ITSEC Newsletter 2025-11-27

This post walks through what authentication reflection actually is, why it remains dangerous today, and how the most recent discoveries prove that reflection keeps coming back in places where it really shouldn’t. We will explore how recent Windows behaviors introduced entirely new attack surfaces involving Kerberos, NTLM, SMB, HTTP and DCE/RPC. We’ll also look at Ghost SPNs, the CredMarshalTargetInfo (CMTI) trick, and multiple cases where a single reflected authentication was enough to compromise an entire domain. The goal is also to keep the explanations clear enough for readers who aren’t experts on these topics, without losing the important technical details.

Offensive security - TL;DR : The use of GPO to perform lateral movement has become more common during recent Red Team assessments. One key aspect of this process is the targeting. As a Red Teamer/Pentester, you don’t want to deploy your configuration on a high number of assets without control. Several methods exist : Security filtering, Item-level targeting and Script-based targeting. Several tools will be covered in this blogpost: SharpGPOAbuse, SharpGPO (Fork), GroupPolicyBackdoor.