SpecterOps Blog

Research & Tradecraft

SCOMmand and Conquer – Attacking System Center Operations Manager (Part 1)

TL:DR SCOM suffers from similar insecure default configurations as its SCCM counterpart, enabling attackers to escalate privileges, harvest credentials, and…

Research & Tradecraft

SCOMmand And Conquer – Attacking System Center Operations Manager (Part 2)

TL;DR: We found that SCOM RunAs credentials could be obtained on-host and also off-host in certain configurations and wrote a…

Research & Tradecraft

Git SCOMmit – Putting the Ops in OpsMgr

TL;DR Yet another System Center Ludus configuration for your collection. https://github.com/Synzack/ludus_scom Intro As you may know, here at SpecterOps we…

Industry Insights

Getting the Most Value Out of the OSCP: The PEN-200 Labs

TL;DR How to leverage the PEN-200 simulated black-box penetration testing scenarios for maximal self-improvement and career success. Introduction In the…

The Defender’s Guide to Windows Services

It’s dangerous to find malicious services alone! Take this! Authors: Luke Paine & Jonathan Johnson Introduction This is the second installment of…

BloodHound

Establish security boundaries in your on-prem AD and Azure environment

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after years…

Research & Tradecraft

Playing Detection with a Full Deck

Research & Tradecraft

Death from Above: Lateral Movement from Azure to On-Prem AD

Intro I’ve been looking into Azure attack primitives over the past couple of months to gain a better understanding of…