Pinned Tweet
Excited I made it to the MSRC @msftsecresponse Top 100 Most Valuable Researchers (MVRs) ! #76 overall and #9 for Office 🔥
Congratulations to our MSRC 2022 Most Valuable Researchers! Thank you to all the researchers who have helped secure our customers. Check out our blog for the full list: msrc-blog.microsoft.com/2022… #cybersecurity #securityresearch
Dlive retweeted
Windows Exploitation Techniques: Dangling COM Object Registrations projectzero.google/2026/09/w…
Dlive retweeted
Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>
sites.google.com/site/zhinia…
Dlive retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
Dlive retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
Dlive retweeted
We have identified vulnerabilities in Microsoft Azure Data Factory’s integration with Apache Airflow that allow attackers to gain persistent shadow admin control, impact centralized log tampering, and more. Learn how to protect your cloud environment: bit.ly/3VJlrbf
ALT Pictorial representation of vulnerabilities in Azure Data Factory's integration with Apache Airflow. Illustration of a digital cloud with a padlock symbol, set against a background of neon circuit board lines.
Dlive retweeted
Nice analysis but it seems this PoC is an information leak bug (CVE-2024-49113 ?) I reported that is incorrectly tagged as DoS. So instead of calling it LDAPNightmare I'd prefer LdapBleeding. And @msftsecresponse could you please help to correct the bulletin🤣?
Starting 2025 strong! We’ve developed a PoC exploit for CVE-2024-49112. Read the blog and check out the GitHub repo: hubs.ly/Q030X5Y00
Just the beginning of the great things SafeBreach will deliver this year; stay informed at hubs.ly/Q030X2pM0. #CTEM #whatisPropagate
Dlive retweeted
During a recent engagement, @Bandrel discovered how an attacker can craft a CSR by using default system certificates. After finding out this method was novel, the team kept digging. Read what they found in our new #blog! hubs.la/Q02SCqpG0
Dlive retweeted
DCOM cross-session coercion + Kerberos = 💣 We took a closer look at the attacks discovered by @decoder_it and @D1iv3 earlier this year and made a PoC in Python! Curious? Full blog post here: blog.compass-security.com/20…
#potato #impacket
Dlive retweeted
In today's WTF?!?!? moment
When a ESXi server is domain-joined, it assumes any "ESX Admins" group & its members should have full admin rights.
So.... anyone who can create & manage a group in AD, can get full admin rights to the VMware ESX hypervisors!
microsoft.com/en-us/security…
Microsoft has uncovered a vulnerability in ESXi hypervisors, identified as CVE-2024-37085, being exploited by threat actors to obtain full administrative permissions on domain-joined ESXi hypervisors and encrypt critical servers in ransomware attacks. msft.it/6012lbTai
Dlive retweeted
Windows Server 2025 Active Directory Updates Thread!
Server 2025 is in preview, so I took a look at updated features, specifically Active Directory, with a focus on security features.
Article:
What's new in Windows Server 2025 (preview)
learn.microsoft.com/en-us/wi…
#AD2025🧵
Dlive retweeted
Didn't check the code yet, but looks like SilverPotato and CertifiedDCOM have a working public weaponized tool by now:
github.com/CICADA8-Research/…
That's huge news from my perspective🔥
Dlive retweeted
To understand what it does you should better read the original publications from @decoder_it and or @D1iv3. Plus the linked blog from @tiraniddo. For me this readme is perfectly fine. All details were published before.
Dlive retweeted
We found a Remote Code Execution (RCE) vulnerability in @Ollama - one of the most popular AI inference projects on GitHub. Here is everything you need to know about #Probllama (CVE-2024-37032) 🧵👇
Dlive retweeted
How can I analyze and reproduce the Nexus Repository 3 Path Traversal Vulnerability (CVE-2024-4956) with Java Fuzzing (Jazzer)
exp10it.io/2024/05/%E9%80%9A…
Dlive retweeted
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…
Dlive retweeted
Without further ado - here is EtwInspector!
This is a C++ tool to help users interact with ETW providers. This tool supports the enumeration of providers, their events, and capture events.
github.com/jsecurity101/ETWI…
When interacting with ETW I always feel like I have to use 2-3 tools to enumerate and capture desired events.
What if there was an ETW tool that allowed you to enumerate providers, events that providers support, but also capture (multiple) providers.
New ETW tool coming soon to a GitHub repo near you soon :)
Dlive retweeted
Taking a cue from @D1iv3 and @decoder_it's work on inducing authentication out of remote DCOM I thought I'd quickly write up a post about getting Kerberos authentication out of the initial OXID resolving call. tiraniddo.dev/2024/04/relayi…
