Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

2015-02-07 Thread Ben Lincoln (F7EFC8C9 - FD)
It has also been tested against Yahoo etc. "Sorry if this has already been discussed elsewhere" Many asked - for example: http://www.milw00rm.com/exploits/7057 Again, please tell us whether you reproduce with the PHP code. Kind Regards, On 2015/2/5 3:29, Ben Lincoln (F7EFC8C9 - FD) wrote

Re: [FD] Major Internet Explorer Vulnerability - NOT Patched

2015-02-04 Thread Ben Lincoln (F7EFC8C9 - FD)
So here's a possibly stupid question: is this entirely an IE flaw, or is it tied to the use of Cloudflare by the targeted site as well as the attacking site? I ask because: 1 - I tried to reproduce the attack in a number of ways without using CloudFlare, and was unsuccessful. 2 - Since I don'

[FD] Dictionary/brute-force attack against "kerberized" IIS service accounts without triggering account lockout

2014-12-18 Thread Ben Lincoln (F7EFC8C9 - FD)
Not sure if this is old news by now, but I haven't seen it mentioned anywhere. I was writing some walkthroughs for the alpha version of Mimikatz 2.0, and realized that since the "Silver Ticket" functionality involves one of the Windows kerberos ticket encryption keys being the NTLM hash of th

Re: [FD] Critical bash vulnerability CVE-2014-6271 (slightly OT logo discussion)

2014-09-26 Thread Ben Lincoln (F7EFC8C9 - FD)
On 2014-09-25 09:14, Tony Arcieri wrote: On Thu, Sep 25, 2014 at 8:55 AM, Michal Zalewski wrote: In what way? It doesn't have a logo, so it's a bit better in my book. That's where you're wrong: https://pbs.twimg.com/media/ByVh24fCcAAy7mT.png I propose a contest - IMO if Heartbleed got a