Using discovered credentials to move laterally in an environment is a common goal for the NCC Group FSAS team. The ability to quickly and reliably use a newly gained set of credentials is essential during time-constrained operations. This blog post explains how to automate lateral movement via MSSQL CLR without touching disk* or requiring XP_CMDSHELL and how this can be prevented and detected.

In your emails, getting your hashes  Capturing NetNTLM hashes from network communications is nothing new; a quick Google for 'Capture NTLM Hashes' throws up blog posts discussing the various ways to force SMB communications to an attacker and the numerous existing tools to capture the authentication attempt and extract the password hash. Sniffing SMB traffic requires elevated permissions … Continue reading Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures →

Carnivore is a tool for assessing on-premises Microsoft servers such as ADFS, Skype, Exchange, and RDWeb. Carnivore's functionality covers every stage an attacker would follow - from discovering relevant subdomains, to uncovering username format and username enumeration, to password spraying and additional post authentication activities for Skype such as retrieving the global address list or … Continue reading Tool Release – Carnivore: Microsoft External Assessment Tool →