18; Red Team Operator at UNDISCLOSED; Be humble, there is always something to learn.
LAN
Joined April 2025
- Tweets49
- Following59
- Followers309
- Likes752
Pinned Tweet
New research: InsomniacUnwinding
"Call stack spoofing is mandatory for sleep masking"
No, it's not. Surgical UNWIND_INFO preservation: ~250 bytes vs ~6KB .rdata. Signatures encrypted, stack intact, no spoofing.
Github: github.com/kapla0011/Insomni…
Blog:
lorenzomeacci.com/unwind-dat…
Yippee! Nothing special to the gurus; it's a super-known driver, but I learned a lot in the reversing and exploit creation process. Time for some unknown drivers next!
kapla retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
This jet lag is killing me in Vegas. I want to sleep at 10 AM. Luckily we have this awesome pool to keep me awake.
kapla retweeted
Need to do an NTLM relay over C2 but local priv-esc isn't possible?
@_logangoins new post walks through relaying NTLM auth out of a network and back in through red team infra to bypass traditional relay controls, plus how defenders actually stop it.
specterops.io/blog/2026/07/1…
kapla retweeted
[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows?
youtube.com/watch?v=tOVcScKu…
kapla retweeted
FREE THEM. THEY DID NOTHING WRONG
❗️ The world's biggest anime piracy site HiAnime's suspected operators have been arrested in Vietnam.
Vietnamese police say the group ran 100+ piracy sites since 2020, uploaded 26,000+ films, and pulled in roughly $12.85 million in ad revenue. Four suspects are in custody; three are under travel restrictions.
The arrests follow a multi-year investigation supported by US Homeland Security Investigations, the DOJ, and anti-piracy coalition ACE.
kapla retweeted
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
More and more AI slop blogs are built for content farming and clicks. Posting timelines no human could write, let alone review. Most of it is straight up wrong information. Makes me wonder if AI gets worse over time, recursively training on its own polluted, wrong data.
kapla retweeted
Not sure what all the fuss was about with CET? I never considered cetcompat to be a dealbreaker as most operators ideally bring in their own sideloads which are non-cet, unless you plan to inject microsoft processes. Spent last 2 days to test a theory and built a shellcode POC to find atleast 3 different techniques to build a fully unwindable cetcompat stack frame. As much as this was easy, integrating it into brute ratel is gonna be fun.. Looks like next release might be slightly delayed...
