🇯🇵Redteam Operator @FujitsuOfficial / OSEE, OSCE3
Joined September 2018
- Tweets12.8K
- Following1.3K
- Followers3.3K
- Likes45.7K
kinako retweeted
Sync different: reverse engineering & weaponizing edge sync for advanced red teaming by @TEMP43487580
Full abstract at : entrypoint.fr/talks/edge-syn…
kinako retweeted
You can now coerce HTTP authentication from Windows targets that are running MS-RPRN, using impacket with PR #2361!
The PR added a new opnum from the MS-RPRN spec, OPNUM 88 and an example script to make the process straight forward. Letting you now coerce and relay HTTP authentication from remote machine targets
Shoutout to sudonoodle for the BOF that inspired this and for the technique(at least I think it was them who found it) :3
kinako retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
kinako retweeted
今まで基本的に招待で登壇させていただいていたのですが、今年初めてCFPを出してみようと思い、とても嬉しいことにCODE BLUE 2026に採択されました。多くの場合、十分にリスクとして認識されていない、長年使ってきたテクニック—端末侵害後の活動の一部でもある「信頼の移植（Pass-the-Device）」についてお話しできればと思います。ペンテスト／Red Teamの方々には永続化や攻撃範囲を広げるネタとして、防御側の方々にはリスクの認知と対策・監視の観点で知ってもらいたいです。
#codeblue_jp #codeblue2026
codeblue.jp/program/time-tab…
kinako retweeted
Im incredibly proud, and honestly lost for words, to share that I have been granted the @Microsoft MVP award for the Security and Cloud & Datacenter management categories 🥳
The journey, the learning, the community building and experiences that lead to this moment have no doubt contributed to greatly making me who I am today. And for all of you that have been a part of that, I thank you all from the bottom of my heart.
kinako retweeted
My @x33fcon talk about Credential Relay Phishing is finally out!
Watch me struggle through the live Google phishing demo, a day after the pirate ship party, which deprived me of my last few brain cells. 😜
Wrath of demo gods and AI lulz included. 🥳
youtu.be/dNtqZJmtIpw
kinako retweeted
Sky社に報告した脆弱性の修正パッチが公開されました！対応が早くて助かります。 対象製品をお使いの環境は早めのパッチ適用を！
jvn.jp/jp/JVN33423625/
skygroup.jp/security-info/ne…
国内製品がより強固なものになっていくのは嬉しい〜
kinako retweeted
Everyone calls #ESC17 "the WSUS bug", it isn't !
It forges a domain-trusted TLS cert for ANY server. One cert: internal HTTPS in cleartext, RDP creds despite NLA, full domain takeover via LDAPS (even Kerberos).
Research + open-source tool 👇
research.qu35t.pw/en/series/…
kinako retweeted
You should check @MGrafnetter recent @blackhat talk
slides: i.blackhat.com/BH-USA-26/Pre…
WP: i.blackhat.com/BH-USA-26/Pre…
CC: @gentilkiwi
kinako retweeted
I've noticed that @bunjavascript has been gaining a lot of traction lately, so I thought it might be interesting to take a look at its offensive potential 🕵️
The game is evolving and we have now entered a new post-exploitation era made of Virtual Machines and Interpreters. Let's revive some old techniques using modern tools ♻️
blog.atsika.ninja/posts/byoi…
kinako retweeted
New File Format for Initial Access???. "PPKG" files, had a hard time bringing some of the old XML schema for building these properly but finally got execution!!, These run with high privileges by default so the UAC prompt is shown and a good pretext is still needed but these files are NOT in the block list for Outlook. Also thanks to Pearce as well I had no knowledge of ppkg files and how they worked or what they did some great stuff going offline with web_search capabilities of course.
#redteam
kinako retweeted
Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥
Technical analysis: gist.github.com/H0j3n/a5ef26…
POC: github.com/aniqfakhrul/CVE-2…
kinako retweeted
GPOHound v1.1.0 is out! 🎉
This release adds the "sysvol", "ldap", and "parse" modules, along with several bug fixes and improvements.
For more details: github.com/cogiceo/GPOHound/…
kinako retweeted
Onelogon: Taking over Active Directory Accounts via Netlogon🔑
We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
ALT Compromise an Active Directory Domain with the Onelogon vulnerability
ALT Scanning an AD domain for accounts vulnerable to Onelogon
kinako retweeted
先週のInterop Tokyo 2026で、「攻撃者視点で考える Detection Engineering」というテーマで登壇しました。
防御側の方々に参考にしていただけるよう、登壇内容をもとに整理した資料です。 EDR、SIEM、Red Team演習をどう検知設計・運用改善につなげるかを考えるきっかけになれば幸いです。
speakerdeck.com/cryptopeg/at…
kinako retweeted
It was a great experiencn to join @x33fcon! Beautiful city, exciting pirate ship and cool talks. Had a lot of fun discussing red and blue topics! Thak you #x33fcon for supporting our talk and let's keep in touch every one I had a chance to talk to!
"Signed, Trusted, Abused: Advanced #BYOSI #Malware Loader Techniques" talk at #x33fcon by @TEMP43487580 and @kinako_software x33fcon.com/#!s/YuyaChudoRyu…
kinako retweeted
"Signed, Trusted, Abused: Advanced #BYOSI #Malware Loader Techniques" talk at #x33fcon by @TEMP43487580 and @kinako_software x33fcon.com/#!s/YuyaChudoRyu…
kinako retweeted
This is big 🔥🔥 techcommunity.microsoft.com/…
kinako retweeted
Tenant enumeration is dead.
Microsoft has now patched both techniques that allowed full tenant domain discovery from a single unauthenticated request.
That changes recon against M365 environments significantly.
The signals still exist, tenant IDs, MOERA prefixes, brand metadata, but no single query gives you the full picture anymore. Effective enumeration now means chaining techniques together, validating against large datasets, and in some cases requiring authentication.
Juan Pablo Gomes Postigo breaks down:
• what the original technique was
• what still works today
• how we updated hubs.la/Q04hDQ9f0 going forward
hubs.la/Q04hGhk50
#CyberSecurity #Pentesting #IdentitySecurity #SecurityResearch
