Zeroed

Just a guy that talks at conferences sometimes

[Zeroed @Zeroedtech]

If you're attending #BSidesMelb2026 this weekend, there's still a handful of tickets available for my Friday training session "Attacking and Defending Microsoft IIS" https://t.co/qZfRJmIg7F Come and learn how to write and detect web shells, there's something for everyone

[Zeroed @Zeroedtech]

A slightly scary commit, on the plus side, my .NET profiler is a million times easier to extend now

[Zeroed @Zeroedtech]

If you're attending #BSidesMelb2026 and have an interest in IIS security, I'll be running training the day before https://t.co/iulfaMv5up
Come and learn how to write and detect web shells, there's something for everyone

[Zeroed @Zeroedtech]

Success! After hours of debugging, I found that removing runat="server" from the outer most element of the CVE-2025-49704 payload generated by YSoNet fixed it. Every in the wild sample I've seen has this field set so I'm pretty confused now. @irsdl any idea why this might be?

[Zeroed @Zeroedtech]

Has anyone managed to exploit any of the SharePoint ToolPane CVE's on a freshly installed server? I'm testing out a CVE-2025-49704 payload generated with https://t.co/9aVHTUYOO6 against 16.0.10417.20018 in my lab and whilst the auth bypass works, the payloads fail to deserialise

[Zeroed @Zeroedtech]

I’ve recently done a deep dive into how IIS view state machine keys are generated and how they are used to decrypt view state messages. I’ve written up my findings in a new blog post and developed an application to assist with the decryption of view states
https://t.co/JkfFjnpBVj

[Zeroed @Zeroedtech]

...so yes

[Zeroed @Zeroedtech]

Not the response I want when I resort to AI to debug some mutual TLS issues

[Zeroed @Zeroedtech]

@irsdl @BSidesLondon I'd be very keen, viewstate exploration is a massive issue these days but getting people to under the issue is a nightmare

[Zeroed @Zeroedtech]

@BertJanCyber I suspect this will follow the same route as the recent SharePoint vulns, adversaries will start simple with basic subprocesses execution but within a few days we'll have malicious .NET assemblies being reflectively loaded

[Zeroed @Zeroedtech]

I've recently been experimenting with using .NET profilers to hook .NET functions under IIS and decided to write up a blog post while it was fresh in my mind https://t.co/VzSHi8b5Q8

[Nicolas Krassas @Dinosn]

TOLLBOOTH: What's yours, IIS mine https://t.co/tcb2I2ieH7

[Zeroed @Zeroedtech]

12 months ago I presented a 3 hour course on attacking and defending Microsoft IIS servers to a packed room at BSides Canberra, today the 30+ hour version went live on @XintraOrg !

[inversecos @inversecos]

New XINTRA course‼️
Advanced IIS Post Exploitation, Detection & Evasion

Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.

If your detection and response capabilities lag exposure, this course bridges the gap with:

- Memory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques

Syllabus and preview videos here👇
https://t.co/U4TjRX7DXy

@XintraOrg

[Zeroed @Zeroedtech]

@lucho_in_Oz The weekend

[Zeroed @Zeroedtech]

@irsdl @0xTib3rius @TheRealC3rul34n You don't like waiting 5 mins for the installer to launch, just to tell you you're missing a dependency?

[Zeroed @Zeroedtech]

Not a bad read, I think they may be overanalysing a compiled webshell and its a shame they didn't get a memory dump but its great to see more companies talking about this stuff
https://t.co/0EkBjcdAjn

[Zeroed @Zeroedtech]

@vinopaljiri Nice, I've always assumed these timestamps had just been tampered with

[Zeroed @Zeroedtech]

After a bit more digging it look like its referenced in Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
but not Microsoft.JScript, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
The later of which is used by my IIS

[Zeroed @Zeroedtech]

For years I've seen adversaries using the "unsafe" keyword in their JScript eval shells and assumed it was required to eval complex statements (i.e code), but after trying to work out what it actually does for some training I'm working on I found it does nothing! Its unreferenced

[Zeroed @Zeroedtech]

@AlienPacket @DebugPrivilege Sometimes you just don't care, as long as you achieve your objective, does it really matter that the blue team knows how you did it? A lot of the c# malware I look at does very little to hide what it's doing