SpecterOps Blog

Research & Tradecraft

SCCM Hierarchy Takeover

One Site to Rule Them All tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative…

Research & Tradecraft

Ghostwriter v4: 2FA, RBAC, and Logging, Oh My!

Ghostwriter v4 is officially here! Technically, it’s been available as a release candidate for a while, but we have arrived…

Research & Tradecraft

Reactive Progress and Tradecraft Innovation

Detection as Prediction The overarching goal of a security operations program is to prevent or mitigate the impact of an…

Research & Tradecraft

Shadow Wizard Registry Gang: Structured Registry Querying

Why Do We Need New Tooling for Registry Collection? The Windows registry, an intricate database storing settings for both the…

Research & Tradecraft

Crypto Census: Automating Cryptomining Domain Indicator Detections

Research & Tradecraft

Site Takeover via SCCM’s AdminService API

tl:dr: The SCCM AdminService API is vulnerable to NTLM relaying and can be abused for SCCM site takeover. Prior Work…

Research & Tradecraft

Hacking With Your Nemesis

In the first post in this series, On (Structured) Data, we talked about the gap area of offensive structured data…

Research & Tradecraft

Challenges In Post-Exploitation Workflows

In our previous post, we talked about the problem of structured data in the post-exploitation community. We touched on the…

Research & Tradecraft

On (Structured) Data

Introduction The offensive security industry is a curious one. On the one hand, we are ahead in various trends (or…