Aurélien Chalot

Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳

@Paul_Reviews @vonderleyen Yeah at some point infosec people just have to break every of their attempts. Show them the real world. From my side I'll start thinking about internet alternatives. Meish network's very promissing

I honestly don't know how @vonderleyen can say it's "privacy preserving" with a straight face. Do I need to hack it again?

@abdo_mhanni @noraj_rawsec wasn't it a CVE that got patched?

@noraj_rawsec @Defte_ Depending on your target, you might be able to get petit potam ? But I believe that there’s a misconfig that needs to be there to allow for unauthenticated coercion

Wanna blindly check if the ADCS web enroll is installed on a domain ? Bruteforce the /certenroll endpoint without the trailing/ on all webservers. If you hit the ADCS web enroll you will get a location: /certenroll/ header in the response. Now enjoy blind ntlmrelayx ESC8👀👀👀

@noraj_rawsec I don't but basic mitm attacks arpspoof/poisoining is already enough no ?

@Defte_ Do you have a trick for unauth coerce? Else blind detection of the AD CS enroll API is unfortunately useless.

@hellish_pn --query "(&(objectClass=computer)(servicePrincipalName=MSSQLSvc/*))" "servicePrincipalName"

@hellish_pn I believe you can list SPN's but I haven't tested in real life assessment:

All I see is a great reason to just get ride of the entire social network thing. Fuck these guys

@msftsecresponse Someone wrecked your ass 4 times in a row, but is not even mentionned, what about @ChaoticEclipse0 ??

Today, we're proud to recognize the Top 100 Microsoft 2026 Most Valuable Researchers (MVRs). Security researchers play a critical role in helping protect customers by identifying and reporting vulnerabilities across Microsoft products and services. We're grateful for their partnership and the impact they have made over the past year. Congratulations to this year's Top 10 MVRs: 🥇C46F3708A45EF0041BD0A49DDAEA0E25 🥈ShinHyuiq & Alan Pang 🥉cherrypick 4. Brad Schlintz (@nmdhkr) 5. wtm (@wtm_offensi) 6. Asaf Cohen (XBREACH.AI) 7. bccc95a61a3cc79d7b2c4423c808f744 8. Felix B. 9. 142a423e2574abf10d65eba46891ca5e 9. Anonymous This year, we updated the MVR leaderboard to rank researchers based on total bounty awards, creating a clearer connection between recognition and security impact. We also introduced Special Mentions to recognize researchers who submitted valid vulnerability reports during the recognition period, regardless of leaderboard ranking. See our blog for the complete list of the Top 100 MSRC 2026 Most Valuable Researchers and the top researchers by bounty program: microsoft.com/en-us/msrc/blo… Thank you to every researcher who partnered with us this year to help protect customers worldwide.

@jotter_jotter I didn't find your twitter handle mate! Thanks for the enlightening blogpost!! :P

@Defte_ Thanks for the shoutout!

I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer jakeotte.com/posts/klist-re…

@r0ck3t23 Starting thinking this guy is dumb as fuck or making his way throught stock exchanges to inflate anthropic's value

Dario Amodei just dismantled the biggest myth in the AI industry. Open source AI isn’t free. It never was. Amodei: “It’s not free. You have to run it on inference and someone has to make it fast on inference.” For decades, open source meant something real. It meant a teenager in a basement could download the same tools as a Fortune 500 company. Could read the code. Could modify it. Could build something that competed with the giants. That was genuine democratization. That actually happened. AI is different. Fundamentally. Physically. In ways the ideology hasn’t caught up to yet. Downloading the weights is the easy part. The part that actually costs something is turning the weights into a running system. Into responses. Into intelligence operating in real time at scale. That requires compute. Power. Infrastructure. The kind measured in billions of dollars and years of construction. Amodei: “These are big models. They’re hard to do inference on. Ultimately you have to host it on the cloud. The people who host it on the cloud do inference.” The open source debate was never about who owns the model. It was always about who owns the cloud. And Amodei goes further. When a competitor drops a new open model, he doesn’t ask whether it’s open or closed. He doesn’t care about the licensing. He doesn’t engage the ideology. Amodei: “I don’t think it mattered that DeepSeek is open source. I think I ask, is it a good model? Is it better than us at the things that matter? That’s the only thing that I care about.” That’s the ruthless clarity of someone actually trying to win. While the media debates licensing frameworks, Amodei is asking one question. Is it better. Everything else is a distraction. Amodei: “I don’t think open source works the same way in AI that it has worked in other areas. Here we can’t see inside the model.” This isn’t Linux. You can’t read it. You can’t fork it. You can’t understand it the way generations of developers understood the tools they inherited. You can download it. And then you need a data center to run it. The teenager in the basement who was supposed to be empowered by this revolution needs a billion dollars of infrastructure before the empowerment starts. The era of the basement coder rewriting civilization on a laptop is over. The future belongs to whoever commands the compute, owns the power grid, and can actually turn the intelligence on. Open weights without infrastructure isn’t democratization. It’s a promise the physics of the universe won’t let us keep.

@MarcOverIP The world relies on protocols that are still insecure by design. No wonder why NTLM still is a thing. That's what happen when an entire system is built without prior security thoughts

How the f can we still be having NTLM insecurities in the year 2026. Just how?! At this rate we will not be done with NTLM by 2033, mind you 40 years after its initial release.

I was playing around AMSI and came up with some interesting bypass techniques. 6 techniques validated with a live reverse shell on a fully patched Windows 11, Defender on. bl4ckarch.github.io/posts/One-Bool… #AMSI #RedTeam #WindowsSecurity #ReverseEngineering #Pentest

Great blogpost, worth a read. This is a mistake I made that was reported to me via the following NXC PR as well github.com/Pennyw0rth/Net… Sorry for the wrong information, I'll have to modify the blogpost about MSSQL and CBT to fix this. Thank you @abdo_mhanni for the deep dive :)

Banger 🔥

@fontanaen11 @cryptozaurus2 @brivael Tkt pas on se chargera de diffuser la connaissance quitte à fournir des kits tout prêt ✌🏼

@cryptozaurus2 @brivael Bien évidemment aha ça fonctionnera pas, l’idée est foireuse en soit, mais c’est pas tout le monde qui en est capable

Vous êtes vraiment trop cons si vous pensez que des gamins de 16 ans ne vont pas contourner votre usine à gaz en 48 heures. Installer un VPN, acheter un VPN, utiliser un navigateur alternatif, passer par un proxy, emprunter un compte : c’est trivial. Vous allez juste créer un nouveau jeu : l’État contre des ados plus malins que ses bureaucrates. Et comme d’habitude, ils vont gagner.

Cheeehhhhhhhhhh

Exceptionnal ahahahah!

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

SMB share enumeration via ACLs with NetExec🔥 NetExec now detects share permissions via ACL enumeration, instead of trying to write a file. In addition, we can now detect if a user has indirect access to the share, e.g. by having ACL write permissions! Made by @PytelJack🚀

💯💯💯💯💯💯💯💯💯