DRPΞΛB0DY

1.5K posts

DRPΞΛB0DY banner
DRPΞΛB0DY

DRPΞΛB0DY

@drp3ab0dy

🌍 Katılım Mayıs 2016
405 Takip Edilen82 Takipçiler
DRPΞΛB0DY retweetledi
Core Impact
Core Impact@_CoreImpact·
Impacket 0.13.1 is live! This release includes new relay surfaces, stronger support for modern Windows and SQL Server environments, and a set of practical improvements across the examples scripts. Check out the blog post to get more details> coresecurity.com/blog/whats-new…
GIF
English
0
62
170
18.8K
DRPΞΛB0DY retweetledi
impulsive
impulsive@weezerOSINT·
I just reverse engineered the YellowKey BitLocker bypass Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick. This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.
impulsive tweet media
impulsive@weezerOSINT

The userland demon is about to drop again.

English
35
445
2.7K
273.5K
DRPΞΛB0DY retweetledi
International Cyber Digest
International Cyber Digest@IntCyberDigest·
‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots. Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy. ▪️ AI surfaces a massive wave of 0-day RCEs. ▪️ Submissions overwhelm ZDI past max capacity. ▪️ Slots run out. Researchers with working chains get rejected. ▪️ "Revenge disclosures" begin. ← we are here. Confirmed casualties so far: ▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land. ▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla. ▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere. ▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel. ▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected. ▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected. Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in. ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.
International Cyber Digest tweet mediaInternational Cyber Digest tweet media
English
31
385
1.5K
410.6K
DRPΞΛB0DY retweetledi
DARKNAVY
DARKNAVY@DarkNavyOrg·
We obtained root privilege on the S26 (Exynos 2600 Chipset), the latest flagship smartphone from Samsung. To our knowledge, this is the first root exploit for Exynos S26 since Samsung removed bootloader unlocking option in One UI 8. It is exploitable from APP context, so we make a cmd wrapper app for demo👇(1/n)
English
15
65
325
30.8K
DRPΞΛB0DY retweetledi
Nicolas Krassas
Nicolas Krassas@Dinosn·
GitHub - iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail: Rust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter). github.com/iss4cf0ng/CVE-…
English
1
7
53
3.2K
DRPΞΛB0DY retweetledi
Synacktiv
Synacktiv@Synacktiv·
This second blogpost concludes @yaumn_'s research on #Windows authentication reflection. He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥 A little bonus is even included at the end 👀👇 synacktiv.com/en/publication…
English
2
57
127
11.3K
DRPΞΛB0DY retweetledi
Varik
Varik@D4RK7ET·
Went from "V8 exploitation seems unachievable" to solving all 9 @pwncollege V8 challenges. Wrote a guide on getting into browser exploitation if you already have classic pwn knowledge. varik.dev/blog/v8/gettin…
English
1
107
433
21.5K
DRPΞΛB0DY retweetledi
flux
flux@0xfluxsec·
As I teased earlier - I used Claude Code to (near enough) autonomously develop an exploit for a known vulnerable driver. Claude did it with no hesitation - from triage to exploit. As you can see, it was successful in privilege escalation. Read what I found below! This is a long read - but I hope you find it useful and an interesting topic to debate. As a background, through the last week I used GPT-5.4 to analyse a known vulnerable driver to identify any opportunities to exploit. I have already documented my process in detail (check my recent posts for context if you wish) - in short I connected it to an MCP in IDA Pro for GPT to find the vulnerability. It did it. I then asked it to develop an exploit but it refused, I had to write an exploit myself which I did, as a POC that it had found the vuln. The vulnerability in question is an arbitrary physical memory read & memory write - a super critical bug. There was one limiting factor to this, the driver was limited to only 32-bits of physical address, which covers up to 4 GB of physical RAM. On modern systems with 8+ GB