Published inPosts By SpecterOps Team Members·PinnedCertified Pre-OwnedTL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re also presenting this material at Black Hat USA 2021. [EDIT 06/22/21] — We’ve updated some of the details for ESC1 and ESC2 in this…Active Directory22 min readActive Directory22 min read
Published inPosts By SpecterOps Team Members·Nov 9, 2022Certificates and Pwnage and Patches, Oh My!This post was written by Will Schroeder and Lee Christensen. A lot has happened since we released the “Certified Pre-Owned” blog post and whitepaper in June of last year. While the paper details a LOT of tradecraft ranging from credential theft to domain persistence, the part that caught most people’s…Active Directory16 min readActive Directory16 min read
Published inPosts By SpecterOps Team Members·Jul 7, 2022Koh: The Token StealerEdit 07/13/22: After an awesome back and forth with Clément Notin and @SteveSyfuhs on Twitter on the effects of “TokenLeakDetectDelaySecs” and “Protected Users” for mitigating token theft, I’ve updated the Koh README to reflect these mitigations. Years ago I was chatting with a few experienced red teamers and one was…Windows11 min readWindows11 min read
Published inPosts By SpecterOps Team Members·Jun 1, 2022DeepPass — Finding Passwords With Deep LearningOne of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies from environment to environment, there is one common target that everyone’s always interested in: passwords. After diving into machine learning from an adversarial perspective I started to pay attention…Machine Learning12 min readMachine Learning12 min read
Published inPosts By SpecterOps Team Members·May 4, 2022Learning Machine Learning Part 3: Attacking Black Box ModelsIn the first post in this series we covered a brief background on machine learning, the Revoke-Obfuscation approach for detecting obfuscated PowerShell scripts, and my efforts to improve the dataset and models for detecting obfuscated PowerShell. We ended up with three models: a L2 (Ridge) regularized Logistic Regression, a LightGBM…Machine Learning24 min readMachine Learning24 min read
Published inPosts By SpecterOps Team Members·Apr 26, 2022Learning Machine Learning Part 2: Attacking White Box ModelsIn the previous post, I went through a very brief overview of some machine learning concepts, talked about the Revoke-Obfuscation project, and detailed my efforts at improving the dataset and models for detecting obfuscated PowerShell scripts. That resulted in three separate tuned models for obfuscated PowerShell script detection: a Logistic…Machine Learning25 min readMachine Learning25 min read
Published inPosts By SpecterOps Team Members·Apr 5, 2022Learning Machine Learning Part 1: Introduction and Revoke-ObfuscationFor the past two years I’ve been trying to get a grasp on the field of machine learning with the hopes of applying it to both offense and defense. At the beginning of this journey I had no idea what Random Forests were, the tradeoffs of underfitting and overfitting, what…Machine Learning28 min readMachine Learning28 min read
Jun 17, 2021Certified Pre-OwnedTL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re also presenting this material at Black Hat USA 2021. [EDIT 06/22/21] — We’ve updated some of the details for ESC1 and ESC2 in this…23 min read23 min read
Published inPosts By SpecterOps Team Members·Feb 28, 2019A Case Study in Wagging the Dog: Computer TakeoverLast month, Elad Shamir released a phenomenal, in depth post on abusing resource-based constrained delegation (RBCD) in Active Directory. One of the big points he discusses is that if the TrustedToAuthForDelegation UserAccountControl flag is not set, the S4U2self process will still work but the resulting TGS is not FORWARDABLE. This…Microsoft6 min readMicrosoft6 min read
Published inPosts By SpecterOps Team Members·Feb 20, 2019Kerberoasting RevisitedRubeus is a C# Kerberos abuse toolkit that started as a port of @gentilkiwi‘s Kekeo toolset and has continued to evolve since then. …Microsoft12 min readMicrosoft12 min read
