Garrett
@unsigned_sh0rt
Followers
2K
Following
3K
Media
138
Statuses
1K
Research at @SpecterOps
Portland, OR
Joined August 2009
Non-infosec post this time. I try to stray away from talking about my personal life here as much as I can especially when it comes to my family. In November 2023 my son Oliver was diagnosed with level 3 Autism Spectrum Disorder.
3
7
38
knew win10 had the dsquery.dll laying around but never knew what to do with it. "rundll32.exe dsquery.dll OpenQueryWindow" will pop open a console for you and you can do some light LDAP recon. you can also open with with win + ctrl + f. probably useful for VDI/Citrix type tests
6
76
371
Wanted to say thank you to everyone who shared/donated! My wife hit her goal and I couldn't be more grateful!.
She's started a fundraiser in his honor to help give back to the community that has supported him so much. I want to support her every way I can. Please consider sharing and/ or donating for autism research!
4
2
18
RT @BurningRiverCon: Calling all hackers from Cleveland and beyond!. Burning River Cyber Con will be held on November 15, 2025. We are lo….
0
2
0
RT @_logangoins: I Just documented a cool way to authenticate proxied tooling to LDAP in an AD environment using C2 payload auth context, w….
specterops.io
TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP authentication from the current user context to perform a proxied relay to...
0
117
0
I automated the POC for stealing policies from MP relays from this blog into a modified version of mssqlclient would work too with any other piv account to the DB. (no PR because impacket doesnt merge, sorry).
github.com
modified mssqlclient from impacket to extract policies from the SCCM database - garrettfoster13/mssqlkaren
4
42
115
RT @0xthirteen: I wanted to find out if you could start the WebClient service remotely, so I ended up digging into it .
specterops.io
A walkthrough to answer the question: "Can you start the WebClient service remotely as a low privileged user?"
0
57
0
RT @lastweekinfosec: DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat them….
blog.badsectorlabs.com
DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat themed loader (@vxunderground), fine-tune LLMs for offsec (@kyleavery_), juicing...
0
5
0
RT @SpecterOps: The DSInternals PowerShell module just got an upgrade! 🔥. Updates include:.✅ Golden dMSA Attack.✅ Full LAPS support.✅ Trust….
specterops.io
Discover the latest enhancements to the DSInternals PowerShell module, including the Golden dMSA Attack and support for LAPS, trust passwords, or BitLocker recovery keys.
0
40
0
here's the POC for decrypting the creds if you ever run into them.
github.com
POC to decrypt SmartDeploy encrypted credentials. Contribute to garrettfoster13/NotSoSmartDeploy development by creating an account on GitHub.
0
2
15
Who doesn't like free creds?.
PDQ SmartDeploy versions prior to 3.0.2046 used static, hardcoded encryption keys for cred storage. Low-privileged users could potentially access admin creds from registry or deployment files. @unsigned_sh0rt unpacks his testing in his latest blog post.
3
11
37
RT @SpecterOps: The AD CS security landscape keeps evolving, and so does our tooling. 🛠️. @bytewreck drops info on Certify 2.0, including a….
specterops.io
Certify 2.0 features a suite of new capabilities and usability enhancements. This blogpost introduces changes and features additions.
0
98
0
RT @RonB_Y: Speaking at @defcon was as fun as always! My new tool called RPC-Racer is now available. It masquerades as a legitimate RPC ser….
github.com
Toolset to manipulate RPC clients by finding delayed services and masquerading as them - SafeBreach-Labs/RPC-Racer
0
45
0
RT @_dirkjan: Good article from Bleeping Computer about the Exchange hybrid tradecraft I dropped at Black Hat yesterday, with some of my co….
bleepingcomputer.com
CISA has issued an emergency directive ordering all Federal Civilian Executive Branch (FCEB) agencies to mitigate a critical Microsoft Exchange hybrid vulnerability tracked as CVE-2025-53786 by...
0
22
0
WSFC misconfigurations can turn your domain into one big fustercluck. I'm sharing fustercluck today as part of my #BHUSA presentation. The README summarizes the issues and a detailed blog is coming soon.
github.com
POC tool to abuse windows server failover clusters - garrettfoster13/fustercluck
4
51
115
I pushed updates to SCCMHunter as part of my Arsenal demo at #BHUSA today! New features include a relay module for TAKEOVER-5 and a community contribution to coerce client push from a *nix host for ELEVATE-2.
github.com
[1.1.10] - 2025-08-06 Added Relay Module Added a new module to support TAKEOVER-5. Operators can relay coerced authentication to the SMS Provider role to compromise SCCM. HTTP Module Thanks ...
1
48
134
RT @SpecterOps: MSSQLHound leverages BloodHound's OpenGraph to visualize MSSQL attack paths with 7 new nodes & 37 new edges, all without to….
specterops.io
TL;DR MSSQLHound is a standalone PowerShell collector that adds 7 new nodes and 37 new MSSQL attack path edges to BloodHound using the new OpenGraph feature that was released in version 8.0. This...
0
53
0