LocalKDC: A Kerberos KDC Inside Every Windows Machine
The gap LocalKDC fills
Recent Posts
IAKerb on MIT and Samba: A Pre-Windows Attack-Surface Baseline
Why baseline before Windows
IAKerb: Kerberos When You Cannot Reach a KDC
The gap IAKerb fills
HackTheBox: DarkZero
This box is rated hard difficulty on HTB. It involves us using given credentials to attack a linked MSSQL server, enabling xp_cmdshell to grant command execu...
Forging a Device Claim to Beat a Tier-0 Silo
How claims and silos work
SteadFAST: Armored Kerberos Offensive Tooling for Fail-Unarmored Domains
This is part two of a two-part series on Kerberos FAST armoring. Part one covered the protocol mechanics and how enforcement behaves at the AS and TGS layers...
Kerberos FAST Armoring: What It Is and How Enforcement Actually Works
This is part one of a two-part series on Kerberos FAST armoring. Part one covers the protocol mechanics and how enforcement behaves at the AS and TGS layers....
What Samba 4.24 Actually Checks When It Re-Issues a PAC
I spent a session pointing my PAC mutation tooling at a Samba 4.24 AD DC to find a place where Samba and Windows disagree about PAC signatures. The thesis wa...