Giulio Pierantoni·Oct 2DNS Server to Enterprise Admin: Exploiting ADIDNS Custom PoliciesOne of my favorite things about Active Directory is the sheer amount of obscure little features that can be misused by attackers. I have…
Giulio Pierantoni·Aug 29, 2025ADIDNS Time Bombs: Poison Today, Relay TomorrowPredictable hostnames can be exploited with malicious ADIDNS records to take control of hosts added to the domain at a later date. This is…A response icon3A response icon3
Giulio Pierantoni·Jul 29, 2025User-Based Unconstrained Delegation and SPN-jackingAlternative title: ranting too much about rare unconstrained delegation cases.A response icon1A response icon1
Giulio Pierantoni·Jun 18, 2025ADCS Exploitation Part 3: Living Off The LandADCS exploitation is now a common tactic for domain escalation but most guides will tell you how to use certipy and certify, which may not…A response icon1A response icon1
Giulio Pierantoni·Mar 25, 2025LPE in InTune Windows Agent MSIThis blog is about a little LPE vulnerability I found while testing a Windows 11 VM serviced by InTune. Part of my local recon routine…
Giulio Pierantoni·Jan 21, 2025Targeted Timeroasting: Stealing User Hashes With NTPDomain admins can manipulate user attributes to obtain MS-SNTP hashes for accounts other than computers. This can be used as an alternative…
Giulio Pierantoni·Dec 23, 2024DES Kerberoasting and SessionRoastingToday we are going to exploit the UserAccountControl flag Use DES Key Only.While not well known I recently saw a domain where this attack…
Giulio Pierantoni·Nov 15, 2024How To DCSync a Samba DC (and maybe OpenLDAP)In a recent assessment I found myself in a domain where the only DC was a Samba server. While Samba allows the creation of a fully…
Giulio Pierantoni·Oct 10, 2024ADCS Exploitation Series — Part 2: Certificate Mapping + ESC15Certificate mapping is the process at the heart of multiple ADCS vulnerabilities, so I thought it would be appropriate to dedicate it its…A response icon1A response icon1
Giulio Pierantoni·Aug 4, 2024ADCS Exploitation Part 1: Common AttacksActive Directory Certificate Services is so widespread and easy to misconfigure it deserves a spot among one of the internal pentester’s…
