😈 [ 📔 Michael Grafnetter @MGrafnetter ]

New Indicator of Compromise (IoC) by the NTLM Relay Attack with Shadow Credentials, thanks to bugs in Impacket, a popular Python implementation. Will probably be fixed in the near future.

🔗 https://www.dsinternals.com/en/indicator-of-compromise-shadow-credentials-ntlm-relay-impacket/

🐥 [ tweet ]

😈 [ MrAle98 @MrAle_98 ]

Hey there,

Finally published the article on the exploit for CVE-2025-21333-POC exploit.

Here the link to the article:

🔗 https://medium.com/@ale18109800/cve-2025-21333-windows-heap-based-buffer-overflow-analysis-d1b597ae4bae

🐥 [ tweet ]

😈 [ c0rnbread @0xC0rnbread ]

Today I'm releasing Xenon, a custom Mythic agent for Windows targets written in C.

Notable features include:
📁 Modular command/code inclusion
🦠 Malleable C2 Profile support
🪨 Compatible with Cobalt Strike BOFs

🔗 https://github.com/MythicAgents/Xenon

Blog series:
🔗 https://c0rnbread.com/creating-mythic-c2-agent-part1/

🐥 [ tweet ]

😈 [ Andrea Pierini @decoder_it ]

KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)

🔗 https://github.com/decoder-it/KrbRelayEx-RPC

🐥 [ tweet ]

😈 [ Thomas Seigneuret @_zblurx ]

Fear no more for LDAP Signing and Channel binding with Impacket based tools 😎

🔗 https://github.com/fortra/impacket/pull/1919

🐥 [ tweet ]

😈 [ 5pider @C5pider ]

spend some time rewriting stardust to be more minimalist and easier to use! I needed a generic minimal shellcode template that works for both x86 and x64 out of the box so I rewrote stardust to do so.

It is now written in C++20 and utilizing some of its language features. The template can be used to easily write shellcode fast in a more modern and less painful way.
The project can be compiled in release or debug mode, where as debug mode will just allow the use of DBG_PRINTF, which calls DbgPrint under the hood to print out strings to the currently attached debugger.

There are more things i have added so consider checking it out. I removed global variable access since i no longer use it nor require it (went for diff design heh). If u still need that feature I would recommend to change the branch to "globals-support" where the old version is hosted.

🔗 https://github.com/Cracked5pider/Stardust

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

Loki C2 blog drop! Thank you for all those who helped and all the support from the community. Big shoutout to @d_tranman and @chompie1337 for all their contributions to Loki C2! @IBM @IBMSecurity @XForce

🔗 https://securityintelligence.com/x-force/bypassing-windows-defender-application-control-loki-c2/

🐥 [ tweet ]

😈 [ NetSPI @NetSPI ]

Beacon Object Files (BOFs) in C2 platforms limit developers.

Read NetSPI's blog post to explore a reference design for a new BOF portable executable (PE) concept that bridges the gap between modern C++ development and memory-executable C2 integration.

🔗 https://www.netspi.com/blog/technical-blog/network-pentesting/the-future-of-beacon-object-files/

🐥 [ tweet ]

😈 [ Wietze @Wietze ]

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections.

My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees.

Here’s what I found and why it matters:

🔗 https://wietze.github.io/blog/bypassing-detections-with-command-line-obfuscation

🐥 [ tweet ]

😈 [ bohops @bohops ]

This ended up being a great applied research project with @d_tranman on weaponizing a technique for fileless DCOM lateral movement based on the original work of @tiraniddo. Excellent work, Dylan!

Blog:
🔗 https://www.ibm.com/think/news/fileless-lateral-movement-trapped-com-objects

PoC:
🔗 https://github.com/xforcered/ForsHops

🐥 [ tweet ][ quote ]

😈 [ Craig Rowland - Agentless Linux Security @CraigHRowland ]

This new Linux script from THC will encrypt and obfuscate any executable or script to hide from on-disk detection:

🔗 https://github.com/hackerschoice/bincrypter

I'm going to show you how to detect it with command line tools in this thread:

🔗 https://threadreaderapp.com/thread/1905052948935377402.html

🐥 [ tweet ]

😈 [ Oddvar Moe @Oddvarmoe ]

Many people wanted my slides from the Windows Client Privilege Escalation webinar yesterday.

Here are links to the slides and the recording of the webinar.

Slides:
🔗 https://www.slideshare.net/slideshow/windows-client-privilege-escalation-shared-pptx/277239036

Recording:
🔗 https://youtu.be/EG2Mbw2DVnU?si=rlx-GG2QMQpIxQYi

🐥 [ tweet ]

😈 [ Duncan Ogilvie 🍍 @mrexodia ]

Success! Claude 3.7 with my IDA Pro MCP server managed to solve the crackme that was previously failing🦾

The trick was adding a convert_number tool and stress to always use it for conversions. It took ~7 minutes to run and the cost was $1.85. Also includes an analysis report.

🔗 https://github.com/mrexodia/ida-pro-mcp

🐥 [ tweet ]

рип цтфы категории пвн

😈 [ Yehuda Smirnov @yudasm_ ]

Excited to release a tool I've been working on lately: ShareFiltrator

ShareFiltrator finds credentials exposed in SharePoint/OneDrive via the Search API (_api/search/query) and also automates mass downloading of the discovered items.

Blog:
🔗 https://blog.fndsec.net/2025/04/02/breaking-down-sharepoint-walls/

Code:
🔗 https://github.com/Friends-Security/sharefiltrator

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!

🔗 https://github.com/boku7/Loki

🐥 [ tweet ]