Posts on fonetone

NTLMv1 Must Die

Tue, 24 Feb 2026 05:55:55 +0100

Table of Contents

Foreword

I know the internet is already drowning in NTLM authentication articles. So, if you’re thinking this post might be just another drop in that ocean, I get it — and I’m sorry to disappoint. But for the newcomers or anyone still tangled in the protocol’s quirks, this might just be the lifebuoy you need. Also, I won’t be plunging into the technical details; people far smarter than I am already did, so I kindly recommend you check their work. I am merely putting into my own words something that’s been explained countless times, to help me understand it better, and hopefully, it helps you too.

Hierarchy Takeover via NTLM Coercion and Relay over SMB to Remote Site Database

Fri, 20 Feb 2026 07:00:55 +0100

Table of Contents

Introduction

I’m gonna have soon to come up with acronyms for those titles, it’s getting out of hand. Don’t panic tho, it sounds far more complicated than it actually is! It’s very similar to what was already covered in this post, except that this time we relay over SMB instead of LDAP. Additionally, we will be talking to the DB directly as the Primary Site Server, instead of using a user account. So basically a machine talking to another machine, what could go wrong, right?

Hierarchy Takeover via NTLM Coercion and Relay to MSSQL

Sun, 15 Feb 2026 16:15:55 +0100

Table of Contents

Introduction

This post is part of a series on SCCM exploitation. If you haven’t yet, don’t miss SCCM Range Deployment — it’s like setting up your own SCCM sandbox, minus the sand in your underwear.

At the end of this post, you will know how to coerce a SCCM Primary Site Server into authenticating against you, and relay that authentication back to the Server Site Database.

SCCM Range Deployment

Sat, 14 Feb 2026 07:42:50 +0100

Table of Contents

Introduction

If you’ve never heard of Ludus, I almost feel bad for you. Because once you know, there’s no going back. This absolute game-changer is about to save you HOURS, and I’m basically your hero for telling you about it. You’re welcome. I’ve just changed your life, so feel free to name your firstborn after me.

Now, let’s give credit when credit is due. Who built that thing?