PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Wait, Why is my WebClient Started?: SCCM Hierarchy Takeover via NTLM Relay to LDAP

specterops.io | blog
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

During automatic client push installation, an SCCM site server automatically attempts to map WebDav shares on clients, starting WebClient when installed.
Published
Collected

Related coverage

blog · bughunters.google.com
The Story of init.g(malaga): Three Editions of Growing Future Leaders
This blog post outlines the origins of and how it has developed over the past few years, including a preview of what awaits participants in the 2026 edition. Why Málaga? From a Homegrown Startup to a Community Crossroads To understand why resonates...
blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
blog · xbow.com
How Attackers Are Using AI & What Defenders Must Do
Attackers are running AI driven attack chains from recon to exploitation in minutes. Here’s what actually changed, and why defenders need AI pentesting to keep pace.
blog · xbow.com
PHP2shell: Patch Today, Then Prove It
The PHP Project just shipped fixes for the vulnerability dubbed PHP2shell. Step one is to patch, confirm it took, and make a plan for anything too old to patch.
blog · about.gitlab.com
GitLab Orbit: Find vulnerability blast radius without the manual hunt
Exploitation happens at machine speed now. Map every project, owner, and pipeline a critical CVE touches so remediation can keep up.
blog · about.gitlab.com
GitLab Orbit is GA: Higher agent accuracy, lower token cost
Your entire software lifecycle in one queryable graph, with permissions intact. In GitLab testing, agents on GitLab Orbit made up to 45x fewer retries.
Back