@splinter_code

offensive security - windows internals | BlueSky: https://xitter.cf/t.co/ytvJCoaF2c | Mastodon: https://xitter.cf/t.co/hNIHa6L14d

 Italy
splintercod3.blogspot.com/
Joined August 2016
  • Tweets1.8K
  • Following324
  • Followers9.3K
150Media
Antonio Cocomazzi retweeted
diversenok@diversenok_zeroMar 6
> A new Project Zero blog post by James Forshaw projectzero.google/2026/02/g… Me: Oh hey, I recognize this function! UIAccess + GetProcessHandleFromHwnd / NtUserGetWindowProcessHandle were the core of my CVE-2021-31951 EoP 😋 So some fixes leading to v3 actually date a bit earlier

A Deep Dive into the GetProcessHandleFromHwnd API

In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t k...

projectzero.google
1
11
76
4,347
Antonio Cocomazzi retweeted
Insomni'hack@1ns0mn1h4ckFeb 27
Replying to @decoder_it
@decoder_it breaks down reflection attacks and their impact on enterprise security in this new talk at #INSO26. Are you interested in how modern authentication flow works? So this talk is for you! Save your spot: ow.ly/cCr450Ykak4 #Infosec #INSO26 #CyberConference
4
6
1,239
Antonio Cocomazzi retweeted
Andrea P@decoder_itFeb 25
Just dropped a short post on why some classic NTLM relay tricks seems to be dead on Server 2025. decoder.cloud/2026/02/25/wha…

What Windows Server 2025 Quietly Did to Your NTLM Relay

TL;DR This post is super short, nevertheless: The classic cross-DC coerce + relay to LDAPS technique, abusing a misconfigured LmCompatibilityLevel (0/1/2) to generate NTLMv1 + ESS and strip the MIC…

decoder.cloud
2
64
3
198
14,091
Antonio Cocomazzi retweeted
Andrea P@decoder_it24 Nov 2025
Just published a summary of "modern" Windows authentication reflection attacks. Turns out reflection never really died. 😅decoder.cloud/2025/11/24/ref…
3
79
1
229
20,776
Antonio Cocomazzi retweeted
Andrea P@decoder_it29 Oct 2025
Blog post about my recent CVE-2025-58726, aka “The Ghost Reflection” is out, read it here: semperis.com/blog/exploiting… 🙃

Exploiting Ghost SPNs and Kerberos Reflection for SMB Privilege Elevation

Understanding how attackers use Ghost Service Principal Names to initiate authentication reflection can help you avoid similar vulnerabilities.

semperis.com
3
88
179
16,850
Antonio Cocomazzi retweeted
Andrea P@decoder_it24 Oct 2025
Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in NTLM local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅
5
63
1
222
18,763
Antonio Cocomazzi retweeted
Andrea P@decoder_it21 Oct 2025
my simple poc: github.com/decoder-it/printe…
11
30
3,407
Antonio Cocomazzi retweeted
Andrea P@decoder_it21 Oct 2025
Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used. Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.
4
81
1
277
19,188
Antonio Cocomazzi retweeted
diversenok@diversenok_zero25 Mar 2025
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
2
21
1
115
12,496
Antonio Cocomazzi retweeted
Andrea P@decoder_it8 Sep 2025
In my long history of submissions, I think this is the first time one has been marked as critical😅
3
1
82
6,339
Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-conferenc… #infosec #securityconference – at Rome, Lazio
Romhack2025 agenda

ALT Romhack2025 agenda

11
3
34
11,146
Antonio Cocomazzi retweeted
Andrea P@decoder_it24 Apr 2025
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

From NTLM relay to Kerberos relay: Everything you need to know

While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

decoder.cloud
2
149
2
349
19,769
Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9

Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security Blog

Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows...

microsoft.com
9
114
14
296
71,522
Antonio Cocomazzi retweeted
Elad Shamir@elad_shamir9 Apr 2025
NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs. Read my detailed post - the most comprehensive guide on NTLM relay & the new edges: ghst.ly/4lv3E31
6
110
2
256
21,627
Antonio Cocomazzi retweeted
Boris Larin@oct0xor25 Mar 2025
We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-for…

Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain

Kaspersky GReAT experts discovered a complex APT attack on Russian organizations dubbed Operation ForumTroll, which exploits zero-day vulnerabilities in Google Chrome.

securelist.com
9
94
8
279
37,776
Antonio Cocomazzi retweeted
Raffaele Sabato@syrion8925 Mar 2025
Check out our new blog post!
SentinelOne
@SentinelOne25 Mar 2025
🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 📄 This new research from SentinelOne exposes how these new variants are spreading and how you can protect your organization. Stay informed. Stay secure. Dive into the research: s1.ai/readup
1
5
12
1,662
Antonio Cocomazzi retweeted
Samir@SBousseaden25 Mar 2025
new #elastic defend rules out : - PPL bypass via ComDotNetExploit - Execution via Windows-Run (trending delivery method ITW) github.com/elastic/protectio…
1
22
1
93
7,303
Antonio Cocomazzi retweeted
Andrea P@decoder_it26 Mar 2025
Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code 😂🤣
5
37
181
10,482
Antonio Cocomazzi retweeted
Andrea P@decoder_it13 Mar 2025
KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/KrbRel…
6
157
1
383
23,242
Antonio Cocomazzi retweeted
Samir@SBousseaden3 Mar 2025
Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.
T3nb3w@T3nb3w2 Mar 2025
🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/r… 💻 Code: github.com/T3nb3w/ComDotNetE…

Abusing IDispatch for Trapped COM Object Access & Injecting into PPL Processes | Red Teaming's Dojo

mohamed-fakroud.gitbook.io
2
35
160
14,980
Load more