#windowsserver

Microsoft has patched a critical Windows Event Logging vulnerability (CVE-2026-50502) allowing remote code execution. Update your systems immediately. #Microsoft #Vulnerability #CyberSecurity #WindowsServer #CVE202650502 https://meterpreter.org/windows-event-logging-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Low-privileged Active Directory user → Full Domain Admin? A new AD CS vulnerability called Certighost (CVE-2026-54121) makes it possible. The attack abuses the certificate enrollment "chase" mechanism to obtain a Domain Controller certificate, authenticate via PKINIT, perform DCSync, and ultimately extract the krbtgt secret for complete Active Directory compromise. ✅ No admin privileges required ✅ Public PoC available ✅ Patched by Microsoft, but unpatched Enterprise CAs remain at risk I break down: • How the exploit works internally • Why AD CS trusts the wrong host • PKINIT → DCSync attack chain • Microsoft's patch and new validation logic • Detection and mitigation guidance 🔗 https://thecybersecguru.com/news/certighost-cve-2026-54121-ad-cs-domain-controller-impersonation/ #CyberSecurity #ActiveDirectory #ADCS #WindowsServer #Microsoft #PKINIT #Kerberos #DCSync #CVE202654121 #CVE #BlueTeam #RedTeam #ThreatDetection #InfoSec #SOC #Windows #Pentest #DFIR #CyberDefense

I like a fresh lab. I do not like building one for the umpteenth time, especially when the build takes longer than the thing I actually wanted to test. build-lab is the final piece in a three-script set, and the one that ties the other two together. One command, an ISO, and roughly half an hour later you have a Windows Server 2025 domain controller. Log on once and the domain populates itself with a directory that looks lived in, nested groups and GPOs and an Enterprise CA included. No GUI, no answer file to hand-edit, no clicking Next. This is an orchestrator. It calls New-VMwareWorkstationVM to build and start the VM, pushes the new-AdDomain payload into the guest over vmrun, and kicks off the promotion. Still PowerShell 5.1, still nothing outside what Microsoft and VMware already ship. One thing is deliberately manual. Directory population runs from a scheduled task that fires at your first Administrator logon, so you do have to log into the console once. I could automate it by storing a domain Administrator password under a startup-triggered task. That's the one compromise I decided not to make, even in a lab, and I'm still not certain it was the right call. The interesting problem was verification. A successful AD promotion reboots Windows immediately, which tears down the vmrun guest-operations channel mid-call. A blocking call hung on that reboot and never came back. So the guest script gets launched fire-and-forget, which means there is no exit code to read. Just silence. Instead, build-lab confirms success by polling for ntds.dit in the guest, and pulls the guest's deployment logs back to the host either way, because the run you need logs from is the one that failed. https://github.com/0x44616e69656c/build-lab What's the step in your lab build that you've rebuilt by hand so many times you've stopped noticing it? #PowerShell #ActiveDirectory #WindowsServer #Automation #HomeLab #VMware #InfoSec

I really dislike sitting down to a lab environment that looks bare. Three users. A couple of empty OUs. Domain Admins with one lonely account. Nothing that feels real. It often doesn't matter, but it bugs me. I'm not going to hand craft hundreds or thousands of objects for a lab, but automation doesn't care. New-AdDomain takes a clean Windows Server 2025 machine and builds a realistic Active Directory forest. Proper OU structure, nested groups, computer and service accounts, GPOs, sites, an Enterprise Root CA, and enough lived-in state that security tools and attack simulations have something meaningful to work with. Pure PowerShell. No Ansible. No third-party dependencies. https://github.com/0x44616e69656c/new-AdDomain #PowerShell #ActiveDirectory #WindowsServer #HomeLab