This website is a virtual proof that I'm awesome https://dtsec.us/ Abusing DCOM remoting for fileless lateral movement - Authors: Dylan Tran and Jimmy Bayne (@bohops)Disclaimer: This post was originally published on the IBM Security Blog and has been mirrored here. Component Object Model (COM) has been a cornerstone of Microsoft Windows development since the early 1990s and is still very prevalent in modern Windows operating systems and applications.... Tue, 25 Mar 2025 00:00:00 -0400 https://dtsec.us/2025-03-25-fileless-lateral-movement-trapped-com-objects/ https://dtsec.us/2025-03-25-fileless-lateral-movement-trapped-com-objects/ Who up stompin they modules - In my last blog post I talked about stack spoofing, a technique used to hide the origin of an API call so as to not point back to our implant in memory. The implementation I went over is a trade-off; at a glance, the stack is clean, but in reality,... Sat, 04 Nov 2023 00:00:00 -0400 https://dtsec.us/2023-11-04-ModuleStompin/ https://dtsec.us/2023-11-04-ModuleStompin/ Call stack spoofing techniques and how to detect them - Authors: Bobby Cooke (@0xboku) and Dylan TranDisclaimer: This post was originally published on the IBM Security Blog and has been mirrored here. In a blog published this March, we explored reflective loading through the lens of an offensive security tool developer, highlighting detection and evasion opportunities along the way. This... Fri, 06 Oct 2023 00:00:00 -0400 https://dtsec.us/2023-10-06-reflective-call-stack-detections-evasions/ https://dtsec.us/2023-10-06-reflective-call-stack-detections-evasions/ And losing my sanity against Elastic - Stack spoofing is a really cool malware technique that isn’t new, but has been receving some more attention recently. The goal of this post is to introduce readers to the concept and dive into two implementations. This post will focus only on call stack spoofing in x64 Windows with “active”... Fri, 15 Sep 2023 00:00:00 -0400 https://dtsec.us/2023-09-15-StackSpoofin/ https://dtsec.us/2023-09-15-StackSpoofin/ Using Ekko to sort of bypass Hunt Sleeping Beacons - Sleep obfuscation is a really cool technique that has been around for a bit now. I spent the past few months digging into it and C. As defensive software has become more capable, along with defensive proof of concepts become more advanced, so must the techniques we implement into our... Mon, 24 Apr 2023 00:00:00 -0400 https://dtsec.us/2023-04-24-Sleep/ https://dtsec.us/2023-04-24-Sleep/ HellsGate with no Gate Part 2 - This is going to be an update to my previous blog post; to keep things brief, I have found a more consistent and evasive way to utilize syscalls. Hopefully you read my last blog post, as that contained a lot of relevant information. As for this blog post, two key... Sun, 02 Oct 2022 00:00:00 -0400 https://dtsec.us/2022-10-02-NoGate2/ https://dtsec.us/2022-10-02-NoGate2/ A great course - This is going to be a relatively short post as I don’t have much to say; the course and exam are great. I passed the course in about 2.5 of the 48 hours, and it took me a total of 6 hours to get all the flags. I really enjoyed... Wed, 21 Sep 2022 00:00:00 -0400 https://dtsec.us/2022-09-21-CRTO/ https://dtsec.us/2022-09-21-CRTO/ HellsGate with no Gate - I’ve been digging a little deeper into .NET stuff recently (as anybody could tell with my recently blog posts), and I inevitably ended up looking at some more Windows internals. I now present, a modified implementation of SharpHellsGate. I decided to take a look at this because I liked Dinvoke... Sun, 14 Aug 2022 00:00:00 -0400 https://dtsec.us/2022-08-14-NoGate/ https://dtsec.us/2022-08-14-NoGate/ Part 2: Refining our techniques - It’s been a month since my first part to this “series” and now I’m getting more familiarized with this stuff. Last post covered Platform Invoke (Pinvoke), Remote Process Injection, and Donut. This post will focus on taking these techniques to the next level with the following: Dynamic Invocation (Dinvoke) and... Sun, 26 Jun 2022 00:00:00 -0400 https://dtsec.us/2022-06-26-Donut_2/ https://dtsec.us/2022-06-26-Donut_2/ Part 1: Inject your payloads - With all the Hack The Box boxes I’ve done, I’ve rarely ran into issues with Antivirus. Typically these boxes teach some sort of methodology or technique; therefore evasion is rarely implemented. However, evasion is an interesting concept; if