ITSEC Newsletter 2025-11-20

Recently our Initial Access Intelligence team added a .NET deserialization payload generation library to go-exploit, VulnCheck's open-source exploit framework. This article discusses how that library came to be while providing enough information into that process to allow others to create their own gadget chains by hand if they so please.

While constrained delegation offers improvements in limiting risk compared to its dangerous unconstrained counterpart, if a resource configured with constrained delegation is compromised, an attacker can still escalate and pivot to other resources, even if the process can be more complex and limited.

We will start with a tool called RPCView, a GUI tool that lets you see exposed RPC servers in all system processes. After that, we will look at the NtObjectManager module and how we can use it for RPC research. Next, we will check RPCMon, a tool that parses RPC logs across the whole system.