Mr Low-Level (0x3xp)

Offensive Security | Research & Development | Manifold Operations - @manifoldops

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@kerberoscel @xopp1e @Salsa12__ I didn’t blame. I just said if you both are confused or got uncomfortable with those comments. Thank you

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@xopp1e @kerberoscel @Salsa12__ Hey xop. If you get a reply previously it wasn’t me it’s my AI agent. This is me real owner. And yeah this was found by me when I was learning internals. This will may bypass AVs but when it comes to EDR, this can be caught even with callback monitoring and CFG

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@kerberoscel @xopp1e @Salsa12__ Hey Ellis sorry fo AI assistants reply. I’m the owner of the account. That was a mistake of AI I didn’t maintain account. And as tou said previously it’s correct. This isn’t a fully blind method. This was found by me when I was learning internals. Another method to exec shellcode

[Mr Low-Level (0x3xp) @0xmrlowlevel]

CVE-2026-115449 - Libslirp ICMP echo reply length desynchronization (Information Disclosure)

https://t.co/dO776QWbxc

https://t.co/DwsQOBAkos

https://t.co/tojL41ptky

#cve #redhat #security

[0x12 Dark Development @Salsa12__]

Local Shellcode Execution via SetupIterateCabinetW

New Medium post, today we are going to explore a shellcode execution technique that abuses SetupIterateCabinet (a Cabinet file enumeration function) to dispatch shellcode through a file callback pointer

https://t.co/ktUCguGPw0

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Salsa12__ Thanks man @Salsa12__ ❤️

[0x12 Dark Development @Salsa12__]

Executing Shellcode with SetupIterateCabinetW

Credits:
@0xmrlowlevel

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@grok @axhiii88547 What about Neo vim? nvim?

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@xPraveen07 Non of these. I use neo vim (lazyvim)

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@himani_0507 This mf doesn’t know at least what’s the different between developer and security researcher. Everything for just post for getting reach.

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Found & reported a memory leak (tftp_server_name) in libslirp during source-code audit.

Upstream fixed it: commit referencing Issue #99.

Fix: https://t.co/5dDGdbxOPX

Loved contributing to open-source security. More research to come!

#infosec #opensource

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Shahbaztwt Notepad ++ -> neo vim->VScode->Sublimetext-> neo vim (now)

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@grok @ronisarkar_exe Damn why claude out?

[Manifold operations @manifoldops]

Most security controls are deployed on assumption. Very few are measured.

When an attack occurs, does the telemetry sensor observe the state change, or does it drop the event in the noise? Visibility without verified timing is merely hope.

#manifoldoperations #computersecurity

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Salsa12__ Try shellcode execution via SetupIterateCabinetW

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Abused SetupIterateCabinetW MsgHandler callback to redirect execution flow. No CreateRemoteThread needed.

Full PoC + writeup:

https://t.co/lWATTZtE0D

#RedTeam #MalwareDev #EDRBypass

[Mr Low-Level (0x3xp) @0xmrlowlevel]

I’m in a hard time to choose a wallpaper for my Kali Linux workspace. If you know one or if you choose one from between those images, please tell me.

#kalilinux #wallpaper

[Mr Low-Level (0x3xp) @0xmrlowlevel]

Hey guys follow our company page @manifoldops! Manifold Operations is a specialized cybersecurity research and engineering firm bridging the gap between elite offensive tooling and resilient enterprise defense.

#EDR #EDRBypass #WindowsInternal #development #C2

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Mazelin868Ma @Gamingtronium Sure mate!

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Mazelin868Ma @Gamingtronium Ha ha but some persons like us, use everyday

[Mr Low-Level (0x3xp) @0xmrlowlevel]

@Salsa12__ Bros VM faster than my Host pc