Remote-Desktop-Caching-

Remote-Desktop-Caching- Questo strumento consente di recuperare informazioni delle vecchie sessioni RDP mstsc sotto forma di file PNG danneggiati. Questi file PNG permettono ai membri del Red Team di estrarre informazioni succose come le password LAPS o qualsiasi informazione sensibile sullo...

SharpLAPS

SharpLAPS Das Attribut ms-mcs-AdmPwd speichert das Klartext-LAPS-Passwort. Diese ausführbare Datei ist dafür ausgelegt, innerhalb einer Cobalt-Strike-Sitzung mit execute-assembly ausgeführt zu werden. Sie ruft das LAPS -Passwort aus dem Active Directory ab. Erfordert entweder: Konto mit...

CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...

DonPAPI - Dumping DPAPI Credz Remotely

Dumping revelant information on compromised targets without AV detection DPAPI dumping Lots of credentials are protected by DPAPI. We aim at locating those "secured" credentials, and retreive them using : User password Domaine DPAPI BackupKey Local machine DPAPI Key protecting TaskScheduled blob...