😈 [ bohops @bohops ]

This ended up being a great applied research project with @d_tranman on weaponizing a technique for fileless DCOM lateral movement based on the original work of @tiraniddo. Excellent work, Dylan!

Blog:
🔗 https://www.ibm.com/think/news/fileless-lateral-movement-trapped-com-objects

PoC:
🔗 https://github.com/xforcered/ForsHops

🐥 [ tweet ][ quote ]

😈 [ Craig Rowland - Agentless Linux Security @CraigHRowland ]

This new Linux noscript from THC will encrypt and obfuscate any executable or noscript to hide from on-disk detection:

🔗 https://github.com/hackerschoice/bincrypter

I'm going to show you how to detect it with command line tools in this thread:

🔗 https://threadreaderapp.com/thread/1905052948935377402.html

🐥 [ tweet ]

😈 [ Oddvar Moe @Oddvarmoe ]

Many people wanted my slides from the Windows Client Privilege Escalation webinar yesterday.

Here are links to the slides and the recording of the webinar.

Slides:
🔗 https://www.slideshare.net/slideshow/windows-client-privilege-escalation-shared-pptx/277239036

Recording:
🔗 https://youtu.be/EG2Mbw2DVnU?si=rlx-GG2QMQpIxQYi

🐥 [ tweet ]

😈 [ Duncan Ogilvie 🍍 @mrexodia ]

Success! Claude 3.7 with my IDA Pro MCP server managed to solve the crackme that was previously failing🦾

The trick was adding a convert_number tool and stress to always use it for conversions. It took ~7 minutes to run and the cost was $1.85. Also includes an analysis report.

🔗 https://github.com/mrexodia/ida-pro-mcp

🐥 [ tweet ]

рип цтфы категории пвн

😈 [ Yehuda Smirnov @yudasm_ ]

Excited to release a tool I've been working on lately: ShareFiltrator

ShareFiltrator finds credentials exposed in SharePoint/OneDrive via the Search API (_api/search/query) and also automates mass downloading of the discovered items.

Blog:
🔗 https://blog.fndsec.net/2025/04/02/breaking-down-sharepoint-walls/

Code:
🔗 https://github.com/Friends-Security/sharefiltrator

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!

🔗 https://github.com/boku7/Loki

🐥 [ tweet ]

😈 [ ippsec @ippsec ]

After using Python for so long, I've been trying to switch to GoLang over the last two years just to try something new. I'm finally somewhat confident in being able to write I'd try to create a video series to help others. This is the first video:

🔗 https://youtu.be/uJFW4c4QE0U

🐥 [ tweet ]

😈 [ Matt Creel @Tw1sm ]

Nothing new, but formalized some operator notes on Entra ID/Azure tradecraft I've found to be exceptionally useful on ops. Overlooked this myself for quite some time and thought others in the same boat might find it worth a read! 📖

🔗 https://medium.com/specter-ops-posts/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4

🐥 [ tweet ]

😈 [ Andrew Oliveau @AndrewOliveau ]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

Blog:
🔗 https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions

Code:
🔗 https://github.com/xforcered/RemoteMonologue

🐥 [ tweet ]

😈 [ Elad Shamir @elad_shamir ]

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs.

Read my detailed post - the most comprehensive guide on NTLM relay & the new edges:

🔗 https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e

🐥 [ tweet ]

😈 [ S3cur3Th1sSh1t @ShitSecure ]

As this is public now - an alternative to modifying AppIds to make them use the interactive user via the remote registry you can also use a lot of existing CLSIDs which have the interactive user configured and coerce an incoming RPC authentication from loggedon users 😎

🐥 [ tweet ][ quote ]

Небольшой пример, как можно использовать Certipy как библиотеку для проведения #ESC1 через нативную веб-форму энрола /certsrv/certrqxt.asp:

🔗 https://ppn.snovvcra.sh/pentest/infrastructure/ad/ad-cs-abuse/esc1 (certrqxt2pfx[.]py)

Недавно был прикольный кейс, когда надо было получить сертификат сквозь Cisco SSL VPN Relay Add-On и легаси Internet Explorer без возможности нормального проксирования в целевую сетку ;)

😈 [ Microsoft Threat Intelligence @MsftSecIntel ]

Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets.

🔗 https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/

🐥 [ tweet ]

😈 [ Vector 35 @vector35 ]

We've open-sourced another core Binary Ninja feature: SCC. If you're not familiar with it, the Shellcode Compiler has been built-in to BN from the beginning, allowing you to build small PIE shellcode in a variety of architectures right from the UI:

🔗 https://scc.binary.ninja/
🔗 https://github.com/Vector35/scc

If you haven't seen it before, it's available under the Edit / Compile dialog.

🐥 [ tweet ]

😈 [ Alex Neff @al3x_n3ff ]

NetExec v1.4.0 has been released! 🎉

There is a HUGE number of new features and improvements, including:
- backup_operator: Automatic priv esc for backup operators
- Certificate authentication
- NFS escape to root file system

And much more!
Full rundown:

🔗 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.4.0

🐥 [ tweet ]

😈 [ Orange Cyberdefense's SensePost Team @sensepost ]

The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_

Writeup:
🔗 https://sensepost.com/blog/2025/is-tls-more-secure-the-winrms-case./

PR to impacket:
🔗 https://github.com/fortra/impacket/pull/1947/files

Demo:
🔗 https://youtu.be/3mG2Ouu3Umk

🐥 [ tweet ]

😈 [ Check Point Research @_CPResearch_ ]

Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code.
In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking.

Blog:
🔗 https://research.checkpoint.com/2025/waiting-thread-hijacking/

Code:
🔗 https://github.com/hasherezade/waiting_thread_hijacking

🐥 [ tweet ]

😈 [ 0xdf @0xdf_ ]

OS Enumeration CheatSheet! I'll look at using package versions, common ports, and packet TTLs.

🔗 https://0xdf.gitlab.io/cheatsheets/os

🐥 [ tweet ]

😈 [ Compass Security @compasssecurity ]

3 milliseconds to admin — Our analyst John Ostrowski turned a DLL hijacking into a reliable local privilege escalation on Windows 11. He chained opportunistic locks, and API hooking to win the race to CVE-2025-24076 & CVE-2025-24994. Read his blog post:

🔗 https://blog.compass-security.com/2025/04/3-milliseconds-to-admin-mastering-dll-hijacking-and-hooking-to-win-the-race-cve-2025-24076-and-cve-2025-24994/

🐥 [ tweet ]

😈 [ NetSPI @NetSPI ]

Microsoft patched critical vulnerabilities (CVE-2025-21299, CVE-2025-29809) in Q1 2025.

NetSPI research reveals Kerberos canonicalization bypasses Hyper-V isolation of credentials, compromising Windows security.

Read the full article:

🔗 https://www.netspi.com/blog/technical-blog/adversary-simulation/cve-2025-21299-cve-2025-29809-unguarding-microsoft-credential-guard/

🐥 [ tweet ]