Matan Bahar

Tzach Benita and I just finished developing a simple tool in C++ to dump the LSASS memory and encrypt the dump using AES with CBC. The tool worked against a fully patched Windows Server 2022. Link to github in the 1st comment. #cybersecurity #windows #infosec #redteam #PenTest

New research alert, Phishing as a Service - Abuse Azure Apps to Phish the Tenant. While researching Azure App Permissions with my colleague @IdanLerman , we found a way to impersonate any user in the tenant and send an email on their behalf. medium.com/@matanb707/phi…

While researching in Azure with my partner @IdanLerman we found some cool misconfiguration in Azure role condition that can lead to full subscription compromise. medium.com/@matanb707/own… #RBAC #RoleCondition #Azure #ConditionByPass

Im happy to share another part regarding my recent research "The Perfect Cover Masking Password Sprays as Microsoft Traffic" as i used the legitimate function apps in a malicious way to mask the IP address and the location. medium.com/@matanb707/the… #FunctionApps #DefenseEvasion

My recent research "The Perfect Cover: Masking Password Sprays as Microsoft Traffic" is shared by Merill Fernando, it is an honor to be in that blog, thank you for sharing! link for the blog: entra.news/p/entra-news-8… link for the research: medium.com/@matanb707/the…

Entra-Pass-Spray – A password spraying tool leveraging Azure Runbooks to evade detection. By running within Microsoft's infrastructure, it masks the attack source as a Microsoft IP in victim logs and therefore goes under the radar. medium.com/@matanb707/the…

Can dMSA be abused for persistence in Active Directory? This article explores potential security risks, misuse scenarios, and defensive measures to prevent attackers from leveraging misconfigured dMSAs. medium.com/@matanb707/adv… #CyberSecurity #ActiveDirectory #dMSA

I am pleased to share the findings of my recent research on the Azure Virtual Desktop and Azure Event Hub. medium.com/@matanb707/spa… #Azure #EventHub #AVD #ProcessDump #SASToken

I am pleased to share the findings of my recent research on the Microsoft Graph API and its application permissions, specifically focusing on the EntitlementManagement.ReadWrite.All permission. medium.com/@matanb707/cat… #Azure #EntraID #AccessPackage #Catalog

I am pleased to share the findings of my recent research on the Microsoft Graph API and its application permissions, specifically focusing on the User.ReadWrite.All permission. medium.com/@matanb707/gue…

Together with my colleague Idan Lerman I am pleased to introduce LAPS Extractor, a new PowerShell script designed for securely retrieving LAPS (Local Administrator Password Solution) passwords in Active Directory environments. medium.com/@matanb707/ret…

I'm excited to introduce StealthPasswordSpray, a new PowerShell script designed for stealthy password spraying attacks on Active Directory environments. It has been tested on Defender and various EDR solutions, successfully bypassing them. github.com/ADPunisher/Ste…

Together with my colleague Idan Lerman I am pleased to share some research about the Kerberos protocol and develop a POC that bypasses AV\EDR and extracts the TGS. medium.com/@matanb707/ker…

קמפיין גיוס המונים כפר סבא של האוהדים 1928💚 אנחנו כמועדון צריכים עוד כסף על מנת לצלוח את העונה הנוכחית. סכום היעד הינו 120,000₪. הקמפיין מיועד לכל אדם שכדורגל וקהילה מרגשים אותו לכל מי שרוצה להיות בעלים של קבוצה- בקיצור, מיועד לכולם! צריכים אתכם איתנו! headstart.co.il/project/77519

The security research blog I promised you has been released - One Electron to Rule Them All! Thanks to my amazing team @VakninHai @Tamirye94 and @Bl4ckShad3 for working closely with me on this fun research ❤️ medium.com/@MalFuzzer/one… #cybersecurity #infosec #redteam

EnumSecToolkit Release Proud to launch EnumSecToolkit on GitHub! Developed with @R3dTeamN1nja , it simplifies identifying security vulnerabilities. New script: EnumLocalAdminAccess, using WMI, WinRM, RPC & SMB. Feedback appreciated! GitHub Repo & PoC github.com/ADPunisher/Enu…

Another offensive PoC tool for the fun that leverages the SeBackupPrivilege security token to be able to harvest sam and system. Here is a link to my GitHub repo that also includes a recorded PoC: github.com/ADPunisher/Bac…

I've decided to release yet another offensive PoC tool that leverages the SeTakeOwnershipPrivilege security token to be able to takeover and fully control files on the operating system. Here is a link to my GitHub repo that also includes a recorded PoC: github.com/ADPunisher/Own…

Excited to present a project that my colleague @YudaSm2 and I have been working on: the EnumSecToolkit. This advanced tool has been specifically designed to streamline and automate the enumeration and reconnaissance phase of red team assessments.