This post reviews how the Kerberos Bronze Bit vulnerability (CVE-2020-17049) can be exploited in practice. I strongly suggest first reading the Bronze Bit Attack in Theory post to understand why and how this attacks works. It is also worth noting that Microsoft published a patch for the vulnerability on November 10, 2020. The patch rollout […]
Introduction and Background This attack expands upon the excellent research documented by Elad Shamir in “Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory.” I’ll cover the key points below, but his article a great resource and primer for Kerberos and constrained delegation in AD. If you’re already familiar with the Kerberos fundamentals, […]
With the release of Microsoft’s patch to fix CVE-2020-17049, I’m excited to share details about this vulnerability and how it could be exploited. This post is only a very high-level overview, and I strongly encourage readers who are interested to check out my follow-up posts which provide much more depth: To learn about Kerberos, Kerberos […]
TL;DR Use NetblockTool to easily dump a unique list of IP addresses belonging to a company and its subsidiaries. Download the tool here: https://github.com/NetSPI/NetblockTool The Problem A problem that I was frequently running into for both offensive and defensive roles is determining the IP addresses that a company owns and uses. Traditionally, gathering a list […]
It has been a while since the initial release (August 2018) of the Get-AzurePasswords module within MicroBurst, so I figured it was time to do an overview post that explains how to use each option within the tool. Since each targeted service in the script has a different way of getting credentials, I want users […]
If you’ve used OWASP’s DirBuster, you know it’s a great directory buster. Its speed and reliability make it one of the best directory busters currently available. However, it has one big limitation: it can only scan one target at a time. This is fine if you’re only attacking one target, but if you are attacking […]
We test a lot of web applications at NetSPI, and as everyone continues to move their operations into the cloud, we’re running into more instances of applications being run on Azure App Services. Whenever we run into an App Services application with a serious vulnerability, I’ll frequently get a ping asking about next steps to […]
Get-AzPasswords is a function within the MicroBurst toolkit that’s used to get passwords from Azure subscriptions using the Az PowerShell modules. As part of this, the function supports gathering passwords and certificates that are attached to automation accounts. These credentials can be stored in a few different ways: Credentials – Username/Password combinations Connections – Service […]
For many years, pentester-hosted SMB shares have been a common technology to use during internal penetration tests for getting tools over to, and data off of, target systems. The process is simple: share a folder from your testing system, execute a “net use z: \\testingbox\tools” from your target, and run your tools from the share. […]