@lowercase_drm

@AlmondOffSec but mostly shilling for #pywerview

Joined March 2022
  • Tweets272
  • Following93
  • Followers798
86Media
Choose your poison 🦋 bsky.app/profile/lowercasedr… 🐘 mastodon.social/@drm (still posting here too)
1
2,325
5ebc8a47a4efd588b7b424ec7e8552843731ed4a39f999314b60985e0088ae85
1
78
It’s the first time I see some resin (epoxy?) on flash pins that prevents SPI sniffing (and thus VMK dumping too) 😮. Can it be removed easily? Model: Lenovo X1 Gen 9 @en4rab @NoobieDog @ghidraninja @pascal_gujer
4
1
6
1,103
For the record, it is a known problem on badcaps. badcaps.net/forum/troublesho…
46
None of this exists without the original research and tooling. 🙏 Massive thanks to @lowercase_drm and @AlmondOffSec for PassTheCert, this Rust port stands entirely on their work: github.com/AlmondOffSec/Pass…

GitHub - AlmondOffSec/PassTheCert: Proof-of-Concept tool to authenticate to an LDAP/S server with a...

Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through Schannel - AlmondOffSec/PassTheCert

github.com
5
32
1,496
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/08/…
7
160
6
450
34,424
You can know dump TDO with secretsdump dot py, thanks to Goultarde 🥳
Almond OffSec@AlmondOffSecMar 10
Are one-way trusts really one way? @lowercase_drm sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets. offsec.almond.consulting/tru…
7
1
16
3,768
I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer jakeotte.com/posts/klist-rev…

klist.exe Revisited: Internals and Further Use Cases – Jake Otte

A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, and examining behavior under Credential Guard.

jakeotte.com
2
79
1
300
18,655
10 years ago, my colleague Yannick published pywerview. I was an early adopter and later became an official co-maintainer. I still use it on every pentest. Nowadays, a project like that could probably be vibe-coded in no time by burning tokens, but it was a f* great adventure!
11
356
Recently sniff a SPI bus for the first time (with and without PIN) on a Lenovo T470. It's quite fun, event with a DSLogic! s/o @en4rab for SPITkey.
For the Lenovo T470, a SPI flash shares the SPI bus with the TPM

ALT For the Lenovo T470, a SPI flash shares the SPI bus with the TPM

5
8
23
2,894
more replies
HP Probook 440 G5: TPM sniffed on the BIOS flash (SOIC 8)
1
151
HP EliteBook x360 1030 G8: sniffed on the bios chip (UC3)
64
(near) Instant dumping of the Bitlocker VMK using @SipeedIO #SLogic16U3 and #ngscopeclient 🥰. Full disclosure: i know nothing about C++, filter was fully vibe coded (with a Claude free plan)
5
31
2,991
drm retweeted
🕳@sekurlsa_pwJun 6
Padding Oracle in MS-BKRP (BackuprKey RPC) “decrypt DPAPI v2/v3 domain backup blobs via distinguishable error codes on the DC's BackuprKey endpoint.” You need the masterkey in users roaming dir: Roaming\Microsoft\Protect\<SID>\<GUID> Creds: Bad-Jubies github.com/Bad-Jubies/Exploi…

Exploits/MS-BKRP_padding_oracle_decrypt.py at main · Bad-Jubies/Exploits

This is a collection of proof-of-concept exploits for various targets. - Bad-Jubies/Exploits

github.com
1
26
79
4,730
github.com/NoobieDog/TPM-Sni… Continues to grow! Loads more laptops added to the repo that are extractable! Dell Lattitude 5430 and 5440! @lowercase_drm @en4rab

GitHub - NoobieDog/TPM-Sniffing: A repo for TPM sniffing greatness

A repo for TPM sniffing greatness. Contribute to NoobieDog/TPM-Sniffing development by creating an account on GitHub.

github.com
3
18
1
66
5,800
Please, be advised that someone is using a forked repo of my KingCastle python script to spread LUA malware. What a time to be alive. User: Ramdhankola Repo: KingCastle 🌻
191
Two more zerodays - deadeclipse666.blogspot.com/…
9
115
11
469
68,169
Asked Claude to code a small site for the @NoobieDog repo about TPM sniffing. It was a fun exercice (even with a free tier claude account haha). vmk.lol
7
343
drm retweeted
MDSec@MDSecLabsMar 26
In our latest post, researcher @craigsblackie documents attacks against the Dell UEFI firmware that enable DMA attacks against TPM-only bitlockered devices mdsec.co.uk/2026/03/disablin…
3
50
156
13,206
Load more