https://pgj11.com/Hacking, Security Researching, Pentesting/Ethical Hacking, Operating Systems... 2026-10-28T11:54:52+01:00 Pedro Gabaldón Juliá https://pgj11.com/ Jekyll © 2026 Pedro Gabaldón Juliá /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-09-28T09:00:00+02:00 2026-09-28T16:08:51+02:00 https://pgj11.com/posts/Windows-NCSI-Proxy-Auth-Coercion-Part-2/ Pedro Gabaldón Juliá

Summary Part 1 ended with a question: how does a proxy configured by an interactive user arrive inside ncsi.dll when the service thread is not impersonating that user? In this part we will walk through the internals of NCSI to understand how a proxy configured by another user finally lands in netprofm, and how that value is later used by the WinHTTP request. The answer was not a direct read ...

2026-09-28T09:00:00+02:00 2026-10-01T16:26:27+02:00 https://pgj11.com/posts/Windows-NCSI-Proxy-Auth-Coercion-Part-1/ Pedro Gabaldón Juliá

Summary In February 2026, I started investigating a Windows proxy behaviour in which a proxy configured by an unprivileged user caused NCSI to negotiate NTLM with an attacker-controlled proxy from a service security context. The following table summarizes the information about the vulnerability. CVE ID Microsoft declined to assign it a CVE ZDI advisory ...

2026-08-31T10:00:00+02:00 2026-09-24T19:27:54+02:00 https://pgj11.com/posts/Analysis-of-Bincrypter-and-gsocket-gs-netcat/ Pedro Gabaldón Juliá

Introduction Recently, in a Linux server compromise, the TA used a gsocket binary as a reverse shell tunnel. The compromise started with a WordPress site affected by CVE-2026-18322 and the attacker dropped a gsocket binary in the site’s root plus persistence in crontab to execute it. https://bazaar.abuse.ch/sample/532015ceef91eff71878ee50e84efb8902d78bb5c34db25a241c5866784a840e/ https://w...

2026-02-10T00:00:00+01:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/FortiGate-Symlink-Attack/ Pedro Gabaldón Juliá

Analysis and Exploitation of FortiGate Symlink Persistence Method Background📚 Around April 2025 Fortinet started warning customers that a Threat Actor (TA) continued to have remote read-only access to filesystem after patching FortiGates (FGT) units. This was achieved by a path in the VPN-SSL. Basically, requesting some route (we will see it later in the post) in the VPN-SSL, it allowed to a...

2025-08-02T00:00:00+02:00 2026-08-13T22:39:11+02:00 https://pgj11.com/posts/FortiGate-VPN-SSL-Honeypot/ Pedro Gabaldón Juliá

FortiGate VPN-SSL Honeypot The following blog post contains an example of running and configuring the FortiGate VPN-SSL Honeypot project. This project can be found in Github here: https://github.com/PeterGabaldon/Fortigate.VPN-SSL.Honeypot Description and Capabilities A deception honeypot that mimics FortiGate VPN-SSL devices to trap brute force attempts, detect deliberately exfiltrated ...