😈 [ Bobby Cooke @0xBoku ]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!

🔗 https://github.com/boku7/Loki

🐥 [ tweet ]

😈 [ ippsec @ippsec ]

After using Python for so long, I've been trying to switch to GoLang over the last two years just to try something new. I'm finally somewhat confident in being able to write I'd try to create a video series to help others. This is the first video:

🔗 https://youtu.be/uJFW4c4QE0U

🐥 [ tweet ]

😈 [ Matt Creel @Tw1sm ]

Nothing new, but formalized some operator notes on Entra ID/Azure tradecraft I've found to be exceptionally useful on ops. Overlooked this myself for quite some time and thought others in the same boat might find it worth a read! 📖

🔗 https://medium.com/specter-ops-posts/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4

🐥 [ tweet ]

😈 [ Andrew Oliveau @AndrewOliveau ]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

Blog:
🔗 https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions

Code:
🔗 https://github.com/xforcered/RemoteMonologue

🐥 [ tweet ]

😈 [ Elad Shamir @elad_shamir ]

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs.

Read my detailed post - the most comprehensive guide on NTLM relay & the new edges:

🔗 https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e

🐥 [ tweet ]

😈 [ S3cur3Th1sSh1t @ShitSecure ]

As this is public now - an alternative to modifying AppIds to make them use the interactive user via the remote registry you can also use a lot of existing CLSIDs which have the interactive user configured and coerce an incoming RPC authentication from loggedon users 😎

🐥 [ tweet ][ quote ]

Небольшой пример, как можно использовать Certipy как библиотеку для проведения #ESC1 через нативную веб-форму энрола /certsrv/certrqxt.asp:

🔗 https://ppn.snovvcra.sh/pentest/infrastructure/ad/ad-cs-abuse/esc1 (certrqxt2pfx[.]py)

Недавно был прикольный кейс, когда надо было получить сертификат сквозь Cisco SSL VPN Relay Add-On и легаси Internet Explorer без возможности нормального проксирования в целевую сетку ;)

😈 [ Microsoft Threat Intelligence @MsftSecIntel ]

Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets.

🔗 https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/

🐥 [ tweet ]

😈 [ Vector 35 @vector35 ]

We've open-sourced another core Binary Ninja feature: SCC. If you're not familiar with it, the Shellcode Compiler has been built-in to BN from the beginning, allowing you to build small PIE shellcode in a variety of architectures right from the UI:

🔗 https://scc.binary.ninja/
🔗 https://github.com/Vector35/scc

If you haven't seen it before, it's available under the Edit / Compile dialog.

🐥 [ tweet ]

😈 [ Alex Neff @al3x_n3ff ]

NetExec v1.4.0 has been released! 🎉

There is a HUGE number of new features and improvements, including:
- backup_operator: Automatic priv esc for backup operators
- Certificate authentication
- NFS escape to root file system

And much more!
Full rundown:

🔗 https://github.com/Pennyw0rth/NetExec/releases/tag/v1.4.0

🐥 [ tweet ]

😈 [ Orange Cyberdefense's SensePost Team @sensepost ]

The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_

Writeup:
🔗 https://sensepost.com/blog/2025/is-tls-more-secure-the-winrms-case./

PR to impacket:
🔗 https://github.com/fortra/impacket/pull/1947/files

Demo:
🔗 https://youtu.be/3mG2Ouu3Umk

🐥 [ tweet ]

😈 [ Check Point Research @_CPResearch_ ]

Thread Execution Hijacking is one of the well-known methods that can be used to run implanted code.
In this blog we introduce a new injection method, that is based on this classic technique, but much stealthier - Waiting Thread Hijacking.

Blog:
🔗 https://research.checkpoint.com/2025/waiting-thread-hijacking/

Code:
🔗 https://github.com/hasherezade/waiting_thread_hijacking

🐥 [ tweet ]

😈 [ 0xdf @0xdf_ ]

OS Enumeration CheatSheet! I'll look at using package versions, common ports, and packet TTLs.

🔗 https://0xdf.gitlab.io/cheatsheets/os

🐥 [ tweet ]

😈 [ Compass Security @compasssecurity ]

3 milliseconds to admin — Our analyst John Ostrowski turned a DLL hijacking into a reliable local privilege escalation on Windows 11. He chained opportunistic locks, and API hooking to win the race to CVE-2025-24076 & CVE-2025-24994. Read his blog post:

🔗 https://blog.compass-security.com/2025/04/3-milliseconds-to-admin-mastering-dll-hijacking-and-hooking-to-win-the-race-cve-2025-24076-and-cve-2025-24994/

🐥 [ tweet ]

😈 [ NetSPI @NetSPI ]

Microsoft patched critical vulnerabilities (CVE-2025-21299, CVE-2025-29809) in Q1 2025.

NetSPI research reveals Kerberos canonicalization bypasses Hyper-V isolation of credentials, compromising Windows security.

Read the full article:

🔗 https://www.netspi.com/blog/technical-blog/adversary-simulation/cve-2025-21299-cve-2025-29809-unguarding-microsoft-credential-guard/

🐥 [ tweet ]

😈 [ Florian Roth ⚡️ @cyb3rops ]

Everyone knows Russian hackers don’t use VPNs. They just charge in head-first, use Russian IPs, and leave a calling card in Cyrillic.
Classic ‘на авось’ energy.

🐥 [ tweet ][ quote ]

мы?

😈 [ hasherezade @hasherezade ]

Centralized resource for listing and organizing known injection techniques and POCs:

🔗 https://github.com/itaymigdal/awesome-injection

🐥 [ tweet ][ quote ]

😈 [ Mr.Z @zux0x3a ]

Last night, I made myself busy and revisited some older methods for exploiting tokens in Windows applications shared by @mrd0x couple of years ago. However, I realized that the integration of AI into applications like Notepad presents new opportunities for exploitation. This led me to write a blog post and modify a BOF to tackle the issue.
a compromised Cowriter Bearer token could be leveraged to extract potentially sensitive information.

🔗 https://0xsp.com/offensive/the-hidden-risk-compromising-notepad-cowriters-bearer-tokens/

🐥 [ tweet ]

😈 [ ippsec @ippsec ]

New video in my Hackers for Golang series: Dependency Injection. Covers why it’s crucial for clean code, with Python examples before Go. It’s complex but worth learning early. Check it out and let me know your thoughts!

🔗 https://youtu.be/BhLpqRev80s

🐥 [ tweet ]