parzel (@parzel2) profile picture

parzel

@parzel2

Hacker based in Berlin | Working at @mod0 | https://nitter.gq/t.co/6MZdC7Pcsk | he/him

 Berlin, Deutschland
Joined May 2018
  • Tweets318
  • Following290
  • Followers938
2Media
Photo by parzel (@parzel2)
During a recent engagement, @Bandrel discovered how an attacker can craft a CSR by using default system certificates. After finding out this method was novel, the team kept digging. Read what they found in our new #blog! hubs.la/Q02SCqpG0
EKUwu: Not just another AD CS ESC

EKUwu: Not just another AD CS ESC

Using default version 1 certificate templates, an attacker can exploit a vulnerability (EKUwu) to generate certificates that bypass security controls,…

trustedsec.com
4
125
2
257
36,249
I did not approve of the timing of this release but here it is. Blog coming soon. github.com/ly4k/Certipy/pull…
ESC15/EKUwu PR by dru1d-foofus · Pull Request #228 · ly4k/Certipy

ESC15/EKUwu PR by dru1d-foofus · Pull Request #228 · ly4k/Certipy

Initial PR of ESC15 attack discovered and disclosed by Justin Bollinger from TrustedSec (https://x.com/Bandrel) Edit: Here are some additional details about the attack. As other people have noted, ...

github.com
3
37
4
134
24,019
Following up on my earlier tweet (nitter.gq/decoder_it/status/1842…) regarding Kerberos relay with SMB server, I've uploaded my quick & dirty version. It's far from perfect, so feel free to improve it! github.com/decoder-it/KrbRel…
Andrea P (@decoder_it) profile pictureAndrea P@decoder_it4 Oct 2024
Is Kerberos relaying so limited? I'd say no, thanks to @tiraniddo CredMarshalTargetInfo trick. In this case, I'm relaying SMB to HTTP (ADCS) with a modified version of @cube0x0 krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)
Image from Andrea P (@decoder_it)
Image from Andrea P (@decoder_it)
6
97
1
243
56,953
parzel retweeted
cts🌸 (@gf_256) profile picture
cts🌸
@gf_25626 Sep 2024
The entire disclosure seems to have been leaked online gist.github.com/stong/c8847e… Here is the report and POC
CUPS disclosure leaked online. Not my report. The original author is @evilsocket

CUPS disclosure leaked online. Not my report. The original author is @evilsocket

CUPS disclosure leaked online. Not my report. The original author is @evilsocket - cups-browsed.md

gist.github.com
cts🌸 (@gf_256) profile picturects🌸
@gf_25626 Sep 2024
Seems like it's in CUPS. GL;HF github.com/OpenPrinting/cups…
Review locking/multi-threading implementation · Issue #36 · OpenPrinting/cups-browsed

Review locking/multi-threading implementation · Issue #36 · OpenPrinting/cups-browsed

According to @evilsocket, cups-browsed can be held up for an extended period of time: The lock acquired here doesn't get unlocked until the IPP server has responded. A malicious IPP server can ...

github.com
12
120
25
930
548,796
A big thank you to our Review Committee @BalthasarMartin @parzel2 @vinulium, Luca Melette and Diana Janetzky. We now have an amazing schedule featuring their favourite talks which you can check out here: bsides.berlin #BSidesBerlin #appsec #infosec #BSides
5
8
920
#BSidesBerlin is back! Will you be joining us this year at @Festsaal on Saturday 26.10? Our CFP is open until 16.08 👉cfp.bsides.berlin/bsides-ber… Early Bird Tickets are available until end of July 👉 bsides.berlin @SecurityBSides @cfp_time
5
8
1,128
Today at #Troopers24 we released Certiception – the ADCS honeypot we always wanted to have. Blog: srlabs.de/blog-post/certicep… Source code: github.com/srlabs/Certicepti… Slide deck, including our guide to deception strategy: github.com/srlabs/Certicepti…
2
156
5
394
32,820
Lovely to see the Email RFCs abused to embed a command injection payload in the local-part of the address! Nice work Michael Imfeld & @parzel2 modzero.com/en/blog/beyond_t…
1
41
1
109
11,286
Shells at midnight: Exploiting the flexibility of Email addresses for offensive purposes. Today we are publishing a new blog post about our disclosure report on #MailCleaner #CVE-2024-3191: modzero.com/en/blog/beyond_t… @[email protected] will also present at @a41con today.
4
1
10
901
🎟️📢Don't miss your chance to attend or present at BSides Berlin on October 26 in Festsaal Kreuzberg. Ticket sales and the Call for Papers are NOW OPEN!! bsides.berlin
2
7
12
1,900
We identified critical vulnerabilities in MailCleaner. A command injection vulnerability can be exploited by sending an Email. Our report can be found here: modzero.com/en/advisories/mz… Kudos to chaos.social/@born0monday and chaos.social/@parzel #MailCleaner #CVE-2024-3191 #Infosec
[MZ-24-01] MailCleaner

