers #APT28 and their targeting of hotels & travelers. Also first targeted use of ETERNALBLUE.https://t.co/iiHh71UQeF pic.twitter.com/SIMeDd7MTM— Nick Carr (@ItsReallyNick) August 11, 2017 I'm always interested to see the latest APT group techniques, so I decided to review the malware to see how the dropper worked (and see if there were any goodies I could add to my toolkit). The dropper was shown to be a typical Word .docm file (MD5: 9b10685b774a78…

Read more »

How GitHub login detection banner works

Sometimes I come across things non-security related that intrigue me, albeit mostly I'm thinking how I can use it to exploit a service, but still... One such piece of functionality caught my interest, a banner displayed at the top of GitHub: I was thinking of the different ways that this type of functionality could be achieved. We have seen similar methods of detection exploited in the past to leak out information, although much more targeted at cross-origin detection (such as Social Media Fingerprint which identify images only delivered to authenticated users). I fired up Chrome's network act…

Read more »