I like to learn about Windows/Active Directory pentesting, Red Team stuff & Maldev enjoyer
Joined May 2018
- Tweets2.3K
- Following859
- Followers435
- Likes3.4K
NOODLE retweeted
I've never worked on WhatsApp before, so I thought it'd be interesting to poke it with a stick!
I wrote an article about my attempt to uncover WhatsApp's CVE-2026-23866:
numb3rs.re/posts/cve-2026-23…
This is my first article on mobile VR, let me know what you think!
NOODLE retweeted
Did you know you can spot which servers and workstations have the WebClient (WebDAV) service running, straight from BloodHound-CE?🔥
A machine with WebClient running can be forced to authenticate over HTTP (PetitPotam/PrinterBug via WebDAV), then NTLM-relayed to LDAP for RBCD / Shadow Credentials, or to AD CS Web Enrollment (ESC8) to compromise the target.
This Cypher query surfaces them all at once, so you can prioritize targets:👇
MATCH (c:Computer)
WHERE c.webclientrunning = true
RETURN c LIMIT 1000
RustHound-CE v2.5.22 adds the WebClient collection method, run automatically with -c All
github.com/g0h4n/RustHound-C…
#RedTeam #ActiveDirectory #BloodHound
NOODLE retweeted
Did you know you can request a certificate via NTLM relay through these 2 AD CS endpoints? 🔥
/_CES_Kerberos/service.svc/CES
/_CES_NTLM/service.svc/CES
This article explains it really well 👇
adhdmurky.github.io/posts/po…
RustHound-CE v2.5.21 now also checks whether these endpoints exist (on top of /certsrv/certfnsh.asp) so #BloodHound can graph the path!
#ADCS #ESC_CES
NOODLE retweeted
Enfin!! Big update for RustHound-CE version 2.5.20 🦀 🔥
LocalGroups collection over SAMR RPC (AdminTo, CanRDP, ExecuteDCOM, CanPSRemote edges)
Four edges your graph was missing when collecting with RustHound-CE. Not anymore!
New collection method --collection-method LocalGroup, also wired into All 🚀
Link: github.com/g0h4n/RustHound-C…
NOODLE retweeted
Need to pivot through a macOS target during a Red Team operation? 🍎
Mirage C2 includes built-in SOCKS proxying, letting operators route traffic through a compromised Mac and reach resources beyond the initial foothold.
Start it. Pivot. Keep moving.
Part of DarwinOps by BallisKit.
#RedTeam #macOS
NOODLE retweeted
Releasing new tool named localgroups-rs v1.0.0 🦀 🔥
Local group enumeration over RPC, SAMR and SID resolution over RPC, LSAT!
The initial goal is to bring the AdminTo / CanRDP / ExecuteDCOM / CanPSRemote edges to RustHound-CE for the collection phase. It then grew into a standalone BUILTIN alias enumeration tool.
Good to know: no local admin needed on domain controllers and on hosts older than Win10 1607 / Server 2016. From 1607 / 2016 onward, RestrictRemoteSam reserves the BUILTIN aliases for local admins only.
NOODLE retweeted
Need to red team macOS targets but don't know where to start?
Introducing Mirage C2 🥷! Our new modular, in-memory macOS implant for DarwinOps.
Shell, SOCKS proxy, credential & secret extraction, plus private techniques for process injection, privilege escalation, TCC bypass & persistence.
From initial access to post-exploitation and EDR evasion, BallisKit now brings the full attack chain to macOS.
#RedTeam #macOS
NOODLE retweeted
Yes again.. New update for RustHound-CE version 2.5.14 🦀 🔥
Attribute-by-attribute audit against SharpHound v2.16.0.0 on the same domain, compatibility goes from 69% to 84%, and ROADMAP.md is now up to date, object by object.
Next big gap is Computer, currently at 62%; LocalGroups, NTLMRegistryData, DCRegistryData, SmbInfo and IsWebClientRunning all need remote registry / SMB access (already implemented in src/transport/smb.rs). Same story for CARegistryData on EnterpriseCA. That work should take us past 90%!!
Taking a week or two off before starting it🌴
Link: github.com/g0h4n/RustHound-C…
Read below 👇1/4
NOODLE retweeted
Releasing passthecert-rs v1.0.4 🦀 🔥
Support for Shadow Credentials attack! 🔑
Write msDS-KeyCredentialLink on any target you can reach and get back its NT hash / TGT.
