This article, written with my friend Giuseppe, is published here: http://resources.infosecinstitute.com/apk-golden-ticket-owning-android-smartphone-gaining-domain-admin-rights/
From APK to Golden ticket
The road to “silver”
Remember my last post, the "SYSTEM" challenge? Now let's modify the scenario.... Imagine you've got the xp_cmdshell running under this account: os-shell> whoami do you want to retrieve the command standard output? [Y/n/a] y [21:52:27] [INFO] theQL query used returns 1 entries [21:52:27] [INFO] retrieved: dummydomain\\andrew command standard output [1]: [*] dummydomain\andrew Oh! This…
The “SYSTEM” challenge
This is a brief "writeup" of a challenge which I created for my friends of "SNADO" team. I will write this article from the "pentester" perspective, just to be more clear and realistic đ The mission was to get windows "SYSTEM" privileges, starting from a vulnerable webapp. There were several ways to get the result,…
The “Golden Ticket” solution
This is the second part of my previous post. Remember, you have the domain controller's  dump of the hashes, but it's the test lab and when you try to login via PTH (pass the hash), no way.. probably domain admin password was changed... Game over? Not at all.. we can try the "Golden Ticket" solution...…
Grab the Windows secrets!
This is a severe pen-test!! After gaining access to the internal Windows network, there is no way to go further.  No way to get an AD account, even an unprivileged one,  and you are just banging your head against the wall  đŚ But did you an in-depth information gathering? Review your findings... maybe you can…
Bypassing UAC from a remote powershell and escalating to “SYSTEM”
This short article is a continuation of my previous one.  I will focus on bypassing UAC and getting SYSTEM privileges, again without any âautomated toolsâ, just to show you how i⌠Source: Bypassing UAC from a remote powershell and escalting to "SYSTEM"
Bypassing UAC from a remote powershell and escalating to “SYSTEM”
This short article is a continuation of my previous one.  I will focus on bypassing UAC and getting SYSTEM privileges, again without any "automated tools", just to show you how it works and which techniques you could use. As usual, there are several ways to accomplish these tasks, so feel free to add your comments &…
Dirty tricks with Powershell
You probably already heard about  Powershell and what amazing things you can do with it during a penetration test. Tools like Powercat, Powershell Empire, Powersploit etc.. are wonderful and ready to use.. but serious hackers have to realize what is going on behind the scenes, do you agree? So forget these tools and also Rapids'7 Metasploit,…
Idiot’s quick & dirty guide to buffer overflow on GNU/Linux X64 architecture
In this short guide I'll show you how to exploit a very simple buffer overflow on a linux X64 system and obtain a shell. I won't tell you about ASM, stacks, registers and so on.. you can find all you need googling around... Just keep in mind: The 64-bit registers have names beginning with "R"…
“Speedy” HTTP2 challenge on game.rop.sh
"Speedy" is an interesting challenge hosted on http://game.rop.sh. It's somehow strange because it has nothing to do with the normal and traditional hacking techniques... but let's go on. This is the main screen of the web site: You are asked to insert some data (HTTP header manipulation?). Let's start Burp and intercept the requests/responses. And…
Decoder's Blog 