SAERXCIT retweeted
Fun fact you can get Citrix Netscaler images from Azure/AWS by doing the trial/bring your own license then export the storage volume.
SAERXCIT retweeted
A handy .NET reverse engineering trick:
Add a sample.exe.config file next to your sample and you can trace e.g. all network requests, including content and headers without hooking or bothering with proxies. Helpful to e.g. quickly inspect c2 traffic:
gist.github.com/eversinc33/c…
SAERXCIT retweeted
Lookalike Ghidra, dnSpy, and other download sites turned trusted clicks into TDS redirects. CPR found click hijacking, gated routing, and multiple malware families downstream — including an evasive, previously undocumented framework we call SessionGate.
research.checkpoint.com/2026……
SAERXCIT retweeted
New Titanis release => github.com/trustedsec/Titani…
The new Dsrep lets you dump secrets from AD, Ldap supports queries for DNS records and timestamp conversions, Dcom supports dotted-property notation, along with other enhancements and fixes.
SAERXCIT retweeted
A Ligolo-ng JavaScript agent working inside Chrome/Edge by leveraging Isolated Web Applications
iwa.ligolo.ng/
github.com/nicocha30/ligolo-…
SAERXCIT retweeted
Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection.
github.com/CCob/DRSAT
SAERXCIT retweeted
Are one-way trusts really one way? @lowercase_drm sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets.
offsec.almond.consulting/tru…
SAERXCIT retweeted
I keep forgetting I build random projects here’s the first of three break.yxz.red/ browser breakout kit for testing on embedded systems to see if you can break out the browser.
SAERXCIT retweeted
I was looking a bit onto why OPENROWSET is able to read privileged files (like the root flag on Signed @hackthebox_eu) when using Silver tickets on MSSQL. Turns out you can get SYSTEM access without potatoes by recovering the full token. vuln.dev/silver-ticket-mssql…
SAERXCIT retweeted
Hi
I have finished the first part of my Spoopy Windows Sockets project. I'll continually work on it for because I'm (probably) mentally ill.
I have written code which can communicate with HTTPS hosts without using WININET, WINHTTP, or WINSOCKS. It works by communicating directly with the Windows AFD (Ancillary Function Driver for WinSock). This is extremely beneficial because WININET, WINHTTP, and WINSOCKS have Windows telemetry stuff in place, for detecting stuff, or whatever.
My favorite part of this project is that it also resolves DNS with AFD, so you can resolve DNS with SYSCALLS too.
Basically, you can do web stuff with raw SYSCALLS and nothing else (sort of). The HTTPS TLS verification stuff happens (mostly) in user-mode space, and attempting to recreate it programmatically would result in me having to basically recreate something like OpenSSL, but Windows specific. I'm not doing that.
You COULD do HTTPS stuff without verifying the TLS stuff, but that is probably a poor decision.
Anyway, I have stripped this code down to the bone. I have removed virtually all dependencies. All headers have been recreated from scratched so there is zero bloat. This project and/or proof-of-concept is entirely self-encapsulated.
To make it work all you need to do CTRL+C and CTRL+V into Visual Studio. That's it. Nothing else. I have made it as shrimple as possible.
It has two functions right now:
- EXAMPLE_HttpsSimpleGetRequestClose
- EXAMPLE_HttpsSimpleGetRequestKeepAlive
The names speak for themselves.
I have code in place which will allow file uploads, downloads, and (maybe) HTTPS authentication. Ideally Red Team nerds, or Blue Team nerds, can look at this, poke it with a stick, and do really cool stuff with it. I have made it as least-schizo as possible. I have removed the position independence and stuff.
This project is the result of research by x86matthew, Apple, Mārtiņš Možeiko, Mateusz Lewczak, Google Chrome nerds, ReactOS nerds, and some guy on UnknownCheats who writes like a caveman.
gist.github.com/vxundergroun…
Laurent Gaffié/lgandx 's (Responder/Pcredz) new twitter handle is @secorizon.
Worth a follow 🙂
xitter.cf/secorizon/status/20046…
SAERXCIT retweeted
[RELEASE] Part two is out! Callback chaining with tail calls and proxy frames to build semi-artificial call stacks and maybe annoy a few detection rules. Nothing ground breaking, but maybe somebody can pick up an idea or two.
Enjoy😉
klezvirus.github.io/posts/Ca…
SAERXCIT retweeted
[BLOG]
PICing AOP - a summary of the latest Crystal Palace commands for Aspect-Oriented Programming.
rastamouse.me/picing-aop/
Publishing github.com/SAERXCIT/LibTP_Ga…!
It's a generalisation of LibTPLoadLib to proxy APIs with an arbitrary number of args.
Provided as a Crystal Palace shared library. API made compatible with @_RastaMouse 's LibTP.
Hooks are provided to show off the newest Crystal Palace features
SAERXCIT retweeted
Great technical dive into callstack spoofing ! 🥖🥐
First blogpost in a while, check it out! PoC is a Crystal Palace shared library, format inspired by @_RastaMouse's LibTP
xitter.cf/AlmondOffSec/status/19…
SAERXCIT retweeted
Apple's sourcemaps takedown (@moeruri), Call stack sig bypass (@saerxcit), AD Site pwnage (@croco_byte), sneaky remap (@MagisterQuis), and more! blog.badsectorlabs.com/last-…
First blogpost in a while, check it out! PoC is a Crystal Palace shared library, format inspired by @_RastaMouse's LibTP
xitter.cf/AlmondOffSec/status/19…
Callstacks are largely used by the Elastic EDR to detect malicious activity. @SAERXCIT details a technique to evade a callstack-based detection and allow shellcode to load a network module without getting detected.
Post: offsec.almond.consulting/eva…
PoC: github.com/AlmondOffSec/LibT…



























