Windows Offensive Security Enthusiast 🤠 Blog: https://xitter.cf/t.co/CAwdjs2rKS GitHub: https://xitter.cf/t.co/YG2YOxfosm
Amsterdam, The Netherlands
Joined March 2016
- Tweets240
- Following107
- Followers1.7K
- Likes266
Arris Huijgen retweeted
Malware authors often hide their tracks using COM, but our latest guide provides the roadmap you need to decode those cryptic vtable calls and finally see exactly what’s happening under the hood: cs.co/6014BDgbFs
Arris Huijgen retweeted
Wrote a new blog about caveats with tools detecting(or mis detecting) relay exploit primitives against http(ESC8) and MSSQL endpoints. Kept noticing issues in tools reporting the absence or presence of vulns that I thought others may have noticed too abdulmhsblog.com/posts/pitfa…
Arris Huijgen retweeted
Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection.
github.com/CCob/DRSAT
Arris Huijgen retweeted
🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷♂️
Read Here - akamai.com/blog/security-res…
Arris Huijgen retweeted
What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution?
We explored process injection using nothing but thread context.
Full write-up + PoCs:
blog.fndsec.net/2025/05/16/t…
Arris Huijgen retweeted
Blogpost from my colleague about what’s still possible with recently published COM/DCOM toolings, Cross Session Activation and Kerberos relaying 🔥
r-tec.net/r-tec-blog-windows…
Arris Huijgen retweeted
ProxyBlob is alive ! We’ve open-sourced our stealthy reverse SOCKS proxy over Azure Blob Storage that can help you operate in restricted environments 🔒
🌐 github.com/quarkslab/proxybl…
Blog post for more details right below ⬇️
Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure.
Check out @_atsika's article on how it came to exist after an assumed breach mission ⤵️
👉 blog.quarkslab.com/proxyblob…
ALT Proxybloby is the red teamer's mascot. Be careful, if left alone in you network it will byte your SOCKS
Arris Huijgen retweeted
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…
Arris Huijgen retweeted
The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_
Writeup: sensepost.com/blog/2025/is-t…
PR to impacket:
github.com/fortra/impacket/p…
Demo: youtu.be/3mG2Ouu3Umk
Arris Huijgen retweeted
We’re glad to announce we released Soxy!🚀
A Rust-powered suite of services for Citrix, VMware Horizon & Windows RDP.
Red teams & pentesters can use it to pivot for deeper access.
Get the tool and more details: 🔗 github.com/airbus-seclab/sox…
Arris Huijgen retweeted
Your laptop was stolen. It’s running Windows 11, fully up-to-date, device encryption (BitLocker) and Secure Boot enabled. Your data is safe, right? Think again! This software-only attack grabs your encryption key. Following up on our #38C3 talk: neodyme.io/blog/bitlocker_sc…
Arris Huijgen retweeted
How to bypass BitLocker encryption on Windows 11 noinitrd.github.io/Memory-Du…
Arris Huijgen retweeted
Just released SCCMHound! A BloodHound collector for SCCM. SCCMHound allows both attackers and defenders to construct BloodHound datasets using the vast
amount of information that is stored/retrievable through SCCM. Feel free to take it for a spin!
github.com/CrowdStrike/sccmh…
Arris Huijgen retweeted
A new fun way to set shadow credentials
posts.specterops.io/attackin…
Arris Huijgen retweeted
Ever wondered how CryptProtectMemory with the CRYPTPROTECTMEMORY_SAME_PROCESS flag worked, or if encrypted blobs could be decrypted without code injection ? I wrote a blogpost about it: blog.slowerzs.net/posts/cryp…
Arris Huijgen retweeted
Dropping a new initial access technique via RDP that I dubbed "Rogue RDP". Use malicious .RDP files to bypass email/servers/security gateways and then run code to binary plant/exfil from your own RDP server, blinding EDR. Bonus: Target runs HyperV? RCE! blackhillsinfosec.com/rogue-…
Arris Huijgen retweeted
Hello: I'm your ADCS server and I want to authenticate against you. My latest Post and PoC are out. You can read it here: decoder.cloud/2024/02/26/hel… Enjoy :)
Arris Huijgen retweeted
Eliminate huge part of lateral movement scenarios with one command: "reg.exe add HKLM\SYSTEM\CurrentControlSet\Control /v DisableRemoteScmEndpoints /t REG_DWORD /d 1"
It will make Service Control Manager deaf to remote management. Everything else works properly.
Arris Huijgen retweeted
Just updated lolol.farm with a few more entries
Also, let me know if there are any others that should be added
Arris Huijgen retweeted
Ok, pinvoke.dev is now live. A simple GitBook of code-generated P/Invoke signatures. Just C# for now, but I may add Rust and a few others in the future.
