Acknowledgements and Resources Big shout out to Nicholas Romanowski and the development team at ServiceNow for building and open-sourcing Dark-Agent, which brought clean, modular in-memory BOF exec...

Acknowledgements and Resources Automating command execution on beacon check-in is not a new technique. It’s a standard practice in red team operations and widely documented in offensive security. I...

Acknowledgements and Resources This is by no means a new technique. In fact, it is widely known and frequently used in offensive security. I chose to write about it to help fill any practical gaps...

Acknowledgements and Resources This is by no means a new technique. In fact, it is widely known and frequently used in offensive security. I chose to write about it to help fill any practical gaps...

Attack Scenario Introduction In Windows, every process runs under a security token that represents the user’s identity and privileges. These tokens can be abused if the process has the SeImpersonat...

The Scenario: In this scenario, we have access to a Windows 10 host where an AppLocker policy is enforced, explicitly blocking access to cmd.exe, powershell.exe, and powershell_ise.exe for a specif...

Introduction In a stack-based buffer overflow, attackers typically inject shellcode into the stack and execute it by overwriting the return address. However, modern systems enforce NX (No eXecute)...

Introduction to the GOAD Lab Setup The Game of Active Directory (GOAD) lab is a purpose-built environment for Active Directory security testing. This guide walks you through setting up GOAD on VMw...