• BloodHound: Intro to Cypher

    February 19, 2017 - 12 minute read
    Intro One of the most overlooked features of BloodHound is the ability to enter raw Cypher queries directly into the user interface. Likely, a lot of that has to do with the fact that it’s not a very emphasized feature, not to mention it requires learning Cypher. However, with a bit of work, using raw Cypher queries can let you manipulate and examine BloodHound data in custom ways that will help you further understand your network or identify interesting relationships. What is Cypher? Just like SQL exists for MSSQL and other databases, the Neo4j graph database has its...
  • MS14-068 and KrbCredExport

    March 30, 2015 - 6 minute read
    Intro On a past assessment, we found a Domain Controller that was vulnerable to the infamous MS14-068 exploit. While trying to get the exploit working properly, we ran into some random issues that we had to work through. I wanted to document the process we used for successful exploitation, as well as the fixes we developed along the way. I don’t intend to go in depth on exactly how MS14-068 works. If you want a detailed explanation, you can find a fantastic one here. At a high level, the logic that verifies the cryptographic signing of a certain...