ITSEC Newsletter 2025-08-14

One of the very important issues that red teamers and pentester always have to consider is how to keep their payloads low profile. You cannot carry out activities if your payloads are constantly being caught and blocked by antivirus software. In addition to avoiding the watchful eyes of AVs, keeping your payloads from being submitted to analysis sites on the Internet (and subsequently falling into the hands of malware analysts, blue teams, etc.) is also crucial. In this article, I will present the idea of leveraging the long file name feature on Windows to help keep payloads from being collected by EDR's tools and scripts that gather samples.

We believe that our story should start with the basics. Therefore, the first (and, spoiler, the second) parts will pay a lot of attention to the basics of RPC, rather than directly programming. However, I will actively show examples of C++ code for ease of understanding. In addition, the text of the article contains many references to research and material from other authors. This way, you will get a full and detailed understanding of RPC before moving on to the issues of developing tools using Impacket. We’ll learn Impacket from scratch to the point where you can write a custom tool for Lateral Movement!

Microsoft introduced Active Directory Web Services (ADWS) in Windows Server 2008 R2 as a method to provide an interface to instances for querying and managing Active Directory over a network. The service runs on domain controllers by default on TCP port 9389 and communication is performed via the Simple Object Access Protocol (SOAP). Administrators typically utilize the Web Service through the active directory administrative center or Active Directory PowerShell modules.