Identifying New Attack Paths via Password Analysis
Check out my talk from Wild West Hacking Fest Mile High 2025 here: Slides:
n00py Blog
/Users/n00py/
Latest posts
The SOCKS We Have at Home
Introduction When performing penetration tests, we sometimes find that the systems or data we are targeting are not directly accessible from the network our attacking system is connected to. This is often the case when searching for things such a PCI data. We may have ‘owned’ the network, we may have gotten ‘DA’, but we... Read More
Bypassing Amazon Kids+ Parental Controls
Recently for Christmas my 4 year old daughter got an Amazon Kids tablet. So far the tablet has been great and Kids+ seems like a pretty decent value for what you get. I m very wary of the types of content available on the internet, and as a parent it s my duty to ensure that my... Read More
Bypassing Okta MFA Credential Provider for Windows
I ll state this upfront, so as not to confuse: This is a POST exploitation technique. This is mostly for when you have already gained admin on the system via other means and want to be able to RDP without needing MFA. Okta MFA Credential Provider for Windows enables strong authentication using MFA with Remote Desktop... Read More
CactusCon 2023: BloodHound Unleashed
Here are the slides and video from my 2023 talk at CactusCon. The YouTube video currently is cut-off at the beginning, but if it gets fixed I ll update with a new link. BloodHound Unleashed.pdf from n00py1
Exploiting Resource Based Constrained Delegation (RBCD) with Pure Metasploit
Metasploit recently released version 6.3. With it came a whole lot of new features related to LDAP operations and using Kerberos authentication. In this blog I want to demonstrate how to perform a GenericWrite - RBCD attack, which I find are very common. Often times a user will not have administrative access to a computer,... Read More
Practical Attacks against NTLMv1
This blog is meant to serve as a guide for practical exploitation of systems that allow for the NTLMv1 authentication protocol. While NTLMv1 is hardly ever needed anymore, a surprising number of organizations still use it, perhaps unknowingly. There are however some VPN products that still currently instruct their users to downgrade NLTM authentication to... Read More
Password Spraying RapidIdentity Logon Portal
In the past I had written a quick blog post on password spraying Dell SonicWALL Virtual Office. While it wasn t all that exciting of a post, a number of people did find it useful and having a blog for it helped people find it more easily than only being in a random Github repo or... Read More
Manipulating User Passwords Without Mimikatz
There are two common reasons you may want to change a user’s password during a penetration test: You have their NT hash but not their plaintext password. Changing their password to a known plaintext value can allow you to access services in which Pass-the-Hash is not an option. You don’t have their NT hash or... Read More
Unauthenticated Dumping of Usernames via Cisco Unified Call Manager (CUCM)
This blog is about something I found recently regarding Cisco Unified Call Manager (CUCM). While playing around with SeeYouCM Thief, which is designed to download parse configuration files from Cisco phone systems, I noticed something interesting within a configuration file. There was an XML element in the configuration files named secureUDSUsersAccessURL . The value pointed to... Read More