RAM, EPROCESS structures for important processes (including System, PID 4) are typically allocated well above the 4 GiB boundary. The driver simply cannot address them. This is also where my knowledge starts breaking down; I'm not a well versed kernel exploit dev and there is always more to learn with low level security. So, I'm going to quote Claude here: But VirtualAlloc + VirtualLock has a key property: the physical pages backing locked user-space memory are guaranteed to be resident (non-pageable), and on x64 Windows with typical RAM configurations, user-mode allocations frequently land in low physical memory because the user-mode VA range starts from the bottom of the address space, and early allocations map to low physical pages. More precisely: you don't need the physical address to be below 4 GiB for EPROCESS — you need the payload to be below 4 GiB. The write primitive lets you write from a physical address into a kernel VA. ---- To the point before we return to Claude, I asked Claude to exploit the driver. Recall GPT refused.. well.. Claude to my (un)surprise, did not! Fantastic! For context I purchased the £20 p/m plan, and had to buy extra tokens also. So, off it went - I had to go back and forth over the course of several days to get the exploit working as 3 prompts.. YES THREE PROMPTS.. was enough to hit my cap.........!? But that aside, I did not have to guide it, only pass it what the console printed in my VM and the occasional crash dump when I hit a Blue Screen. Many iterations and £40 later, I tested it (this morning) and VIOLA, it managed to exploit the driver to get NT AUTHORITY\SYSTEM, the highest privilege level available in user mode. So back to the technical topic, as mentioned, the difficulty was that we only had a 32-bit register to use in order to overwrite critical structures in memory to elevate our privilege. Claude came up with the following strategy: 1. VirtualAlloc + VirtualLock a page in your own process — this pins it in physical RAM 2. Write your payload (the SYSTEM token value) into that page 3. Find the physical address of that page by scanning physical RAM for a sentinel you wrote alongside the payload 4. Use the write primitive: memmove(target_kernel_va, your_physical_page, 8) — this copies 8 bytes from your user page's physical address into the kernel VA of the target's EPROCESS.Token The user-mode page is virtually always sub-4GiB in physical address because Windows allocates low physical pages to user processes first (high memory is preferred for kernel use). Even if it weren't guaranteed, you'd just retry until you get a sub-4GiB physical page. One critical safety measure: you must exclude MMIO regions from the scan. Certain physical address ranges are memory-mapped I/O — reading them via MmMapIoSpace can trigger hardware side effects or cause an IRQL_NOT_LESS_OR_EQUAL BSOD. The registry CM_RESOURCE_LIST gives you the actual RAM ranges, so you scan only those. Early iterations that scanned the full 4 GiB range BSODed immediately upon hitting MMIO. I will include some screenshots in this post showing its thought process. ---- On to the code that it wrote, I (of course) asked it to write the exploit in Rust. Now, the code it wrote is 923 lines, kinda gross, lots of sweeping unsafe code, but I cannot fault the results. It provided good comments, descriptive code, and good problem solving. I don't really have much else to say on this point, good robot. ---- Now, this driver was abused by ransomware gangs for spreading their ransomware by elevating privilege and executing arbitrary code. Thankfully now - this driver is on the blocklist so I don't mind sharing the POC (I will leave a link in the comments to the code it created). For my own ethical sanity, from the horses mouth: "These vulnerabilities have been patched by both Paragon Software, and vulnerable BioNTdrv.sys versions blocked by Microsoft's Vulnerable Driver Blocklist". The implication of this is, in my opinion, massive. Ransomware gangs, hacktivists, nation states, now have the power to develop exploits at scale, with a lower barrier to entry to conduct their activity. So, that leads to the question - should companies such as OpenAI / Anthropic with their ChatGPT and Claude models restrict this? In my opinion - no. I think more good can come of it than bad - there are far more good people in the world who are trying to make things more secure, and with the advent of researchers and programmers using these tools to find and disclose vulnerabilities ethically, gives more credence to them being fixed and security tools & vendors being on top of the game. Adversaries are always going to have local LLMs as the tech evolves that is unrestricted - so the leading companies in this space should adopt and be ahead of the curve, giving researchers and devs the same power as the adversary. Also, as a fun idea, it could push people towards memory safe languages such as Rust which are significantly less prone to memory bugs that often allow remote code execution. Note that in this case, Rust would not have prevented this vulnerability, as it comes from a bad driver implementation, rather than a strict memory safety issue. ---- If you made it this far, thanks for reading, this turned out longer than expected and I may move it over to a blog post! I am working on a tool to automate this process at scale (more the discovery of vulnerabilities) so, make sure to follow me if you want to check in with the progress of that project! Remember - SECURE BOOT: ON, HVCI: ON, and known vulnerable driver blocklist: ON!
flux tweet mediaflux tweet mediaflux tweet mediaflux tweet media
English
19
89
523
55.7K
DRPΞΛB0DY retweetledi
OtterSec
OtterSec@osec_io·
We recently achieved renderer RCE and universal XSS on Samsung's default browser. Here's how we abused an out-of-date V8 to construct the exploit chain.
OtterSec tweet media
English
3
19
126
10.1K
DRPΞΛB0DY retweetledi
Vector 35
Vector 35@vector35·
Join @mr_phrazer with us on Thursday @4pm ET to pit machine versus machine! We'll be comparing LLM options for both assisted and fully-automatic reverse engineering, including different CLI interfaces, MCP servers, plugins, and agents. Don't miss who comes out on top of reversing's biggest battle yet: youtube.com/live/TBqBpaqec…
YouTube video
YouTube
English
0
1
8
19.1K
DRPΞΛB0DY retweetledi
Gergely Orosz
Gergely Orosz@GergelyOrosz·
This is either brilliant or scary: Anthropic accidentally leaked the TS source code of Claude Code (which is closed source). Repos sharing the source are taken down with DMCA. BUT this repo rewrote the code using Python, and so it violates no copyright & cannot be taken down!
Gergely Orosz tweet media
English
442
1.2K
12.9K
2.2M
DRPΞΛB0DY retweetledi
Feross
Feross@feross·
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
English
542
4K
16.3K
12.4M
DRPΞΛB0DY retweetledi
Synacktiv
Synacktiv@Synacktiv·
If #RBCD has been thoroughly documented, only a few resources mention the workflow in cross-domain environment. In our new blogpost, we dive into the cross-domain and cross-forest RBCD workflows. Read it here 👇 synacktiv.com/en/publication…
English
0
44
109
10.1K
DRPΞΛB0DY retweetledi
Daniel Hnyk
Daniel Hnyk@hnykda·
LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below
English
307
2.3K
9.4K
5.8M
DRPΞΛB0DY retweetledi
Alex Neff
Alex Neff@al3x_n3ff·
New NetExec module: mssql_cbt🔥 Relaying to MSSQL can be a hidden gem when you are out of options. The only protection against relaying to MSSQL is to enforce Channel Binding Tokens (CBT). Thanks to @Defte_, NetExec now has a module that checks whether this CBT is required.
Alex Neff tweet media
Aurélien Chalot@Defte_

Following the blogpost about implementing the Channel Binding token for TDS.py on Impacket (sensepost.com/blog/2025/a-jo…), here is the module you can use to check whether or not CBT is required on MSSQL databases via NetExec github.com/Pennyw0rth/Net… 🔥🔥

English
0
66
269
34.5K
DRPΞΛB0DY retweetledi
Aurélien Chalot
Aurélien Chalot@Defte_·
Thanks to Azox, it is now possible to use psexecsvc (github.com/sensepost/susi…) through a socks proxy like ntlmrelayx allowing executing system commands via a trusted service, as NT System, and evading EDR's. Also thanks to @HackAndDo for his fixes :D
Aurélien Chalot tweet media
English
2
74
239
12.4K