😈 [ Andrea Pierini @decoder_it ]

KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)

🔗 https://github.com/decoder-it/KrbRelayEx-RPC

🐥 [ tweet ]

😈 [ Thomas Seigneuret @_zblurx ]

Fear no more for LDAP Signing and Channel binding with Impacket based tools 😎

🔗 https://github.com/fortra/impacket/pull/1919

🐥 [ tweet ]

😈 [ 5pider @C5pider ]

spend some time rewriting stardust to be more minimalist and easier to use! I needed a generic minimal shellcode template that works for both x86 and x64 out of the box so I rewrote stardust to do so.

It is now written in C++20 and utilizing some of its language features. The template can be used to easily write shellcode fast in a more modern and less painful way.
The project can be compiled in release or debug mode, where as debug mode will just allow the use of DBG_PRINTF, which calls DbgPrint under the hood to print out strings to the currently attached debugger.

There are more things i have added so consider checking it out. I removed global variable access since i no longer use it nor require it (went for diff design heh). If u still need that feature I would recommend to change the branch to "globals-support" where the old version is hosted.

🔗 https://github.com/Cracked5pider/Stardust

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

Loki C2 blog drop! Thank you for all those who helped and all the support from the community. Big shoutout to @d_tranman and @chompie1337 for all their contributions to Loki C2! @IBM @IBMSecurity @XForce

🔗 https://securityintelligence.com/x-force/bypassing-windows-defender-application-control-loki-c2/

🐥 [ tweet ]

😈 [ NetSPI @NetSPI ]

Beacon Object Files (BOFs) in C2 platforms limit developers.

Read NetSPI's blog post to explore a reference design for a new BOF portable executable (PE) concept that bridges the gap between modern C++ development and memory-executable C2 integration.

🔗 https://www.netspi.com/blog/technical-blog/network-pentesting/the-future-of-beacon-object-files/

🐥 [ tweet ]

😈 [ Wietze @Wietze ]

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections.

My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees.

Here’s what I found and why it matters:

🔗 https://wietze.github.io/blog/bypassing-detections-with-command-line-obfuscation

🐥 [ tweet ]

😈 [ bohops @bohops ]

This ended up being a great applied research project with @d_tranman on weaponizing a technique for fileless DCOM lateral movement based on the original work of @tiraniddo. Excellent work, Dylan!

Blog:
🔗 https://www.ibm.com/think/news/fileless-lateral-movement-trapped-com-objects

PoC:
🔗 https://github.com/xforcered/ForsHops

🐥 [ tweet ][ quote ]

😈 [ Craig Rowland - Agentless Linux Security @CraigHRowland ]

This new Linux script from THC will encrypt and obfuscate any executable or script to hide from on-disk detection:

🔗 https://github.com/hackerschoice/bincrypter

I'm going to show you how to detect it with command line tools in this thread:

🔗 https://threadreaderapp.com/thread/1905052948935377402.html

🐥 [ tweet ]

😈 [ Oddvar Moe @Oddvarmoe ]

Many people wanted my slides from the Windows Client Privilege Escalation webinar yesterday.

Here are links to the slides and the recording of the webinar.

Slides:
🔗 https://www.slideshare.net/slideshow/windows-client-privilege-escalation-shared-pptx/277239036

Recording:
🔗 https://youtu.be/EG2Mbw2DVnU?si=rlx-GG2QMQpIxQYi

🐥 [ tweet ]

😈 [ Duncan Ogilvie 🍍 @mrexodia ]

Success! Claude 3.7 with my IDA Pro MCP server managed to solve the crackme that was previously failing🦾

The trick was adding a convert_number tool and stress to always use it for conversions. It took ~7 minutes to run and the cost was $1.85. Also includes an analysis report.

🔗 https://github.com/mrexodia/ida-pro-mcp

🐥 [ tweet ]

рип цтфы категории пвн

😈 [ Yehuda Smirnov @yudasm_ ]

Excited to release a tool I've been working on lately: ShareFiltrator

ShareFiltrator finds credentials exposed in SharePoint/OneDrive via the Search API (_api/search/query) and also automates mass downloading of the discovered items.

Blog:
🔗 https://blog.fndsec.net/2025/04/02/breaking-down-sharepoint-walls/

Code:
🔗 https://github.com/Friends-Security/sharefiltrator

🐥 [ tweet ]

😈 [ Bobby Cooke @0xBoku ]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!

🔗 https://github.com/boku7/Loki

🐥 [ tweet ]

😈 [ ippsec @ippsec ]

After using Python for so long, I've been trying to switch to GoLang over the last two years just to try something new. I'm finally somewhat confident in being able to write I'd try to create a video series to help others. This is the first video:

🔗 https://youtu.be/uJFW4c4QE0U

🐥 [ tweet ]

😈 [ Matt Creel @Tw1sm ]

Nothing new, but formalized some operator notes on Entra ID/Azure tradecraft I've found to be exceptionally useful on ops. Overlooked this myself for quite some time and thought others in the same boat might find it worth a read! 📖

🔗 https://medium.com/specter-ops-posts/an-operators-guide-to-device-joined-hosts-and-the-prt-cookie-bcd0db2812c4

🐥 [ tweet ]

😈 [ Andrew Oliveau @AndrewOliveau ]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

Blog:
🔗 https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions

Code:
🔗 https://github.com/xforcered/RemoteMonologue

🐥 [ tweet ]

😈 [ Elad Shamir @elad_shamir ]

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs.

Read my detailed post - the most comprehensive guide on NTLM relay & the new edges:

🔗 https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e

🐥 [ tweet ]

😈 [ S3cur3Th1sSh1t @ShitSecure ]

As this is public now - an alternative to modifying AppIds to make them use the interactive user via the remote registry you can also use a lot of existing CLSIDs which have the interactive user configured and coerce an incoming RPC authentication from loggedon users 😎

🐥 [ tweet ][ quote ]