Finding vulnerabilities in offensive security tooling

Jonas Vestberg examines whether the offensive tools that penetration testers rely on can be trusted, using three example scripts from the Impacket collection as case studies. He frames the scenario as an attacker with a low-privilege foothold on a Windows domain environment, where a tester's own tooling becomes part of the attack surface. The examples were reported to their maintainers beforehand, and no CVEs were assigned.

The first case is a secrets-dumping script that saves registry hives to a predictable location in the system directory, which standard users can reach. A local attacker who watches for those files can copy the boot key and password material before the script removes them. The same logic had been copied into other tools. A second case is a remote-execution script that writes its command output and batch file to a fixed path in the temp folder. A race condition lets a standard user take ownership of that file and swap in a payload that runs as SYSTEM. The third case is a PsExec-style tool whose named pipe grants access to everyone, so an interrupted session can leave a service that any authenticated user can reach.

The talk closes with practical guidance: review and audit tools before use, build them yourself where possible, test them in a lab while watching the artifacts they leave, agree on rules of engagement with clients, and weigh the risk of relying on vendors for offensive software.