your payload is signatured by AV and you cannot run it on... Thu, 12 May 2022 00:00:00 -0400 https://dtsec.us/2022-05-12-Donut_1/ https://dtsec.us/2022-05-12-Donut_1/ Sink HackTheBox - Sink is an insane level box on HackTheBox that was incredibly fun and difficult. The unique technologies and attack vectors taught me a lot about cloud stuff and HTTP request smuggling; a topic I was previously vaguely familiar with. Walkthrough An nmap scan, followed by a full port and script... Fri, 06 May 2022 00:00:00 -0400 https://dtsec.us/2022-05-06-Sink/ https://dtsec.us/2022-05-06-Sink/ Multimaster HackTheBox - Multimaster is an insane level box on HackTheBox that was pretty difficult. It used a variety of technologies and techniques in order to gain Domain Admin. There wasn’t a significant emphasis on the Active Directory aspect, but it was still very interesting and helped me refine some of my skills.... Fri, 22 Apr 2022 00:00:00 -0400 https://dtsec.us/2022-04-22-Multimaster/ https://dtsec.us/2022-04-22-Multimaster/ Sizzle HackTheBox - Sizzle is an insane level box on HackTheBox and utilizes a variety of Active Directory and Windows pentesting techniques in order to obtain Domain Admin. The route to an initial shell was quite difficult and unique, but the rest of the box was relatively simple. Walkthrough Recon An nmap scan,... Wed, 20 Apr 2022 00:00:00 -0400 https://dtsec.us/2022-04-20-Sizzle/ https://dtsec.us/2022-04-20-Sizzle/ The first milestone - My OSCP journey began when I began cybersecurity, 9 months ago. Back then I didn’t know how to change directories or read files in Linux, let alone what Kali Linux was. I didn’t even consider cybersecurity as a potential career path and was unaware of the existence of offensive security... Thu, 14 Apr 2022 00:00:00 -0400 https://dtsec.us/2022-04-14-OSCP/ https://dtsec.us/2022-04-14-OSCP/ A misunderstood tool - Iptables is a common and powerful tool, and one of its use cases is to create firewalls on Linux systems. It’s syntax, from an initial glance, is very complicated. This post aims to clarify the syntax of this tool and make it easier to use. With some quick practice, using... Mon, 28 Mar 2022 00:00:00 -0400 https://dtsec.us/2022-03-28-iptables/ https://dtsec.us/2022-03-28-iptables/ Bankrobber HackTheBox - Bankrobber is an insane level box on HackTheBox that utilizes a client side attack and SQL injection and a simple buffer overflow. User was lengthy as it required a lot of waiting and inconsistency, but the path of System was very quick and simple. Walkthrough Recon An nmap scan, followed... Sun, 26 Dec 2021 00:00:00 -0500 https://dtsec.us/2021-12-26-Bankrobber/ https://dtsec.us/2021-12-26-Bankrobber/ Worker HackTheBox - Worker is a medium level box on HackTheBox and is unique because its usage of the DevOps workflow as an attack vector. Getting both user and System required either knowledge of Azure DevOps or some considerable enumeration, but everything else was not too difficult. Walkthrough A basic and full port... Tue, 07 Dec 2021 00:00:00 -0500 https://dtsec.us/2021-12-07-Worker/ https://dtsec.us/2021-12-07-Worker/ Blackfield HackTheBox - Blackfield is a hard level box on HackTheBox and requires basic Active Directory knowledge and enumeration skills to solve. The user part was rather lengthy, but with the use of Bloodhound, the path to root becomes clear very early on. Walkthrough A basic and full port nmap scan, followed by... Mon, 06 Dec 2021 00:00:00 -0500 https://dtsec.us/2021-12-06-Blackfield/ https://dtsec.us/2021-12-06-Blackfield/ Resolute HackTheBox - Resolute is a medium level box that is actually pretty easy with knowledge of basic Windows and Active Directory enumeration techniques. I am a bit unfamiliar with some Command Prompt and Powershell command syntax, making some steps very time consuming. Overall, this box is pretty basic and the information from... Sun, 05 Dec 2021 00:00:00 -0500 https://dtsec.us/2021-12-05-Resolute/ https://dtsec.us/2021-12-05-Resolute/ Spider HackTheBox - Spider is a hard level box on HackTheBox and heavily focuses on web exploits, hence the name. As with all hard boxes on HackTheBox, it requires a multi-step process and it is recommended that you have experience with web exploits or knowledge of the OWASP Top 10 prior to attempting... Mon, 01 Nov 2021 00:00:00 -0400 https://dtsec.us/2021-11-01-Spider/ https://dtsec.us/2021-11-01-Spider/