🇨🇵 Cybersecurity engineer enjoying Windows & AD security, DFIR and detection engineering @TheDFIRReport analyst
Joined November 2020
- Tweets945
- Following392
- Followers833
- Likes3.6K
MetallicHack retweeted
Windows Exploitation Techniques: Dangling COM Object Registrations projectzero.google/2026/09/w…
MetallicHack retweeted
Super excited to see WESP land in public preview. I spent the past couple of days reverse engineering wesp.sys and espclient.dll, along with building a consumer POC.
Here is a writeup on my initial analysis: jonny-jhnson.dev/blog/a-firs…
GitHub POC: github.com/jonny-jhnson/Wesp…
MetallicHack retweeted
Fileless ELF execution via the Linux kernel keyring
Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere.
matheuzsecurity.github.io/ha…
#fileless #malware #linux #keyring
MetallicHack retweeted
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu…
ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel…
Works with latest September 2026 patch
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public.
github.com/MSNightmare/Shiel…
The PoC works with the latest August 2026 patch
MetallicHack retweeted
github.com/daffainfo/vol-rs
Volatility 3 ported to Rust. Same output, much faster.
#dfir #cybersecurity
MetallicHack retweeted
We are pleased to release tmp.0ut 5 Volume!
Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!
tmpout.sh/5/
ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers
MetallicHack retweeted
Code is up
Something seems to be brewing from beloved @ChaoticEclipse0 , git.projectnightcrawler.dev/… . Looking forward to it.
MetallicHack retweeted
EDRのテーブル完全性チェックをすり抜けるWindowsプロセスインジェクション手法が公開されています。従来手法がPEB(Process-Environment-Block、プロセス環境情報の管理領域)のコールバックテーブル自体を書き換えるのに対し、本手法はテーブルから正規のコールバック関数(__fnCOPYDATA等)のアドレスを解決した上で、その関数のプロローグ(先頭バイト列)にインラインフック(絶対ジャンプ)を設置する方式。PEB構造の改変がないため、テーブル完全性チェックに依存する整合性検証を回避できるとされています。
【要点の整理】
・__fnCOPYDATAはWM_COPYDATAメッセージへの応答で呼び出されるため、SendMessageWでの外部トリガーが可能。複雑な同期処理を必要としないコード実行の起点として機能
・実装は3段階で、対象プロセスのPEBからKernelCallbackTableポインタを読み取り→実行可能メモリにシェルコードを書き込み→正規コールバック関数のプロローグをx64絶対ジャンプスタブ(mov r10, <addr>; jmp r10)で上書きしてトリガー。実行完了後は元のプロローグバイトを復元してフック痕跡を消すため、インメモリ痕跡の残存時間が極めて短い
・変更はuser32のコールバックルーチン内部のインメモリプロローグに限定され、PEB構造やコールバックテーブルアドレスの改変がないため、これらの完全性チェックに依存する検知を回避
・実装から読み取れる検知観点として、user32の既知コールバックルーチンへのコードページ保護変更(PAGE_EXECUTE_READWRITE)の監視、NtWriteVirtualMemory等のリモートメモリ書き込み直後のSendMessageWトリガーの相関、フック設置〜復元間の短時間のメモリ保護変更の追跡が挙げられる
詳細は以下を参照：
github.com/n0qword/win32k-ca…
MetallicHack retweeted
I recently found myself trying to explain FOCI & BroCI to a colleague. I thought I understood it.. I was so wrong😂
So I took a few days to dive deep into this. I hope this will help you as much as it helped me!💙
sapirxfed.com/2026/06/30/i-d…
MetallicHack retweeted
MemNixFS - A new memory forensics tool for Linux memory!
Memory forensics in an easy to use virtual file system similar to MemProcFS - but for Linux!
github.com/MemNixFS/MemNixFS
MetallicHack retweeted
Following up on UNCanny, I found out that you can leak the host’s NetNTLM from a Windows Sandbox .wsb file by pointing HostFolder to a UNC path, before the sandbox even finishes starting. Funny place for a credential leak to hide 👀 Read more: github.com/0xHossam/UNCagedS…
#redteam #intialaccess
MetallicHack retweeted
Releasing DCOMIllusionist as part of our talk on DCOM at @x33fcon with @k3vinTell. It's a remote in memory fileless lateral movement technique based on some research of @tiraniddo
github.com/synacktiv/DCOMIll…
MetallicHack retweeted
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
MetallicHack retweeted
Have you ever wanted to query ETW providers, but didn't want to open a VM? What about checking the difference of ETW providers/events across OS builds?
Today I am releasing EtwWatcher - a tool that brings EtwInspector to GitHub pages so that you can query ETW providers, as well as compare them across builds.
This is something I wish I had for YEARS but have always opt'd to pull manually through a VM. I plan on being very active in uploading new snapshots as new OS builds come out. Check it out!
Blog: jonny-johnson.medium.com/etw…
Repo: github.com/jonny-jhnson/EtwW…
Live site: jonny-jhnson.github.io/EtwWa…
MetallicHack retweeted
Have you ever wondered why svchost can spawn from Windows Defender MsMpEng.exe withouth any flags, even though a legit svchost should always have flags?
Welp that's because its not a real svchost :D
Read - Why Does MsMpEng Spawn svchost.exe Without Flags? - research.nasbench.dev/resear…
TL;DR - MpEngine.dll (AKA Windows Defender Engine) has a function called CreateCraProcessHelper that is used as part of the AntiRootkit scanner. In it, it spawns a suspended process with just the CLI "svchost".
This is used by the engine and KSL driver to pass specific bytes from the \Device\PhysicalMemory between "Kernel" and "User mode" :D
MetallicHack retweeted
Do you know how Entra ID applications work?
What about the security mess they can bring and what they can quietly break?
New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool built to make sense of it:
blog.quarkslab.com/auditing-…
ALT Auditing Azure permissions will make your head spin Use the QAZPT, Luke!
MetallicHack retweeted
So here is new local privilege escalation zero-day I discovered, not patched yet too :).
In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint.
Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client.
In the white paper below, I describe five exploit paths you can abuse.
However it's architecture problem and maybe there are more. It's Not A Potato
securelist.com/phantomrpc-rp…