Following an access token with WinDbg: what Windows sees when you ask for access
When a Windows access check fails, it is natural to start with the object being accessed.
Read articleSecurity engineering notes
Notes on Windows and security.
Things I’ve learned while working on Windows internals, identity, and security systems.
I’m Chad Duffey. This is where I write down the useful bits.
Start here
Selected writing
Recent deep dives into Windows process creation, access control, and token internals.
Why admin still can't touch some Windows processes
Administrator is powerful on Windows, but it is not the highest trust level on the machine.
Read articleBefore main(): tracing what Windows really does when you call CreateProcess
CreateProcess does far more than start a program: it builds enough process state, loader state, and subsystem state for execution to become possible.
Read articleEverything else
More writing
Moving SYSVOL to a new disk
windows
Using IL NOPs with dnSpy
windows
WordPress Backdoor
wordpress
HTB: Search
hack the box
Shadow Credentials
active directory
WinDbg notes
windbg
Rubber Ducky on macOS
red team
Managing Group Policy ACLs with PowerShell
active directory
WDAC notes
wdac
edgegdi.dll persistence notes
windows
Windows Persistence
persistence
Windows malware creation notes
malware
HTB: Forest — an Active Directory walkthrough
active directory
CVE-2020-0796 Mitigations
exploit
Active Directory: recovering deleted objects with Restore-ADObject
active directory
Active Directory - How Smart Card Logon Works
active directory
LDAPS across disparate namespaces
active directory
Try not to get too fancy with Active Directory Backup
active directory
When NTLM is used for Windows Login (Kerberos unavailable)
active directory
Exploiting Vulnserver
exploit
Skeleton Key
exploit
Silver ticket (in short)
exploit
Overpass the hash
exploit
A practical infrastructure security review checklist
infrastructure
Golden ticket (in short)
active directory