𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡

Global Security Team

[Petr Beneš @PetrBenes]

Ever wanted to draw a triangle with OpenGL as a 2kb position-independent shellcode? No? Me neither.

But you can do it anyway: https://t.co/qCd88gK0GR

[𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡 @CT_Hellcat]

@GigelV41464 Doesn't seem to be anything new

[𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡 @CT_Hellcat]

@_gcali @_ringzer0 online？

[Giuseppe Calì @_gcali]

If you like VPN exploits as much as us, you're going to love this course Zeroshi is bringing to @_ringzer0!

Marco will walk students into opening up edge devices for research, mapping their attack surface, finding vulns and building full exploit chains.

https://t.co/nYihjiqSls

[Connor McGarr @33y0re]

[New @originhq blog+POC]

No PPL? No problem!

SecurityTrace, an undocumented ETW feature, restricts some AutoLogger traces to PPL only — yet we found this current design still allows non-PPL processes to consume from Threat-Intelligence as admin only!

https://t.co/iZyILtbJx8

[𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡 @CT_Hellcat]

@C2IRIS The price of cobaltstrike for one year has reached 5900 USD

[David @dmcxblue]

A short weekend read for anyone interested in the ANIMO (Azure Network Intel & Mission Ops) tool I've been working on throughout 2025. It documents a red team scenario with its capabilities and future development plans. If you'd like to send suggestions, phishing links or donations my DMs are open.
#redteam
https://t.co/lOkLyAYEN6

[db @whokilleddb]

New fav persistence method which works on Win11 25H2: Set the default key's value of HKCU\Software\Classes\CLSID\{18907f3b-9afb-4f87-b764-f9a4e16a21b8}\InprocServer32 to point to a malicious DLL and get shells from multiple programs even before a user logs in.

[S3cur3Th1sSh1t @ShitSecure]

Another Pentest, another time the NetExec Veeam module didn't work properly. Sometimes SYSTEM impersonation is needed, sometimes it's flagged by AMSI. You need to know about alternatives. SharpVeeamDecryptor now supports v12 and PostgreSQL Veeam instances 😎

https://t.co/doacobREsm

[𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡 @CT_Hellcat]

@elonmuskTN 11

[Arris Huijgen @bitsadmin]

Because the last release of #NoPowerShell was 2 years ago and to celebrate the repo has 999 stars, I just merged DEV ➡️ MASTER and published Release 1.50 containing over 60 offensive cmdlets! 🥳

https://t.co/dBOcwRPgSw

See examples of some of the cmdlets below 👇

[7h3h4ckv157 @7h3h4ckv157]

ADCSDevilCOM 📍

A C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly.

By: @AnonArtist8

https://t.co/w7ujih35co

[R.B.C. @G3tSyst3m]

Here's my latest research. I decided to dive in to exploring Polymorphic PIC shellcode and walk the reader through the process of creating their own loader via x64 assembly code and Python. Thanks for your support and feedback as always. Enjoy!

https://t.co/otoKLxhHfH

[Steve S. @0xTriboulet]

I put a BOF loader in a BOF so that you can run BOFs from a BOF.

If you've had issues getting a BOF to work with CS's BOF loader in the past, you now have a drop-in way to get a little bit more compatibility.

https://t.co/x6neBpHyIr

[codewhisperer84 @codewhisperer84]

Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.

https://t.co/GC5wA2y3EO

[𝐶𝑇-𝐻𝑒𝑙𝑙𝑐𝑎𝑡 @CT_Hellcat]

@dhavalg2006 How much do you know about GoAnywhere MFT? Can you do automated deployment consultation?

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Crusaders of Rust @cor_ctf]

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)

https://t.co/Cbk9MBo91v

Cheers to @u1f383 for finding these CVEs + the OffensiveCon talk from gteissier & @laomaiweng for inspiration!

[Two Seven One Three @TwoSevenOneT]

#redteam
Now, you can dump the #Windows password from the LSASS process with help from the past: WerFaultSecure.exe
Github: 2x7EQ13/WSASS
Experimental version: Windows 11 24H2
#Blueteam

[Two Seven One Three @TwoSevenOneT]

Analysis of command line parameters and #vulnerability of WerFaultSecure.exe in #microsoft Windows 8.1, along with the use of the WSASS tool for red team activities
#blueteam
https://t.co/r21D8OlhrU