Get the latest cybersecurity news, vulnerability alerts, and security insights. One Day Sec keeps you informed about the ever-evolving threat landscape.
Stay updated with the newest cybersecurity articles
How to have multiple AI agents develop in parallel without quality collapse? Learn the three main bottlenecks and how to overcome them for autonomous development.
Read Parallel Development Experience Bought with Thousands of Dollars in Tokens: Let a Group of AI Agents Write Code for You
Learn to bypass AV for Active Directory info gathering using csvde, ldifde, AdFind, and C# tools. Export users, computers, groups securely.
Read Penetration Basics - Active Directory Information Gathering 2: Bypass AVLearn vSphere Web Services API development with pyvmomi, analyze SharpSphere, and manage VMs via Python. Includes file upload/download code examples.
Read vSphere Development Guide 2 – vSphere Web Services API
Learn how to run csvde on Windows 7 for Active Directory data export in penetration testing. Includes dependency migration and bypass methods.
Read Penetration Basics - Running csvde on Windows 7Learn multiple methods to detect Zimbra versions, including IMAP, SOAP API, and web management, with Python automation and open-source code.
Read Penetration Basics - Zimbra Version DetectionLearn how to use COM object hijacking for Outlook persistence, mimicking APT Trula's method. Includes PowerShell automation, registry tweaks, and defense tips.
Read Use COM Object hijacking to maintain persistence——Hijack OutlookBrowse concise answers derived from our published, source-linked cybersecurity coverage.
Defenders can use automated tools like ACLight, which enumerates ACLs in Active Directory to find privileged accounts that are not members of high-privilege groups (shadow admins). It generates reports like "Privileged Accounts - Layers Analysis.txt" to flag users with DCSync permissions. The article recommends using ACLight for this detection.
Read moreThe user can run mimikatz directly if logged in, or use `runas` or PowerShell's `Start-Process` with credentials to execute a batch file containing the DCSync command. For example: `mimikatz.exe privilege::debug "lsadump::dcsync /domain:test.com /user:administrator /csv"`. Note that wmic cannot be used locally with alternate credentials. Refer to [Domain Penetration - Method to Export All Domain User Hashes Using DCSync](/news/domain-penetration-method-to-export-all-domain-user-hashes-using-dcsync) for more.
Read moreAn attacker with Domain Admin privileges can add three specific ACEs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes with a different GUID) to a regular user account using PowerShell tools like PowerView. This grants that user DCSync rights, creating a "Shadow Admin" that can export all domain hashes unnoticed.
Read moreDCSync is a feature in mimikatz that exploits the Directory Replication Service (DRS) protocol to replicate user credentials from a domain controller, allowing an attacker to export hashes of all domain users. It requires permissions like Domain Admins or a domain controller's computer account. For details, see [Domain Penetration - DCSync](/news/domain-penetration-dcsync).
Read moreSubscribe to our RSS feed to get the latest cybersecurity news delivered to your reader.
Subscribe to RSS