Jacob Paullus
@psycep_
@Mandiant Red Teamer / Something something views are my own
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS. Hope you enjoy the blog & tool drop 🤟 ibm.com/think/x-force/…
Publishing a new blog and tool tomorrow 👀
ANOTHA ONE ☝️ check out our latest @Mandiant blog, showcasing the terrifying Browser-in-the-Middle techniques of the modern social engineer cloud.google.com/blog/topics/th…
Our blog on CVE-2023-6080 is here 💥 check it out! We detail the discovery and exploitation process, going from low privilege to SYSTEM 😎 cloud.google.com/blog/topics/th…
T-Minus two weeks until my first Mandiant blog as the principal author drops as well 🥳 (Detailing the discovery of CVE-2023-6080)
Contributed to my first Mandiant blog on web applications, check it out! Officially on my way to becoming a certified web boy (pls no) 🕸️🕸️ cloud.google.com/blog/topics/th…
Contributed to my first Mandiant blog on web applications, check it out! Officially on my way to becoming a certified web boy (pls no) 🕸️🕸️ cloud.google.com/blog/topics/th…
Excited to finally share some details of my favorite CVE, discovered with @psycep_ (definitely give him a follow)! This one’s a fun local privilege escalation vulnerability in Lakeside Software’s SysTrack LsiAgent Installer – CVE-2023-6080 🤜🤛 github.com/mandiant/Vulne…
A long time in the making, my first credited CVE! cve.org/CVERecord?id=C… w/ @AndrewOliveau and Jake Rawlins
Excited to share the (now patched) AKS Privilege Escalation we found! cloud.google.com/blog/topics/th…
6 business weeks later, the blog is here! 🙌 Check it out: cloud.google.com/blog/topics/th…
It got delayed :’(
Another option is to run “openssl s_client -connect <DC>:636 -showcerts -debug” and look for the CA server tied to the domain controller.
Wanna blindly check if the ADCS web enroll is installed on a domain ? Bruteforce the /certenroll endpoint without the trailing/ on all webservers. If you hit the ADCS web enroll you will get a location: /certenroll/ header in the response. Now enjoy blind ntlmrelayx ESC8👀👀👀
United States Trends
- 1. #CARTMANCOIN 1,823 posts
- 2. yeonjun 243K posts
- 3. Broncos 67.2K posts
- 4. Raiders 66.8K posts
- 5. Bo Nix 18.4K posts
- 6. Geno 19K posts
- 7. daniela 51.8K posts
- 8. Sean Payton 4,844 posts
- 9. #NOLABELS_PART01 107K posts
- 10. #criticalrolespoilers 5,147 posts
- 11. Kehlani 10.7K posts
- 12. #iQIYIiJOYTH2026xENGLOT 452K posts
- 13. #Pluribus 2,962 posts
- 14. Danny Brown 3,188 posts
- 15. Kenny Pickett 1,520 posts
- 16. NO LABELS NOVEMBER 28.5K posts
- 17. Chip Kelly 2,002 posts
- 18. TALK TO YOU OUT NOW 29.3K posts
- 19. Tammy Faye 1,462 posts
- 20. Vince Gilligan 2,673 posts
Something went wrong.
Something went wrong.