Posts on IamWin's Blog

Dumping LSASS Without Mimikatz: Native and Administrative Alternatives

Sun, 26 Jul 2026 11:30:00 -0500

Introduction

In the field of offensive security and Red Teaming, memory credential access remains one of the most common vectors for achieving lateral movement within a Windows environment. Historically, Mimikatz (developed by Benjamin Delpy) has been the go-to tool for extracting credentials from the LSASS (Local Security Authority Subsystem Service) process.

However, in modern enterprise environments, Mimikatz signatures are heavily detected by antivirus solutions, Windows Defender, and EDRs. To understand how these activities are protected and detected, it is essential to understand how LSASS memory dumps can be performed using native operating system tools (LOLBins) or legitimate administrative utilities, avoiding the use of well-known offensive tools.

BloodHound MCP: Integrating Claude with BloodHound

Fri, 03 Jul 2026 12:00:00 -0500

Introduction

About 2 weeks ago I found out about the existence of an MCP (Model Context Protocol) server for BloodHound that allows us to integrate it with Claude. Below I share the publications I read on the topic:

SpecterOps article: BloodHound MCP: One Year Later — What I Learned About MCPs, Models, and Context

GitHub Repository: BloodHound MCP - GitHub Repository

What is this?

The BloodHound MCP allows you to query your Active Directory data in natural language directly from Claude Desktop. Instead of writing Cypher queries manually, you ask Claude things like “show me all Domain Admins” or “find kerberoastable users.”

Active Directory Certificate Services: Abusing ADCS ESC8 (Kerberos Relay)

Tue, 30 Jun 2026 01:08:00 -0500

Summary

ESC8 is an AD CS vulnerability where the Certificate Enrollment Web Service is enabled over HTTP (without HTTPS). This allows intercepting a Domain Controller’s authentication and relaying it to the CA to request a certificate. With that certificate we can impersonate the DC, perform DCSync, and take full control of the domain.

Requirements

Valid domain user credentials (Rosie.Powell:Cicada123)
The CA has Web Enrollment over HTTP enabled
NTLM disabled in the domain (authentication must use Kerberos)
Machine Account Quota > 0 (allows adding DNS records, default is 10)

Step-by-step Walkthrough

1. Initial Setup

Ensure correct DNS resolution in /etc/hosts:

Active Directory Certificate Services: Abusing ADCS ESC11 (RPC Relay)

Sun, 28 Jun 2026 21:30:00 -0500

Introduction

ESC11 is a vulnerability in Active Directory Certificate Services (ADCS) that occurs when the RPC interface of the Certificate Authority (CA) — specifically the ICertPassage (MS-ICPR) interface — does not enforce signing or encryption for certificate enrollment requests. This happens because the IF_ENFORCEENCRYPTICERTREQUEST flag is disabled on the CA.

Since no packet signing or encryption is required on this RPC interface, it becomes vulnerable to NTLM Relay attacks. If an attacker manages to coerce the NTLM authentication of a privileged account (such as the machine account of a Domain Controller or a Domain Admin), they can relay that authentication to the CA’s RPC port and request a valid certificate on behalf of the victim.

Active Directory Certificate Services: Abusing ADCS ESC8 (NTLM Relay)

Tue, 09 Jun 2026 03:00:00 -0500

Introduction

ESC8 is a vulnerability in Active Directory Certificate Services (ADCS) that occurs when the Web Enrollment service is enabled over HTTP without encryption, or over HTTPS without Channel Binding (EPA) enabled.

The vulnerable endpoint is:

http://<CA>/certsrv/certfnsh.asp

This endpoint accepts NTLM authentication without signing or channel binding, making it susceptible to NTLM Relay attacks. In essence, an attacker can intercept the NTLM authentication of a privileged account (such as the Domain Controller’s machine account) and relay it to the ADCS service to obtain a valid certificate on behalf of that account.

Active Directory Domain Trust: Abusing Child-to-Parent Trust

Mon, 08 Jun 2026 01:00:00 -0500

INTRODUCTION

Domain Trust relationships in Active Directory are fundamental to allowing users from one domain to access resources in other domains. However, from a Red Teaming perspective, these relationships represent an excellent vector for privilege escalation and lateral movement.

In this post, we will explore how to abuse a Child-to-Parent trust relationship within the same forest to escalate privileges from a fully compromised subdomain to the root domain.

KEY CONCEPTS

What is a Domain Trust?

It is a trust mechanism between two domains that enables cross-domain authentication. Its key properties are:

Mi Experiencia con la CRTP - 2026

Fri, 13 Mar 2026 10:00:00 +0000

ANÉCDOTA

Hace como un año, estaba en el séptimo ciclo de Ingeniería de Sistemas sintiéndome en un callejón sin salida. Con el título cada vez más cerca, ni siquiera tenía un currículum definido; si bien es cierto que había realizado muchos proyectos de software y gestión, honestamente, no me llenaban. Había tenido un primer roce con la Seguridad Informática y Linux en un curso de la facultad y me había enganchado, pero en ese momento lo veía más como un sueño lejano que como una carrera real.

My Experience with the CRTP - 2026

Fri, 13 Mar 2026 10:00:00 +0000

ANECDOTE

About a year ago, I was in my seventh semester of Systems Engineering, feeling like I was at a dead end. With graduation getting closer every day, I didn’t even have a defined resume. While it’s true I had completed many software and management projects, honestly, they didn’t fulfill me. I’d had a first encounter with Information Security and Linux in a faculty course and got hooked, but at that time, I saw it more as a distant dream than a real career path.

Guía de Explotación: Buffer Overflow x32

Tue, 30 Sep 2025 10:00:00 +0000

En este módulo vamos a aprender a como explotar un Buffer Overflow x32 bits ( Stack based [Linux x86 shellcode - execve(/bin/bash, [/bin/bash, -p], NULL) - 33 bytes]) para esto tenemos un laboratorio que para poder convertirnos en Root tenemos un binario que ejecuta este usuario privilegiado.

Antes de comenzar primero vamos a ver un poco de teoría sobre Buffer Overflow y entender el flujo de trabajo.

¿Qué es un Buffer Overflow?

Un Buffer Overflow (desbordamiento de búfer) es una vulnerabilidad de software que ocurre cuando un programa escribe datos en un búfer (una zona de memoria temporal) más allá de los límites asignados, sobrescribiendo así áreas adyacentes de la memoria.