EAGAIIN retweeted
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
EAGAIIN retweeted
Outflank's ntlmrain takes Google's ~8 TiB NetNTLMv1 rainbow tables and losslessly compresses them to ~3.99 TB using globally sorted endpoints, packed 39 bit chain starts, delta encoding + Rice-16 coding, and a global GIDX index.
The result is ~1 min SSD table lookups, WebGPU-accelerated DES precomputation/verification, and ~7 min end-to-end cracking on an RTX 4070 Ti.
More Explanation in their blog: outflank.nl/blog/2026/09/08/…
Github tool: github.com/outflanknl/ntlmra…
NTLMRain Table: lookup.ntlmrain.com
#NetNTLMv1
EAGAIIN retweeted
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
EAGAIIN retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
EAGAIIN retweeted
For more than 2 years now the Red Team at MDSec have been running riot in environments by abusing ServiceNow. Today we are releasing more of our research in this space:
mdsec.co.uk/2026/08/when-it-…
The TLDR - popping ServiceNow is one of the most impactful things you can do.
EAGAIIN retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
EAGAIIN retweeted
Compromise one node in a Windows Server Failover Cluster and you've compromised all of them.
@unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster.
Check it out! ghst.ly/4wSZSoW
EAGAIIN retweeted
From a normal domain user to Domain Admin, bypassing the SID patch.
ESC1 is alive again, under some conditions.
MSRC closed it as “By design.” Writeup and PoC below, judge for yourself.
0xmaz.me/posts/certsrv-id-cm…
EAGAIIN retweeted
Cloudflare Drop just launched, temporary static site hosting (expires after 60 minutes) without an account, just drop your assets and go.
Red Teamers... GO GO GO GO!!! cloudflare.com/drop/
Example: drop-4638acd5-ef1.aback-arch…
EAGAIIN retweeted
BOF for lateral movement using MSI ODBC Driver installation.
A tool by Craig Wright (@werdhaihai)
Source: github.com/werdhaihai/msi_la…
#redteam #blueteam
EAGAIIN retweeted
I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer
jakeotte.com/posts/klist-rev…
EAGAIIN retweeted
> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging
EAGAIIN retweeted
Onelogon: Taking over Active Directory Accounts via Netlogon🔑
We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
ALT Compromise an Active Directory Domain with the Onelogon vulnerability
ALT Scanning an AD domain for accounts vulnerable to Onelogon
EAGAIIN retweeted
shipping: WinSSHound
maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.
github.com/1r0BIT/WinSSHound
EAGAIIN retweeted
The proof of concept for this issue is live - contact me if you have any issues.
I am not very experienced in C#, nor in publishing on GitHub, so any feedback is appreciated.
github.com/L1v1ng0ffTh3L4N/P…
EAGAIIN retweeted
It's been a while since I wrote a blog post. My new post writes about some cool updates to the MS-RPC-Fuzzer for recursively fuzzing complex structures, logging using ETW, and we found a way to escalate to nt\authority system!
incendium.rocks/posts/Fuzzin…
EAGAIIN retweeted
gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) github.com/mandiant/gopacket…
EAGAIIN retweeted
I just dropped some research: DSCourier and would love for your opinion and to check it out!!
It’s a novel post-exploitation technique abusing WinGet’s COM API to execute code through Microsoft-signed binaries.
GitHub: github.com/DylanDavis1/DSCou…
Blog: dylansec.com/DSCourier/
EAGAIIN retweeted
someone at ANTHROPIC just showed CLAUDE finding ZERO DAY vulnerabilities in a live conference demo
claude has found zero day in Ghost, 50,000 stars on github, never had a critical security vulnerability in its entire, history...
it found the blind SQL injection in 90 minutes, stole the admin api key, then did the exact, same thing to the linux kernel