SpecterOps Blog

Research & Tradecraft

ghostsurf: From NTLM Relay to Browser Session Hijacking

TL;DR: ntlmrelayx‘s SOCKS proxy works great for SMB and MSSQL but fails when you try to browse a web application…

Research & Tradecraft

The Nemesis 2.X Development Guide

TL;DR: Nemesis 2.X makes it easy to extend the platform – this guide walks through creating new file enrichment modules…

Research & Tradecraft

Nemesis 2.2

TL;DR: Nemesis 2.2 introduces a number of powerful new features focusing on large container processing, data processing agents, enhanced DPAPI…

Research & Tradecraft

Task Failed Successfully – Microsoft’s “Immediate” Retirement of MDT

TL;DR – After reporting vulnerabilities found in MDT, Microsoft chose to retire the service rather than fix the issues. As…

Research & Tradecraft

One WSL BOF to Rule Them All

TL;DR – Windows Subsystem for Linux (WSL) is a powerful way for attackers to hide from defenders, since WSL2 is…

Research & Tradecraft

SCCM Hierarchy Takeover via Entra Integration…Because of the Implication

TL;DR SCCM sites (prior to KB35360093) integrated with Entra ID can be abused to compromise the entire hierarchy. Introduction Despite…

Industry Insights

DPAPI Backup Key Compromise Pt. 1: Some Forests Must Burn

TL;DR The industry recommendation for DPAPI backup key compromise remediation is to destroy and rebuild the environment. This article aims…

Industry Insights

Getting the Most Value Out of the OSCP: After the Exam

TL;DR In the final post of this series, I’ll discuss what to do after your latest exam attempt to get…

Research & Tradecraft

Entering a Covenant: .NET Command and Control