bl4ck4rch

Security Researcher & Pentester at @orangecyberdef | CTF enthusiast | @hackthebox_eu MVP 2025

[bl4ck4rch @bl4ckarch]

@M4yFly Successfully Found my way up to Domain Admin
I made a walkthrough on how i did that here https://t.co/n2zgZcTNrs
Feel free to come and discuss about it 😉

[bl4ck4rch @bl4ckarch]

@_barbhack_ Le chall AD initialement prévu aussi en release ?

[cr3ghost @cr3ghost]

Whether you're writing implants, building EDR killers, abusing BYOVD, unhooking kernel callbacks, patching ETW, AMSI bypasses, LOLBins, or doing detection engineering, you need to know how the sensor actually works under the hood.

@0XDbgMan just dropped a full RE teardown of CrowdStrike Falcon's csagent.sys. Save this before it disappears.

If CrowdStrike Falcon is in your environment and you don't know how it works at the kernel level, you're operating blind on both sides of the engagement.

https://t.co/rqhDgni7tP

#Infosec #ReverseEngineering #MalwareAnalysis

[bl4ck4rch @bl4ckarch]

Anyone interested?

[0x12 Dark Development @Salsa12__]

Building out a small circle of experienced pentesters / red teamers for something I'm working on.

If you know someone solid (or that's you), tag them below or DM me directly

[BlackWasp @BlWasp_]

One month ago, I had the pleasure of participating in @sth4ck, and presenting a talk on synthetic stackframes, and how to use them in the context of EDR bypass.
Here is the replay ✌️: https://t.co/M6DF6fH0J2

[Ossama @0x3lk]

bl4ck4rch cooking 🧑‍🍳:)

[bl4ck4rch @bl4ckarch]

I was playing around AMSI and came up with some interesting bypass techniques.
6 techniques validated with a live reverse shell on a fully patched Windows 11, Defender on. https://t.co/q2Ro0wS7tx
#AMSI #RedTeam #WindowsSecurity #ReverseEngineering #Pentest

[Entrypoint @Entrypoint_fr]

We've been working on something for a while.

The talks your blue team doesn't want you to see.

🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation.

📍 Paris - Le Dernier Étage
📅 March 19–20, 2027

https://t.co/WcrpbyzSSV

CFP and additional details coming soon.

[bl4ck4rch @bl4ckarch]

@Yassineaboukir I experienced this whenever i allowed claude on auto mode, seems its more safeguarded nevertheless on normal usage i don't experience this

[Ossama @0x3lk]

Ugh !

[bl4ck4rch @bl4ckarch]

@opcode_osi Great achievement!!!

[bl4ck4rch @bl4ckarch]

@ShiinaaM @0xocdsec @M4yFly Providers in order of Less issues i found personally
🥇 LUDUS
🥈 Virtualbox
🥉 Vmware

Then the rest...

[bl4ck4rch @bl4ckarch]

@M4yFly Successfully found my way to DA, are we authorized to publish a walkthrough?

[bl4ck4rch @bl4ckarch]

@sekurlsa_pw I don't understand why this poc was released in the first place, so many distros ''up to date'' are still vulnerable to this CVE.
why did they not wait for the patch release?

[bl4ck4rch @bl4ckarch]

@CyberWarship Nice Repost Thanks !!!

[bl4ck4rch @bl4ckarch]

@OrangeCyberFR @Ludoc @orange Xxx

[bl4ck4rch @bl4ckarch]

NTLM relay might be dying on Windows Server 2025.
I dug into the root cause and did some reversed to see what changed.
Interesting timing: Decoder-It dropped similar findings the day before I published.
Full breakdown:
https://t.co/qLSgPjz4mP

#ActiveDirectory #NTLM

[bl4ck4rch @bl4ckarch]

@UK_Daniel_Card What tool is this man it seems amazing!

[Mayfly @M4yFly]

The answer is not simple ^^ a small thread 🧵
https://t.co/YG07M9ll7C

[bl4ck4rch @bl4ckarch]

@_RastaMouse Btw i was trying to buy the C2 development course in csharp but it was not longer available and i was asked to send an email, since i made the mail i received no answer till now, Can you help?