Wir haben eine Mission: Werde eine*r von uns! 👩‍🚀👨‍🚀

Finde gemeinsam mit uns die Schwachstellen von morgen 🔑 und manchmal auch welche aus längst vergangener Zeit 🗝️

Mehr erfahrt ihr unter jobs.redteam-pentesting.de 🚀

#infosec #cybersecurity #aachen #hiring #ITJobs #Pentesting

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

📢Our CEO Patrick Hof joined a panel discussion at the AHK debelux event "Building Resilience in Cybersecurity" on Oct. 13th 2026.

His takeaway: Regulation alone does not ensure security: systems must be tested in practice and vulnerabilities actively sought out.

More information: debelux.ahk.de/de/events/2026…

🚨 Rocket Remote Desktop encrypts users' saved credentials with their Windows SIDs. Every user with access to a Windows client on which the client software is installed has access to the database, where these credentials are saved. No fix available yet.

redteam-pentesting.de/en/advisories/…

🚀Our tool keycred for KeyCredentialLinks and Shadow Credential attacks now works with updated domain controllers again!

It turns out, Microsoft violated their own specs.

Try it out: github.com/RedTeamPentest…

Originally, Microsoft did not enforce their own specs for validated writes at all and only checked if a KeyCredentialLink is already present. Now they require a CustomKeyInformation field with the "MFA Not Required" flag to be present and the last logon timestamp to be absent.

This is kind of funny because CustomKeyInformation is actually forbidden for validated writes according to Microsoft's specs 🤡
learn.microsoft.com/en-us/openspec…

🚨Nextcloud was vulnerable to XSS in PDF.js (CVE-2024-4367) found by @thomasrinsma at @CodeanIO.

Although Nextcloud mitigated the vulnerability in their portal by disabling eval, the viewer.html component of the vulnerable PDF.js was still exposed.

redteam-pentesting.de/en/advisories/…

🎄Care for some Glühwein and flags? The Haix-la-Chapelle CTF 2025 starts tomorrow! 🍷
mastodon.social/@Pwn_la_Chapel…

🔥Only 10 days left until the Haix-la-Chapelle 2025 CTF is starting on November 29!

We're sponsoring the prize money for the best writeups and are excited to see your creative solutions.

haix-la-chapelle.eu

You can find the CTFTime event at ctftime.org/event/2951

🚨8 months after public disclosure, @RHEL @AlmaLinux @rocky_linux are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

This is neither the first, nor the second time that we can't get distros to apply upstream fixes for publicly disclosed RCEs with POCs available in Ghostscript.

x.com/RedTeamPT/stat…

Disclaimer: We did not discover this vulnerability (credits go to zhutyra🎉), we're just wondering why we can still exploit these vulnerabilities in pentests on patched systems 🤷

We received no response on the @RHEL bug tracker:
bugzilla.redhat.com/show_bug.cgi?i…

Why doesn’t pretender from @RedTeamPT get more love? It’s excellent for relaying.

👀Turns out MS-EVEN can do a lot more than NULL auth:

In addition to leaking environment variables, it is possible to coerce authentication from arbitrary logged on users* 🤯

*If you are willing to trigger Windows Defender.

Another interesting tidbit was that the share path can contain environment variables, which are expanded by the host.

This could reveal system level variables, which could be interesting in some configurations.

Check out our Impacket PR that adds SMB signing support (NTLM and Kerberos) to smbserver to allow Windows 11 clients that require signing by default to connect:
github.com/fortra/impacke…