ITSEC Newsletter 2025-11-06

Author

Henrik Falk
November 06, 2025

Automating COM/DCOM vulnerability research

This white paper describes how COM/DCOM works and what complications it has. In the next chapters, the white paper will describe how security research can be automated using the fuzzing approach. Since this approach comes with some problems, it describes how these problems were overcome (at least partially).

www.incendium.rocks/posts/Automating-COM-Vulnerability-Research

Exploiting Ghost SPNs and Kerberos Reflection for SMB Privilege Elevation

Kerberos is widely used for secure authentication in Windows environments. However, when misconfigured Service Principal Names (SPNs) and default permissions align, attackers can exploit Kerberos reflection to gain SYSTEM-level access remotely. We reported these findings to the Microsoft Security Response Center (MSRC) in June 2025. Microsoft released a security update for the issue, which it cataloged as CVE‑2025‑58726 (SMB Server Elevation of Privilege), in October 2025. However, understanding how attackers seek to exploit gaps in SPN and authentication security could help you avoid similar vulnerabilities in the future.

www.semperis.com/blog/exploiting-ghost-spns-and-kerberos-reflection-for-smb-server-privilege-elevation

Today I learned: binfmt_misc

Interestingly, this technique seems to have fallen into oblivion again, as neither MITRE ATT&CK nor the five-part Elastic Security “Linux Persistence Detection Engineering” series mentioned it (the last part here with links to all other parts). As of 2025, however, the technique works wonderfully and would probably be very difficult to detect (see the hunting section later).

dfir.ch/posts/today_i_learned_binfmt_misc

ShareHound: An OpenGraph Collector for Network Shares

TL;DR: ShareHound is an OpenGraph collector for BloodHound CE and BloodHound Enterprise that maps network shares, permissions, and paths at scale helping identify attack paths to network shares automatically.

specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares