ITSEC Newsletter 2025-05-01

This post isn’t meant to dive too deep into the technical details, but rather to give a general idea of how Kerberos relay attacks work, what’s possible, what isn’t, and where the limitations lie. My goal is to (hopefully) provide an easy-to-read, approachable overview that helps make sense of the bigger picture, explain how my dedicated KrbRelayEx tools work in practice, and show how they can be used to perform these kinds of attacks.

Due to the wide-scale usage of Microsoft Configuration Manager (hereafter known as SCCM) in the client environments I’ve tested - combined with the technology being so difficult to secure due to its large level of access, I’ve decided to document what I believe are the most common easy wins for attackers. This post will attempt to combine explanatory and practical example focused tradecraft together which combines high commonality with incredible impact from low-privilege contexts, and what you can do to prevent them from a systems administration and defensive perspective.

Coverage-guided fuzzing is a well-known technique that improves the efficiency of a fuzzer by providing runtime feedback This blog post explores this concept on Windows ARM64, using QBDI for code instrumentation and LLVM’s libFuzzer as the fuzzing engine.