[MZ-24-01] MailCleaner

modzero.com
3
8
704
Struggeling to get those precious certificates with #certipy and AD CS instances that do not support web enrollment and do not expose CertSvc via RPC? @qtc_de has you covered and added functionality to use DCOM instead of good old RPC #redteaming github.com/ly4k/Certipy/pull…
Add DCOM support for req command by qtc-de · Pull Request #201 · ly4k/Certipy

Add DCOM support for req command by qtc-de · Pull Request #201 · ly4k/Certipy

In the last few months, we encountered more and more ADCS instances that neither supported web enrollment, nor exposed the CertSvc via plain RPC. The output of certipy req looks like this in that c...

github.com
3
70
150
13,607
parzel retweeted
Dlive (@D1iv3) profile picture
Dlive@D1iv327 Feb 2024
We can relay back to the same machine using Kerberos relay instead of NTLM relay. I discovered this attack vector more than a year ago. I will describe it in detail in upcoming Black Hat Asia 2024 blackhat.com/asia-24/briefin… and introduce more interesting attacks.
Image from Dlive (@D1iv3)
This Post is from an account that no longer exists. Learn more
17
183
5
584
81,033
🇷🇺 Doppelgänger | Russia-Aligned Influence Operation Targets Germany We have been tracking the activities of the suspected Russia-aligned influence operation network Doppelgänger since late November 2023. Here is what we found... 🧵 sentinelone.com/labs/doppelg… #threatintel
Doppelgänger | Russia-Aligned Influence Operation Targets Germany | SentinelOne

Doppelgänger | Russia-Aligned Influence Operation Targets Germany  | SentinelOne

Doppelgänger, a sophisticated Russia-aligned operation, targets German public opinion with disinformation ahead of elections.

sentinelone.com
2
12
3
32
6,079
#threatintel someone just leaked a bunch of internal Chinese government documents on GitHub github.com/I-S00N/I-S00N/
I-S00N/I-S00N

I-S00N/I-S00N

Contribute to I-S00N/I-S00N development by creating an account on GitHub.

github.com
216
3,060
762
13,573
4,450,998
I try an avoid this hellsite, but I did a quick dive into sudo in Windows and here are my initial findings. tiraniddo.dev/2024/02/sudo-o… The main take away is, writing Rust won't save you from logical bugs :)
16
209
9
473
70,043
The videos from #BSidesBerlin 2023 are now live! Here’s a shoutout to all our amazing speakers🙌🏼 youtube.com/playlist?list=PL…
BSides Berlin 2023

BSides Berlin 2023

23 November 2023 - Holzmarkt Berlin

youtube.com
4
12
486
So here we go. A thread exposing a major fuck up by Rwanda National Police in the recruiting of Jonathan Boyd Scott aka Jonathan Lee Villarreal and a curious Russian connection. A thread 🧵
16
107
37
448
204,254
How do you hack Internet-connected devices? Today, our colleagues @parzel2 and @[email protected] will present their research at the #37C3 on how to turn a Poly VoIP phone into a wiretap, giving beginners some starting points for own research projects. events.ccc.de/congress/2023/…
2
4
587
Joining us for a second year as sponsor is @mod0. Thanks for your continued support! Register at bsides.berlin for one of the last remaining in-person tickets. #BSidesBerlin #appsec #infosec #BSides
Image from BSides Berlin (@SidesBer)
4
9
920
Load more