In ldapx v1.3.3 you can now use Unicode modifiers to make queries for attributes like cn and sAMAccountName look like nicknames from 2010😄

🚀ldapx v1.3.0 just dropped Now with active decryption of security layers on top of LDAP, working with ADExplorer and pretty much every other client (or so I hope). Plus better logging, TLS listeners, "pass the cert" support and other upgrades. Link in the reply👇

The gopher gods thank you

Godap v2.10.2 can now create dynamic objects and has a brand new wiki explaining all of its' features! :-) github.com/Macmod/godap/wiki

Not sure if this means anything, but I tried :)

Here's the full list of IPs that sent requests for commands to my server, I made it reply an uninstall command and they seemed to stop over time. It was pretty fun :P

It sent logs when it was spreading too :P

Not in that first occasion, but I have logs from a C2 domain that I found in a sample in 2020 and re-registered to see what sort of requests would come in. It used something like the UPAS Kit as C2 and was operated by brazilians; the malware family was Rombrast.

If Windows did this natively users and orgs would respond to all sorts of incidents a lot faster. :P

If anyone wants to fix it, the bug happens because of improper error handling: github.com/dirkjanm/BloodHou… It's rare, but when it happens it's very annoying, as it forces you to split your dump into thousands of pieces to figure out what's wrong.