Chris Thompson

@_Mayyhem

Senior Security Researcher @SpecterOps github.com/Mayyhem

Joined August 2015

501 Following

2,811 Followers

Replies Reposts Media

Pinned
Chris Thompson
@_Mayyhem
Aug 3
ConfigManBearPig adds SCCM attack paths to the BloodHound graph, including all of the known hierarchy TAKEOVERs. I rewrote 2.0 in Python and added a ton of features that make it easier and more reliable to use, whether you're on offense or defense. Let me know what you find!
SpecterOps
@SpecterOps
Aug 3
ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.
1
Chris Thompson
@_Mayyhem
Aug 13
Patch SCCM with learn.microsoft.com/en-us/intune/c… or you're likely vulnerable to a new hierarchy takeover technique (CVE-2026-47301) discovered by Omri Baso from @XMCyber_ that worked in my lab out of the box. MS's KB description doesn't do the impact justice. medium.com/@omribaso/from…
Chris Thompson
@_Mayyhem
Jul 29
I'm releasing a new Python rewrite of ConfigManBearPig, my BloodHound collector for SCCM, next week w/ a TON of upgrades (SOCKS, hash/kerb auth, CVE scan, threads, pathfind) and am presenting at Black Hat Arsenal next Tues. Come say hi and grab a sticker! blackhat.com/us-26/arsenal/…
1
Chris Thompson
@_Mayyhem
May 11
Very compelling read on OpenGraph's beginnings. The content is interesting, but also I just love Brandon's writing! It makes you feel like you're there on a personal journey instead of just dumping technical info onto the page, which I tend to do and would love to improve upon.
SpecterOps
@SpecterOps
May 8
What does it take to build the foundation for a graph that can grow beyond Active Directory? In his latest blog post, Brandon Shearin reflects on a year building OpenGraph for BloodHound, & the work of turning ambiguity into architecture. Check it out ⤵️ ghst.ly/3QYKrvG
Chris Thompson
@_Mayyhem
Apr 23
MSSQLHound runtime is down from 17 minutes to 17 seconds in my lab after rewriting the BloodHound collector in Go with Javier Azofra and added SOCKS proxying, Kerberos and NT hash auth, and pathfinding. Hope this is more useful for ops than PowerShell! Let me know how it goes!
SpecterOps
@SpecterOps
Apr 23
If MSSQL isn't in your attack path visibility yet, this is your sign. @Mayyhem just shipped a major MSSQLHound upgrade with Javier Azofra Ovejero (github.com/jazofra): faster, cross-platform, and pathfinding-ready in BloodHound. Check it out! ghst.ly/4cUKgtJ
2