ITSEC Newsletter 2024-06-20

Normally, with a signature scheme, you have the public key and want to know whether a given signature is valid. But what if we instead have a message and a signature, assume the signature is valid, and want to know which public key signed it? A rather delightful property if you want to attack anonymity in some proposed “everybody just uses cryptographic signatures for everything” scheme.

ScriptBlock Smuggling allows an attacker to spoof any arbitrary message into the ScriptBlock logs while bypassing AMSI. To make things more interesting, it also does not require any reflection or memory patching to be executed. AMSI patching in particular, has started to be targeted by a lot of AV and EDR solutions so this is a major perk of the technique.

This article will delve into the intricacies of Active Directory and outline a comprehensive methodology for pentesting AD environments. Whether you’re a beginner or an intermediate cybersecurity professional, this guide will equip you with the knowledge and tools to effectively pentest Active Directory, identify vulnerabilities, and enhance the overall security posture of an organization.