Opcode

Top 5 on HTB was a huge checkmark on my bucket list. We're so back!

Code is up

WDAC / AppLocker Bypass Recon Scripts gist.github.com/AlloySecureGro…

[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows? youtube.com/watch?v=tOVcSc…

The CVE brain your #AI agent has been missing 🧠 In our new blog, @__mez0__ introduces Vulnify, an open-source tool that stitches eight authoritative vulnerability databases into a single offline source of truth for #CVE intelligence. Read it now! hubs.la/Q04p1ZGv0

First post in the series: a quick explanation of the PreviousMode mitigation added in 23H2: windows-internals.com/random-windows…

@NotDeGhost Aren't KOTHs ideal for LLM usage? I agree with Active Directory for now, but it won't be for long

We think Jeopardy CTFs are dead, and are looking for new ideas: a new style of challenges that allows for a leaderboard indifferent to the presence of AI. As outlined in the blog, we think the AD and KOTH formats are a step in the right direction, although imperfect.

We're launching a $100,000 fund to save CTFs.

> be me > get dm > "is this malware?" > "windows defender went crazy when i tried this video game mod" > download > look inside > not malware There is a function in Windows you can invoke called "GetAsyncKeyState". In simplest terms, this function waits for user input on the keyboard. When a key is pressed down GetAsyncKeyState tells you what was pressed down. GetAsyncKeyState is used frequently with video games. Using this function video games can determine ... what you're pressing. Likewise, GetAsyncKeyState can be used by legitimate software for when a user does a shortcut or something. There is a lot of legitimate use cases for this function. However, GetAsyncKeyState is also abused because GetAsyncKeyState is tells you what key on the keyboard is pressed down, GetAsyncKeyState is used as a way to record what users are typing. Typically the data returned from GetAsyncKeyState is piped to a text file. Other times malware developers may use GetAsyncKeyState to store recorded key strokes in-memory and then send it out externally to a remote computer. Regardless, this video game mod was invoking GetAsyncKeyState and filtering each key press to determine when the mod was triggered. In essence, it was scanning and waiting to determine if it is toggled on or off. Furthermore, after the mod was toggled on or off, it logged when it was turned off for debugging purposes. From Windows Defenders perspective it saw an unsigned and unverified library being arbitrarily loaded into a video game and, once loaded, it was scanning user keys and subsequently writing something to a text file. After bonking this video game mod with a stick we know it's not malware. However, this is a great example of false-positives in anti-malware services because, by all means, this mod does seemingly mimic something a malware payload would do. But it's not malware. It's just a silly video game mod for Baldurs Gate 3

During an engagement, and in an effort to bypass Crowdstrike, I figured out a new method to locally privilege escalate when having code execution as a Microsoft Virtual account using only a LoLbin(certreq) and some AD-CS magic. I was successfully able to compromise the target with Crowdstrike present without needing to use potatoe class exploits. I wrote a blog about it here! abdulmhsblog.com/posts/iammachi…

Escalating from On-prem to Entra through MITM Attacks My colleague @0x64616e just published his latest research on lateral movement between on-premises Active Directory and Entra through DNS hijacking. Check it out: ➡️ securitylog.sva.de/2026/offsec/es…

Now that Canonical has fully patched CVE-2026-31694, we're sharing our code (along with a lil demo) for the FUSE LPE 🐧 Source @ github.com/BynarIO/pocs/t…

#RBCD attacks in Impacket have been extended across an arbitrary number of domains! 🚀 Discover how to impersonate arbitrary identities through complex #ActiveDirectory forest trusts, including SPN-less exploitation. 📚 synacktiv.com/en/publication… 🔨 github.com/synacktiv/impa…

> Peter Stokes > Scattered Spider guy > Arrested > Microsoft helps FBI > Read court documents > Page 12 > Microsoft tracks Stokes from GDID > Microsoft Global Device Identifier (GDID) > Stokes used Windows > Page 34 > GDID assigned to each OS install > GDID unique to each device > GDID only change if OS wiped > Stokes GDID 6755467234350028 > GDID reported internet activity to Microsoft > GDID showed Stokes using Ngrok > GDID reported Stokes IP address > GDID showed Stokes web activity > GDID showed timestamps of web activity > GDID mapped with video game activity > GDID showed games played > GDID undocumented > GDID only mentioned in one MSDN document > Azure UCDOStatus > Azure Monitor Logging

more phresh linux LPE sl0pday being dropped at github.com/sgkdev (736b380e28d0) w00t w00t

GPOHound v1.1.0 is out! 🎉 This release adds the "sysvol", "ldap", and "parse" modules, along with several bug fixes and improvements. For more details: github.com/cogiceo/GPOHou…

Wrote a new blog about caveats with tools detecting(or mis detecting) relay exploit primitives against http(ESC8) and MSSQL endpoints. Kept noticing issues in tools reporting the absence or presence of vulns that I thought others may have noticed too abdulmhsblog.com/posts/pitfalls…

AREA41 just published the recording from my pretty unusual talk: "Hacker Goes Speedrunning: Beating A 25 Hour Game In Under 2 Minutes" youtube.com/watch?v=OkL6RK… Enjoy!

New giveaway alert Our friends at @synthient wanted to giveaway some goodies for you nerds 2x Synthient Researcher Accounts - $40k 4x Claude Pro 1 Year Subscriptions - $400 6x Twitter Premium 1 Year Subscriptions - $600 If you want to enter this giveaway please do the following Like the post, Comment what you want and why, and follow both @synthient and @vxgiveaways Goodluck to all, picking winners next week

@vxgiveaways @synthient Claude for developing tools I've been procrastinating on 😄

Onelogon: Taking over Active Directory Accounts via Netlogon🔑 We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

The Squidbleed website is now live. A dedicated hub for CVE-2026-47729, technical breakdowns, vulnerability research, and future updates. Explore the story behind the 29-year-old bug. squidbleed.xyz A Calif Research Project. 🦑