Offensive security research: Active Directory, PKI, network protocols and more, with techniques reproduced in the lab.https://research.qu35t.pw/enhttps://research.qu35t.pw/en/blog/esc17-https-interne/https://research.qu35t.pw/en/blog/esc17-https-interne/ESC17 forges a domain-trusted certificate. Against internal HTTPS, it surfaces credentials, session tokens, and Windows authentications in the clear.Sun, 26 Jul 2026 00:00:00 GMThttps://research.qu35t.pw/en/blog/esc17-introduction-threat-model/https://research.qu35t.pw/en/blog/esc17-introduction-threat-model/ESC17 is not a WSUS bug but a PKI trust problem in ADCS. The first part of a research series that maps out its attack surface.Sun, 26 Jul 2026 00:00:00 GMThttps://research.qu35t.pw/en/blog/esc17-ldaps-session-hijack/https://research.qu35t.pw/en/blog/esc17-ldaps-session-hijack/ESC17 breaks LDAPS TLS, but authentication lives above it: cleartext bind capture and session hijacking, against NTLM as well as Kerberos, on the DC.Sun, 26 Jul 2026 00:00:00 GMThttps://research.qu35t.pw/en/blog/esc17-rdp-nla/https://research.qu35t.pw/en/blog/esc17-rdp-nla/ESC17 removes the RDP certificate warning. NLA downgrade no longer works against a modern client, but terminating CredSSP captures the password despite NLA.Sun, 26 Jul 2026 00:00:00 GMT