Also in this release:
- rusthound_ce: a shortcut to dump the whole domain for BloodHound-CE, straight from your certificate 🐾
Both available from the CLI and from the interactive ldapshell, one LDAPS session over Schannel, and you chain every action without ever re-authenticating
Link: github.com/g0h4n/PassTheCert…
NOODLE retweeted
New update for RustHound-CE version 2.5.13 🦀🔥
New in this release:
- Pass-the-Certificate auth support (PFX / PEM, LDAPS via Schannel)
On top of username:password, pass-the-hash (NT hash) and Kerberos ccache, you can now authenticate with a certificate.
github.com/g0h4n/RustHound-C…
NOODLE retweeted
Releasing passthecert-rs v1.0.0 🦀 🔥
Pass-the-Certificate in pure Rust. 🔐
The initial goal is to bring certificate-based LDAPS auth (PFX or CRT+KEY) to RustHound-CE for the collection phase. It then grew into a full PassTheCert-style toolkit.
Link: github.com/g0h4n/PassTheCert…
NOODLE retweeted
Big update for RustHound-CE version 2.5.9 🦀 🔥
New in this release:
- GPO parsing from SYSVOL (AdminTo, CanRDP, CanPSRemote, ExecuteDCOM edges)
- Live session collection over RPC (SRVSVC / WKSSVC / WINREG)
- ESC8 web-enrollment scanner
- Pass-the-Hash auth support (with NT hash)
All wired into --collection-method All 🚀
github.com/g0h4n/RustHound-C…
NOODLE retweeted
J'organise un CTF Active Directory en ligne 🏰
12 heures 2 domaines 1 seul but : Domain Admin 👑
AD LAB LANFEUST hardéné, niveau confirmé. Mais venez tenter le siège quel que soit votre niveau ⚔️
📅 18/09 · 11h-23h · 20 teams de 4-5, sur invitation
🔗 ctfad.mpgn.fr/
NOODLE retweeted
La billetterie de l'édition 2026 de @WineRump 🍇 est ouverte
Les billets sont limités, faites vite !
Le pitch ?
Une petite conférence cyber dans une guinguette à Bordeaux
📅 le vendredi 11/09/26 à partir de 19h
🗺 à La Belle Saison
🍷 en mode cocktail dinatoire
RT appréciés 🙏
NOODLE retweeted
Just dropped a BOF (Beacon Object File) with a SYSTEM LPE + persistence by hijacking the Visual Studio Installer service via AppDomainManager. Native ETW kill, no binary replacement, beacon runs in-process inside a signed Microsoft binary.
github.com/0xaled/Vipere
NOODLE retweeted
I've noticed that @bunjavascript has been gaining a lot of traction lately, so I thought it might be interesting to take a look at its offensive potential 🕵️
The game is evolving and we have now entered a new post-exploitation era made of Virtual Machines and Interpreters. Let's revive some old techniques using modern tools ♻️
blog.atsika.ninja/posts/byoi…
NOODLE retweeted
When Linux and Your Decompiler Load Different Programs:
Built an ELF where Binary Ninja, Hex-Rays, and Ghidra all decompile a call as read(). It calls write().
The file and ld.so don't agree on what one relocation says.
Here's how:
zerotistic.blog/posts/elf-lo…
NOODLE retweeted
Create a folder called (calc). Shift+Right click « Open PowerShell Window here » and boom you have a command injection.
@podalirius_ found two command injection vulnerabilities in Windows Explorer's context menus, both exploitable since 9 years. ghst.ly/42ImlI6
NOODLE retweeted
shipping v5 of LitterBox after way too many late nights
real EDR in the loop now. drop an agent on your VM, fire payloads at it, alerts land back with full call stacks. Elastic Defend + Fibratus work. new UI + better performance — notes in the release.
github.com/BlackSnufkin/Litt…
NOODLE retweeted
DrvEye automates kernel driver analysis to uncover IOCTL paths , symbolic, dangerous primitives, and exploitable code paths, then generates PoCs, fuzzers, and rev artifacts auto
and even check if u can download any new drivers
github.com/0xDbgMan/DrvEye
