Пастухов Алексей
28 posts
@vkrajacic Absolutly, С n program management, especially memory, it is like a blade. In inexperienced hands, it's dangerous; in experienced - it's a local tactical weapon
English
I still use C and manual memory management. Not because it's fun (although it is, especially while learning), but because it's faster.
Writing assembly is probably reserved for hardcore optimizers, but reading assembly is still a valuable skill that every programmer can benefit from.
Antonio Sarosi@antoniosarosi
Before C, someone writing assembly would say "hand-writing" assembly is fun. Before Java someone would say manually allocating memory in C is fun. Just accept that coding has been abstracted and it will not come back, the minimum building block now is architecture components.
English
@Sarthak4Alpha 1.printf() must return int-value, missing validation;
2. missing "\n" as C11's standart requires;
3. declaration of " int main(){return 0;} " is permitted but not entirely correct from an ideological standpoint.
English
Auditing LDAP Queries for Active Directory Enumeration filippwn.github.io/blog/2026/07/a…
Français
@sekurlsa_pw Absolutly passive AD audit tool github.com/ssteelfactor-o…
English
Quick 'n dirty BloodHound ecosystem overview. The different ingestors, collectors, analysis tools.
There might be things missing.
gist.github.com/gitgotgitgotit…
English
@ChaoticEclipse0 They're just cowards, we're proud of you, bro
English
I spent countless nights thinking about it, I did everything to make you happy, what did I do to deserve such cruelty ?
Microsoft Security Response Center@msftsecresponse
Today, we're proud to recognize the Top 100 Microsoft 2026 Most Valuable Researchers (MVRs). Security researchers play a critical role in helping protect customers by identifying and reporting vulnerabilities across Microsoft products and services. We're grateful for their partnership and the impact they have made over the past year. Congratulations to this year's Top 10 MVRs: 🥇C46F3708A45EF0041BD0A49DDAEA0E25 🥈ShinHyuiq & Alan Pang 🥉cherrypick 4. Brad Schlintz (@nmdhkr) 5. wtm (@wtm_offensi) 6. Asaf Cohen (XBREACH.AI) 7. bccc95a61a3cc79d7b2c4423c808f744 8. Felix B. 9. 142a423e2574abf10d65eba46891ca5e 9. Anonymous This year, we updated the MVR leaderboard to rank researchers based on total bounty awards, creating a clearer connection between recognition and security impact. We also introduced Special Mentions to recognize researchers who submitted valid vulnerability reports during the recognition period, regardless of leaderboard ranking. See our blog for the complete list of the Top 100 MSRC 2026 Most Valuable Researchers and the top researchers by bounty program: microsoft.com/en-us/msrc/blo… Thank you to every researcher who partnered with us this year to help protect customers worldwide.
English
BOF for lateral movement using MSI ODBC Driver installation.
A tool by Craig Wright (@werdhaihai)
Source: github.com/werdhaihai/msi…
#redteam #blueteam
English
Nice, but. "Hygiene" findings are underrated, the issues that never become an attack path but still rot the foundation. What gets me sad: the whole conversation lives at the graph layer : what BloodHound can and can't see. Almost nobody looks one level down, at the raw directory, it id very disappointed, the security descriptors, the ACE masks, the foreign SIDs sitting in the delegation attribute. That's the floor where hygiene actually lives, and you only see it if you read it directly.
English
We're back w/ another #BloodHoundBasics from Jacob Jackson! ⤵️
One of my favorite parts of BloodHound Enterprise is the Hygiene findings.
Not every security issue shows up as an attack path but that doesn't make it any less important.
🧵: 1/3
English
Nice work, SoaPy transport's clean. But the stealth's in the ADWS protocol, not the tool, run remotely it still lands in Event 1644 + 9389 Sysmon hit. github.com/ssteelfactor-o… the broader, opposite bet: not a layer over ADWS/SoaPy but native Windows internals directly, read-only, detectable by design.
English
🔴 Another tool about enumeration via Active Directory Web Services just dropped:
🛠️ github.com/JosuPalacios99…
🟣 Purple Team Playbook and Detection Strategy:
🖊️ ipurple.team/2025/08/12/act…
English
ETAC it's cool but it's basically just hiding parts of one big shared graph from people who shouldn't see them. The thing I like about my project Kestrel is you skip all that -one small read-only tool, normal user, one environment, one local file etc. Nobody's to lock anything down after, because you only ever see what you could already see. You lose the big cross-environment picture, but you get a way simpler setup
English
In today’s #BloodHoundBasics from Carlo Alcantara, we cover Environment Targeted Access Control (ETAC) for Enterprise users. Read-Only & User roles now support environment-based visibility via the “Manage Users” page.
Simply select which environments each user can access.
1/2
English
Your WinForms/WPF app deadlocks on .Result. "Async all the way," sure, but WHY? The cause isn't in your code: your .NET UI thread IS a COM SingleThreadedAppartment. I traced the hang in Ghidra down to PeekMessageW + DispatchMessageW in combase - a 30yr-old OLE pump.
github.com/ssteelfactor-o…
#ReverseEngineering #COM
English
Have been digging into two of COM’s most obscure mechanisms: the Running Object Table (ROT) and the Global Interface Table (GIT).
Not from the usual API surface, but from the inside: object layout, memory patterns, allocator footprints, and how Windows actually keeps these pieces alive.
If you work with low-level Windows internals, COM, reverse engineering, or debugging strange cross-apartment behavior, this may be interesting.
Notes and articles: ssteelfactor-oss.github.io
#WindowsInternals #COM #ReverseEngineering #MalwareAnalysis #Debugging #WinAPI #LowLevel #WindowsDev
English
SAL 2.0 annotations on every function. PREfast validates contracts at compile time. Single rootDSE resolution, ain't redundant DC round-trips.
Source: github.com/ssteelfactor-o… Parent project: github.com/ssteelfactor-o…
v0.4 (in-memory graph) + v0.5 (BFS path finder) coming next.
#WindowsSecurity #ActiveDirectory #RedTeam #Kestrel
English
Groups resolved by RID, not by name.
Domain Admins = DomainSID + 512. Works on EN/RU/DE/any language domain.
No hardcoded "Domain Admins" string. No locale dependency. This is how BloodHound does it. Took a while to figure out.
#WindowsSecurity #RedTeam #Kestrel
English
Kestrel v0.1-v0.3:
→ ADWS endpoint detection (port 9389/TCP per DC) → Computer topology via SPN decoding → Delegation risks: unconstrained / constrained / S4U2Self → LAPS coverage (legacy + Windows LAPS 2023+) → Stale computers via lastLogonTimestamp → ACL edge extraction via IDirectoryObject → Transitive group membership via LDAP_MATCHING_RULE_IN_CHAIN
All passive. All read-only. Zero packets to target hosts.
#WindowsSecurity #RedTeam #Kestrel #COM
English
Direct COM vtable calls in C:
IDirectorySearch *pSearch = 0; ADsGetObject(path, &IID_IDirectorySearch, &pSearch); pSearch->lpVtbl->ExecuteSearch(pSearch, filter, attrs, n, &h);
From the wire: authenticated LDAP bind + paged search. Exactly what every domain workstation produces.
#WindowsSecurity #C #BloodHound
English