Decoder's Blog

This is quite a different post as it is not related as usual to Windows vulnerabilities .

LmCompatibilityLevel determines which NTLM and LM authentication protocols are accepted for inbound and outbound connections for Windows machines.

TL;DR This post is super short, nevertheless: The classic cross-DC coerce + relay to LDAPS technique, abusing a misconfigured LmCompatibilityLevel (0/1/2) to generate NTLMv1 + ESS and strip the MIC, is dead when the victim DC runs Windows Server 2025.

Authentication reflection has been around for more than 20 years, but its implications in modern Windows networks are far from obsolete.

While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and practical insights into how these attacks work and how they

Why write a post about changing Windows passwords programmatically when so many built-in and third-party tools already let us do it effortlessly?

Vulnerable Windows drivers remain one of the most exploited methods attackers use to gain access to the Windows kernel.

In this second super short post, I want to explore an unusual Group Policy Object (GPO) configuration I recently encountered.

In the realm of IT administration, Group Policies serve as a powerful tool for centrally managing and controlling various aspects of an Active Directory network environment in a Windows-based operating system.

While exploring the DCOM objects for the “SilverPotato” abuse, I stumbled upon the “ShellWindows” DCOM application.