😈 [ MrAle98 @MrAle_98 ]

Hey there,

Finally published the article on the exploit for CVE-2025-21333-POC exploit.

Here the link to the article:

🔗 https://medium.com/@ale18109800/cve-2025-21333-windows-heap-based-buffer-overflow-analysis-d1b597ae4bae

🐥 [ tweet ]

😈 [ c0rnbread @0xC0rnbread ]

Today I'm releasing Xenon, a custom Mythic agent for Windows targets written in C.

Notable features include:
📁 Modular command/code inclusion
🦠 Malleable C2 Profile support
🪨 Compatible with Cobalt Strike BOFs

🔗 https://github.com/MythicAgents/Xenon

Blog series:
🔗 https://c0rnbread.com/creating-mythic-c2-agent-part1/

🐥 [ tweet ]

😈 [ Andrea Pierini @decoder_it ]

KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)

🔗 https://github.com/decoder-it/KrbRelayEx-RPC

🐥 [ tweet ]

😈 [ Thomas Seigneuret @_zblurx ]

Fear no more for LDAP Signing and Channel binding with Impacket based tools 😎

🔗 https://github.com/fortra/impacket/pull/1919

🐥 [ tweet ]

😈 [ 5pider @C5pider ]

spend some time rewriting stardust to be more minimalist and easier to use! I needed a generic minimal shellcode template that works for both x86 and x64 out of the box so I rewrote stardust to do so.

It is now written in C++20 and utilizing some of its language features. The template can be used to easily write shellcode fast in a more modern and less painful way.
The project can be compiled in release or debug mode, where as debug mode will just allow the use of DBG_PRINTF, which calls DbgPrint under the hood to print out strings to the currently attached debugger.

There are more things i have added so consider checking it out. I removed global variable access since i no longer use it nor require it (went for diff design heh). If u still need that feature I would recommend to change the branch to "globals-support" where the old version is hosted.

🔗 https://github.com/Cracked5pider/Stardust

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

Loki C2 blog drop! Thank you for all those who helped and all the support from the community. Big shoutout to @d_tranman and @chompie1337 for all their contributions to Loki C2! @IBM @IBMSecurity @XForce

🔗 https://securityintelligence.com/x-force/bypassing-windows-defender-application-control-loki-c2/

🐥 [ tweet ]

😈 [ NetSPI @NetSPI ]

Beacon Object Files (BOFs) in C2 platforms limit developers.

Read NetSPI's blog post to explore a reference design for a new BOF portable executable (PE) concept that bridges the gap between modern C++ development and memory-executable C2 integration.

🔗 https://www.netspi.com/blog/technical-blog/network-pentesting/the-future-of-beacon-object-files/

🐥 [ tweet ]

😈 [ Wietze @Wietze ]

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections.

My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees.

Here’s what I found and why it matters:

🔗 https://wietze.github.io/blog/bypassing-detections-with-command-line-obfuscation

🐥 [ tweet ]

😈 [ bohops @bohops ]

This ended up being a great applied research project with @d_tranman on weaponizing a technique for fileless DCOM lateral movement based on the original work of @tiraniddo. Excellent work, Dylan!

Blog:
🔗 https://www.ibm.com/think/news/fileless-lateral-movement-trapped-com-objects

PoC:
🔗 https://github.com/xforcered/ForsHops

🐥 [ tweet ][ quote ]

😈 [ Craig Rowland - Agentless Linux Security @CraigHRowland ]

This new Linux noscript from THC will encrypt and obfuscate any executable or noscript to hide from on-disk detection:

🔗 https://github.com/hackerschoice/bincrypter

I'm going to show you how to detect it with command line tools in this thread:

🔗 https://threadreaderapp.com/thread/1905052948935377402.html

🐥 [ tweet ]

😈 [ Oddvar Moe @Oddvarmoe ]

Many people wanted my slides from the Windows Client Privilege Escalation webinar yesterday.

Here are links to the slides and the recording of the webinar.

Slides:
🔗 https://www.slideshare.net/slideshow/windows-client-privilege-escalation-shared-pptx/277239036

Recording:
🔗 https://youtu.be/EG2Mbw2DVnU?si=rlx-GG2QMQpIxQYi

🐥 [ tweet ]

😈 [ Duncan Ogilvie 🍍 @mrexodia ]

Success! Claude 3.7 with my IDA Pro MCP server managed to solve the crackme that was previously failing🦾

The trick was adding a convert_number tool and stress to always use it for conversions. It took ~7 minutes to run and the cost was $1.85. Also includes an analysis report.

🔗 https://github.com/mrexodia/ida-pro-mcp

🐥 [ tweet ]

рип цтфы категории пвн

😈 [ Yehuda Smirnov @yudasm_ ]

Excited to release a tool I've been working on lately: ShareFiltrator

ShareFiltrator finds credentials exposed in SharePoint/OneDrive via the Search API (_api/search/query) and also automates mass downloading of the discovered items.

Blog:
🔗 https://blog.fndsec.net/2025/04/02/breaking-down-sharepoint-walls/

Code:
🔗 https://github.com/Friends-Security/sharefiltrator

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!

🔗 https://github.com/boku7/Loki

🐥 [ tweet ]

😈 [ ippsec @ippsec ]

After using Python for so long, I've been trying to switch to GoLang over the last two years just to try something new. I'm finally somewhat confident in being able to write I'd try to create a video series to help others. This is the first video:

🔗 https://youtu.be/uJFW4c4QE0U

🐥 [ tweet ]