Published in Posts By SpecterOps Team Members·PinnedCertified Pre-OwnedTL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re also presenting this material at Black Hat USA 2021. [EDIT 06/22/21] — We’ve updated some of the details for ESC1 and ESC2 in this…Active Directory22 min read
Published in Posts By SpecterOps Team Members·Jun 1DeepPass — Finding Passwords With Deep LearningOne of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies from environment to environment, there is one common target that everyone’s always interested in: passwords. After diving into machine learning from an adversarial perspective I started to pay attention…Machine Learning12 min read
Published in Posts By SpecterOps Team Members·May 4Learning Machine Learning Part 3: Attacking Black Box ModelsIn the first post in this series we covered a brief background on machine learning, the Revoke-Obfuscation approach for detecting obfuscated PowerShell scripts, and my efforts to improve the dataset and models for detecting obfuscated PowerShell. …Machine Learning24 min read
Published in Posts By SpecterOps Team Members·Apr 26Learning Machine Learning Part 2: Attacking White Box ModelsIn the previous post, I went through a very brief overview of some machine learning concepts, talked about the Revoke-Obfuscation project, and detailed my efforts at improving the dataset and models for detecting obfuscated PowerShell scripts. That resulted in three separate tuned models for obfuscated PowerShell script detection: a Logistic…Machine Learning25 min read
Published in Posts By SpecterOps Team Members·Apr 5Learning Machine Learning Part 1: Introduction and Revoke-ObfuscationFor the past two years I’ve been trying to get a grasp on the field of machine learning with the hopes of applying it to both offense and defense. At the beginning of this journey I had no idea what Random Forests were, the tradeoffs of underfitting and overfitting, what…Machine Learning28 min read
Jun 17, 2021Certified Pre-OwnedTL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re also presenting this material at Black Hat USA 2021. [EDIT 06/22/21] — We’ve updated some of the details for ESC1 and ESC2 in this…23 min read
Published in Posts By SpecterOps Team Members·Feb 28, 2019A Case Study in Wagging the Dog: Computer TakeoverLast month, Elad Shamir released a phenomenal, in depth post on abusing resource-based constrained delegation (RBCD) in Active Directory. One of the big points he discusses is that if the TrustedToAuthForDelegation UserAccountControl flag is not set, the S4U2self process will still work but the resulting TGS is not FORWARDABLE. …Microsoft6 min read
Published in Posts By SpecterOps Team Members·Feb 20, 2019Kerberoasting RevisitedRubeus is a C# Kerberos abuse toolkit that started as a port of @gentilkiwi‘s Kekeo toolset and has continued to evolve since then. For more information on Rubeus, check out the “From Kekeo to Rubeus” release post, the follow up “Rubeus — Now With More Kekeo”, or the recently revamped…Microsoft12 min read
Published in Posts By SpecterOps Team Members·Nov 28, 2018Not A Security Boundary: Breaking Forest TrustsFor years Microsoft has stated that the forest was the security boundary in Active Directory. For example, Microsoft’s “What Are Domains and Forests?” document (last updated in 2014) has a “Forests as Security Boundaries” section which states (emphasis added): Each forest is a single instance of the directory, the top-level…Active Directory14 min read
Published in Posts By SpecterOps Team Members·Oct 25, 2018Another Word on DelegationEvery time I think I start to understand Active Directory and Kerberos, a new topic pops up to mess with my head. A few weeks ago, @elad_shamir contacted @tifkin_ and myself with some ideas about resource-based Kerberos constrained delegation. Thanks to Elad’s ideas, the great back and forth, and his…Kerberos7 min read
