SpecterOps Blog

Research & Tradecraft

Part 3: Expanding the Function Call Graph

Research & Tradecraft

1Password Secret Retrieval — Methodology and Implementation

Background and Motivation 1Password is a password manager developed by AgileBits Inc., providing a place for users to store various passwords, software licenses,…

BloodHound

BloodHound versus Ransomware: A Defender’s Guide

Intro You don’t need me to tell you how dangerous and destructive ransomware is. It seems like every week there…

Research & Tradecraft

Attacking FreeIPA — Part IV: CVE-2020–10747

I was informed on Wednesday June 17th 2020 that CVE 2020–10747 was revoked after it had been initially issued on…

Research & Tradecraft

Attacking FreeIPA — Part III: Finding A Path

This post is Part III in a series about my experiences attacking FreeIPA. In Part I of this series, we…

Research & Tradecraft

Attacking FreeIPA — Part II Enumeration

In Part I of this series, we reviewed some of the background and underlying technologies utilized by FreeIPA. We also…

Research & Tradecraft

Attacking FreeIPA — Part I Authentication

Recently I had the opportunity to operate inside of an environment managed by FreeIPA. I wanted to take the time…

Research & Tradecraft

CVE-2019–12757: Local Privilege Escalation in Symantec Endpoint Protection

Research & Tradecraft

CVE-2019–13382: Local Privilege Escalation in SnagIt