@bitsadmin

Windows Offensive Security Enthusiast 🤠 Blog: https://xitter.cf/t.co/CAwdjs2rKS GitHub: https://xitter.cf/t.co/YG2YOxfosm

 Amsterdam, The Netherlands
bitsadmin.com/
Joined March 2016
  • Tweets240
  • Following107
  • Followers1.7K
42Media
Malware authors often hide their tracks using COM, but our latest guide provides the roadmap you need to decode those cryptic vtable calls and finally see exactly what’s happening under the hood: cs.co/6014BDgbFs
4
14
2,356
Arris Huijgen retweeted
Abdul Mhanni
@abdo_mhanniJun 24
Wrote a new blog about caveats with tools detecting(or mis detecting) relay exploit primitives against http(ESC8) and MSSQL endpoints. Kept noticing issues in tools reporting the absence or presence of vulns that I thought others may have noticed too abdulmhsblog.com/posts/pitfa…

When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss

Recently on engagements I started experiencing two reoccurring patterns, the first being that certipy and certify would both show me that a endpoint is not vulnerable to the ESC8 attack even though...

abdulmhsblog.com
2
20
4
60
10,864
I just added @ExploitDB as additional source of exploits to #WESNG's collector making "Windows Exploit Suggester - Next Generation" even more comprehensive for identifying unpatched vulnerabilities and exploiting those. Happy hacking! 😎 github.com/bitsadmin/wesng

GitHub - bitsadmin/wesng: Windows Exploit Suggester - Next Generation

Windows Exploit Suggester - Next Generation. Contribute to bitsadmin/wesng development by creating an account on GitHub.

github.com
8
15
650
Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection. github.com/CCob/DRSAT

GitHub - CCob/DRSAT: Disconnected RSAT - A method of running Group Policy Manager, Certificate...

Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies - CCob/DRSAT

github.com
4
62
1
155
15,254
Because the last release of #NoPowerShell was 2 years ago and to celebrate the repo has 999 stars, I just merged DEV ➡️ MASTER and published Release 1.50 containing over 60 offensive cmdlets! 🥳 github.com/bitsadmin/nopower… See examples of some of the cmdlets below 👇

GitHub - bitsadmin/nopowershell: PowerShell rebuilt in C# for Red Teaming purposes

PowerShell rebuilt in C# for Red Teaming purposes. Contribute to bitsadmin/nopowershell development by creating an account on GitHub.

github.com
1
46
2
139
8,390
more replies
🔎 Inspecting ACLs and file hashes using the Get-Acl and Get-FileHash cmdlets.
1
224
Many more examples are in the CHEATSHEET at github.com/bitsadmin/nopower… or use the Get-Help/man command followed by the cmdlet, e.g. man iwr. Regularly new cmdlets are added in NoPowerShell's DEV branch so keep an eye there to get the latest and greatest! 🔥 github.com/bitsadmin/nopower…
1
2
204
Arris Huijgen retweeted
Yuval Gordon@YuG0rd21 May 2025
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️ Read Here - akamai.com/blog/security-res…
22
370
18
872
170,186
Arris Huijgen retweeted
Yehuda Smirnov@yudasm_16 May 2025
What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution? We explored process injection using nothing but thread context. Full write-up + PoCs: blog.fndsec.net/2025/05/16/t…

New Process Injection Class: The CONTEXT-Only Attack Surface

What happens when you skip memory allocation, skip writing, and weaponize thread context alone? This post explores a new class of process injection that lives entirely in the execution layer — no a…

blog.fndsec.net
6
73
1
220
13,981
Arris Huijgen retweeted
S3cur3Th1sSh1t@ShitSecure7 May 2025
Blogpost from my colleague about what’s still possible with recently published COM/DCOM toolings, Cross Session Activation and Kerberos relaying 🔥 r-tec.net/r-tec-blog-windows…

r-tec Blog | Windows is and always will be a Potatoland

This blog post will dive into the world of some of the recently published potato techniques that can lead to more serious risks than

r-tec.net
3
108
2
301
26,113
Arris Huijgen retweeted
Atsika
@_atsika30 Apr 2025
ProxyBlob is alive ! We’ve open-sourced our stealthy reverse SOCKS proxy over Azure Blob Storage that can help you operate in restricted environments 🔒 🌐 github.com/quarkslab/proxybl… Blog post for more details right below ⬇️

GitHub - quarkslab/proxyblob: SOCKS5 proxy tool that uses Azure Storage services as a means of...

SOCKS5 proxy tool that uses Azure Storage services as a means of communication. - quarkslab/proxyblob

github.com
quarkslab@quarkslab29 Apr 2025
Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure. Check out @_atsika's article on how it came to exist after an assumed breach mission ⤵️ 👉 blog.quarkslab.com/proxyblob…
Proxybloby is the red teamer's mascot. Be careful, if left alone in you network it will byte your SOCKS

ALT Proxybloby is the red teamer's mascot. Be careful, if left alone in you network it will byte your SOCKS

3
45
112
9,186
Cool, novel, lateral movement technique by @william_knows by dropping a .dll file on a remote host obtaining code execution! 💡
William Knowles@william_knows28 Apr 2025
.NET GAC and NIC hijacking for lateral movement: williamknowles.io/net-gac-an…
23
153
16,943
Arris Huijgen retweeted
Andrea P@decoder_it24 Apr 2025
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

From NTLM relay to Kerberos relay: Everything you need to know

While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

decoder.cloud
2
149
2
348
19,769
The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_ Writeup: sensepost.com/blog/2025/is-t… PR to impacket: github.com/fortra/impacket/p… Demo: youtu.be/3mG2Ouu3Umk
1
43
1
117
9,997
We’re glad to announce we released Soxy!🚀 A Rust-powered suite of services for Citrix, VMware Horizon & Windows RDP. Red teams & pentesters can use it to pivot for deeper access. Get the tool and more details: 🔗 github.com/airbus-seclab/sox…

GitHub - airbus-seclab/soxy: A suite of services (SOCKS, FTP, shell, etc.) over Citrix, VMware...

A suite of services (SOCKS, FTP, shell, etc.) over Citrix, VMware Horizon and native Windows RDP virtual channels. - airbus-seclab/soxy

github.com
61
1
146
7,496
Load more