Aurelien Chalot

Abusing Windows’ tokens to compromise Active Directory without touching LSASS

27 October 2022 ~24 min By Aurelien Chalot
Authentication Internals Redteam Token Windows
During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows server. Looking at the users connected on the same server, I knew that a domain administrator account was connected. All I had to do to compromise the domain, was compromise the account. This could be achieved by dumping the memory of the LSASS process and collecting their credentials or Kerberos…

Building an offensive RPC interface

03 August 2021 ~21 min By Aurelien Chalot
Internals Rpc Windows
Using the Windows Remote Procedure Call (RPC) interface is an interesting concept when conssidering the fact that it allows you to call functions, over the network in a remote process. I wanted to better understand how RPC worked, and decided to build my own RPC interface to help with that. As a result, I wrote an RPC interface that will spawn a reverse shell given an IP address and a…