The “Fake” Potato – Decoder's Blog
While exploring the DCOM objects for the “SilverPotato” abuse, I stumbled upon the “ShellWindows” DCOM application. This, along with “ShellBrowserWindows”, is we…| Decoder's Blog
Recently, there's been some good research into further exploiting DCOM authentication that I initially reported to Microsoft almost 10 years ago. By inducing authentication through DCOM it can be relayed to a network service, such as Active Directory Certificate Services (ADCS) to elevated privileges and in some cases get domain administrator access.| www.tiraniddo.dev
While exploring the DCOM objects for the “SilverPotato” abuse, I stumbled upon the “ShellWindows” DCOM application. This, along with “ShellBrowserWindows”, is we…| Decoder's Blog
Recently, there's been some good research into further exploiting DCOM authentication that I initially reported to Microsoft almost 10 year...| www.tiraniddo.dev
