- Jumping Network Segregation with RDP rastamouse.me/2017/08/jumpin… Shout-out to @gentilkiwi for DPAPI magic
- Assembly for n00bs with hand-on labs. Anyone interested in seeing this? 😛
- Some pretty cool OPSEC-specific challenge labs coming to RTO soon (hopefully 🤞🏻)
- Pretty stoked that I finally got Red Team Ops approved against the CREST Certified Simulated Attack Specialist (CCSAS) examination.
- Found a funny way to detect Rubeus. There's a typo in the process name used when calling LsaRegisterLogonProcess, which shows up in the Windows audit logs. Not sure if that was intentional given the code comment right next to it.
- Ok, pinvoke.dev is now live. A simple GitBook of code-generated P/Invoke signatures. Just C# for now, but I may add Rust and a few others in the future.
- [BLOG] Short post on how to do NTLM relaying via Cobalt Strike using PortBender, WinDivert and ntlmrelayx. rastamouse.me/ntlm-relaying-…
- Using @rogue_kdc's CVE-2019-084 to backdoor the LAPS AdmPwd DLL and get code exec as SYSTEM on each Group Policy update. Thanks to @_RythmStick for the idea of targeting LAPS for the priv esc.
- Working on breaking RTO out into a more structured learning path with smaller, more manageable courses. This is how it'll look.
- [BLOG] New tool from @_xpn_ and myself - a proof of concept .NET C2 framework. All feedback and comments welcome. rastamouse.me/2020/05/sharpc…
