PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

RCE để chạy whoami, ifconfig?

blog.viettelcybersecurity.com | vulnerability | #ai-security | #bug-bounty | #rce | #lateral-movement | #pentest | #mimikatz | #credential-dumping | #password-reuse
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A pentester describes turning one RCE on an ASP.NET server into deep internal access via mimikatz dumping and password reuse, arguing real engagements must prove impact beyond running whoami.
Published
Collected

Related coverage

vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
blog · netspi.com
Hashdump without the DC using DCSync (because we all wanted it)
Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.
blog · netspi.com
Auto-Dumping Domain Credentials using SPNs, PowerShell Remoting, and Mimikatz
Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.
blog · netspi.com
Exploiting Trusted Hosts in WinRM
Examines WinRM misconfigurations—unencrypted channels, Basic auth, permissive TrustedHosts—that let attackers intercept credentials or relay authentication for remote command execution.
blog · netspi.com
5 Ways to Find Systems Running Domain Admin Processes
Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.
Back