tgt-monitor-bof

Kerberos TGT 监控与自动续期 本仓库包含两个异步 Beacon 对象文件 BOF。第一个 tgt-monitor 监控系统的 Kerberos 登录事件，并在捕获到新 Kerberos TGT 时唤醒代理。类似于 Rubeus 的 monitor 命令，该 BOF 会持续运行并定期检查 LSA 票据缓存。一旦检测到新的 TGT，它将打印票据元数据并输出 base64 编码的 kirbi 数据块，可用于通过传递票据攻击进行横向移动。第二个 tgt-renew 自动续期系统中剩余生命周期低于指定阈值（例如 15 分钟）的 TGT。 !Important 本仓库中的 BOF...

CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

Living off the land, GPO style

TL;DR The ability to edit Group Policy Object GPOs from non-domain joined computers using the native Group Policy editor has been on my list for a long time. This blog post takes a deep dive into what steps were taken to find out why domain joined machines are needed in the first place and what...