Cross-Forest DAC Claims: What AllowAll Actually Allows
The question
Recent Posts
Forging a Device Claim to Beat a Tier-0 Silo
How claims and silos work
SteadFAST: Armored Kerberos Offensive Tooling for Fail-Unarmored Domains
This is part two of a two-part series on Kerberos FAST armoring. Part one covered the protocol mechanics and how enforcement behaves at the AS and TGS layers...
Kerberos FAST Armoring: What It Is and How Enforcement Actually Works
This is part one of a two-part series on Kerberos FAST armoring. Part one covers the protocol mechanics and how enforcement behaves at the AS and TGS layers....
What Samba 4.24 Actually Checks When It Re-Issues a PAC
I spent a session pointing my PAC mutation tooling at a Samba 4.24 AD DC to find a place where Samba and Windows disagree about PAC signatures. The thesis wa...
PACMutator: Fuzzing the PAC Validator Instead of Forging Tickets
What a PAC is, and why it is worth attacking
HackTheBox: Mirage
This box is rated hard difficulty on HTB. It involves us finding an exported NFS share containing sensitive PDF documents which disclose a missing DNS record...
Testing the Windows Server 2025 PKINIT Algorithm-Agility Downgrade Surface
PKINIT gained real cryptographic agility over the last few years. RFC 8636 added key-derivation negotiation, RFC 8070 added freshness, and Microsoft’s MS-PKC...