Red Teaming
-
Centurion: Bring Your Own Execution Environment
How we built a custom virtualized loader with its own ISA, PE loader, TLS stack, and software crypto coprocessor in about a week using LLM-assisted development — and what the BYOEE model means for offensive tooling.
read more → -
Et Tu, RDP? Detecting Sticky Keys Backdoors with Brutus and WebAssembly
How we built automated RDP sticky keys backdoor detection into Brutus using WebAssembly to embed IronRDP, a Rust RDP library, into a single statically-linked Go binary.
read more → -
Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
Introducing Brutus, a multi-protocol credential testing tool written in Go that ships as a single zero-dependency binary. Covers why Hydra falls short of modern JSON reconnaissance pipelines, compiled-in known-compromised SSH key collections, spraying recovered private keys across segmented networks, and experimental LLM-driven credential discovery.
read more → -
Domain Fronting is Dead. Long Live Domain Fronting!
We discovered that domain fronting still works against Google's infrastructure, enabling covert C2 traffic through services like Google Meet, YouTube, and GCP. This research demonstrates how attackers can tunnel traffic through domains too critical for organizations to block.
read more → -
Beyond the Last Mile: How Internet Routing Shapes Red Team Ops
Understanding how internet routing infrastructure impacts red team operations, particularly for traffic tunneling and data exfiltration. Exploring why routing paths, international transit, and peering relationships often matter more than raw connection speeds.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
Part two of the Ghost Calls series details how we tunnel real-time C2 traffic through Zoom and Microsoft Teams TURN infrastructure using WebRTC — covering the approaches we evaluated, the WebRTC protocol suite, our SCTP-based implementation, and a walkthrough of the TURNt utility.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
Part one of the Ghost Calls series takes apart how web conferencing platforms work under the hood, using Zoom as the primary example — the Multi-Media Router and Zone Controller architecture, RTP media handling, the fallback chain Zoom uses to stay connected through restrictive networks, and the TURN infrastructure that makes it all work.
read more → -
Elevating Privileges with Authentication Coercion Using DFSCoerce
DFSCoerce abuses the MS-DFSNM interface to coerce a domain controller into authenticating to an attacker-controlled host, giving another coercion primitive alongside PrinterBug and PetitPotam for driving relay attacks.
read more → -
Relaying to ADFS Attacks
Active Directory Federation Services accepts Windows Integrated Authentication, which makes it a viable relay target. Covers relaying coerced NTLM authentication to ADFS to obtain tokens for federated cloud applications, and the conditions that make it work.
read more → -
Computer Account Relaying Vulnerabilities Part 2
Part two revisits Computer AdminTo Computer relationships with newer coercion primitives and relay targets, and covers what changed in the technique since the original writeup.
read more → -
PortBender: TCP Port Redirection for Red Team Operations
How to redirect traffic from an incoming TCP port using the PortBender utility to perform SMB relay attacks and simulate Duqu 2.0-style persistence through a C2 framework like Cobalt Strike.
read more → -
How to Exploit Active Directory ACL Attack Paths Through LDAP Relaying Attacks
Active Directory ACL attack paths normally need credentials for the principal holding the right. Relaying coerced authentication to LDAP lets you exercise those rights without ever recovering a password, covering GenericAll, WriteDacl, and resource-based constrained delegation edges.
read more → -
Active Directory Computer Account SMB Relaying Attack
Part one on Computer AdminTo Computer relationships: where a computer account holds administrative rights over another host, coercing its authentication and relaying it over SMB turns that relationship into lateral movement.
read more → -
Obtaining LAPS Passwords Through LDAP Relaying Attacks
Coercing authentication from a domain controller and relaying it to LDAP yields read access to LAPS-managed local administrator passwords. Covers the preconditions, the relay path, and why LDAP signing does not fully close it.
read more → -
Extending LLVM for Code Obfuscation (2 of 2)
Part two of the LLVM code obfuscation series. This installment covers developing a more complex pass that automatically encrypts string literals during the compilation process by manipulating the LLVM IR.
read more → -
Extending LLVM for Code Obfuscation (1 of 2)
An introduction to binary obfuscation techniques through LLVM compiler customization. Part one covers LLVM fundamentals, development environment setup, and developing an LLVM pass for junk code insertion.
read more →