In April 2018, Casey Smith published a finding he dubbed squiblytwo, which detailed how WMIC can be used to invoke arbitary code contained in the extensible stylesheet language (XSL) format.

Along with Cn33liz, I recently had the pleasure of assisting Nikhil Mittal with his 2018 BruCON spring training: Active Directory Attacks for Red and Blue Teams.

Persistence, noun, the continued or prolonged existence of something.

In Part 1 we explored how one could go about discovering and mapping the LAPS configuration in a domain. In this part, we’ll look at various ways LAPS can be abused for persistence purposes.

Tim MalcomVetter caused a bit of stir over his Responsible Red Teams post last week, which is not surprising since he was pretty fucking rude about the whole thing.

Where a 10-year old backup can fcuk you in the ass…

Introduction

In Part 1, we looked at using Terraform to deploy cloud infrastructure (VMs, firewalls, DNS records etc). In this post, we’ll look at some examples for automating the installation of tools/software on the VM resources.

Introduction

This short post demonstrates how it may be possible to pivot into a segregated/protected network, via an RDP Jump Box.

Introduction

Deploying resiliant Red Team infrastructure can be quite a time consuming process. This wiki maintained by Steve Borosh and Jeff Dimmock is probably the best public resource I’ve seen in regards to design considerations and hardening tips.

For someone like myself, who destroys and stands fresh infrastructure up for each engagement, building everything by hand is a long, laborious process. Anything that can be automated is a good thing.