José M. Aparicio

Red Team @BlackArrowSec (@Tarlogic)

[BlackArrow @BlackArrowSec]

Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).

➡️ Read the write-up: https://t.co/JvMGad5NuI
➡️ Microsoft bulletin: https://t.co/0IbpRxxUY7

[X-C3LL @TheXC3LL]

A small rant:

The State of Art in Red Team is whatever you want to believe
https://t.co/ZihtNl8WEF

[Inés @ineesdv]

Tangled is a social engineering platform that weaponizes calendar event processing in Outlook and Gmail to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction.

https://t.co/vz4ulB2SL3

Technical breakdown: https://t.co/0Z0LH8hjdM

[BlackArrow @BlackArrowSec]

Meetings You Didn’t Plan, But We Did

In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction

➡️Read more: https://t.co/7RApljHair

[BlackArrow @BlackArrowSec]

This Thursday, our colleague @_Kudaes_ will be at @NavajaNegra_AB presenting Activation Context Hijack: a new code execution technique for Windows environments.

➡️ More info: https://t.co/KLCb6lWNDw

[BlackArrow @BlackArrowSec]

AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga.

This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems.

➡️ Advisory: https://t.co/bD9hLomlG1

[X-C3LL @TheXC3LL]

Old Red Team Story:

@_apanonimo created something similar but as APK uploaded to the Android PlayStore spoofing the target company. It read the 2FA from SMS and autofilled it to login in the intranet, but also gave us access.

It stayed alive for months 😂

[BlackArrow @BlackArrowSec]

Enhanced version of secretsdump from #Impacket to dump credentials without touching disk.

This feature takes advantage of the WriteDACL privileges held by local administrators to provide temporary read permissions on registry hives.
https://t.co/gRtlOdNejE

[Nick Frichette @Frichette_n]

As someone involved in the AWS offsec space, I want to share why I strongly do NOT recommend the HackTricks AWS Red Team Expert course. The author of it is a plagiarist, stealing content from other creators and is directly profiting off of it through sponsorships. A 🧵

[BlackArrow @BlackArrowSec]

Our colleague @IagoAbad has weaponized the leaked token handles technique for MSSQL.

Now open token handles in MSSQL's process (sqlservr.exe) can be abused to change security context and escalate privileges both locally and in the domain.

https://t.co/JmXSDrLMfH

[X-C3LL @TheXC3LL]

My 2cents: before using something random you saw on twitter/Github, think twice how it works and if it is worth or just crap. And, please, don't reuse infra in your attacks 🤣

[ATTL4S @DaniLJ94]

First video of "Understanding a Payload's Life" uploaded. As soon as I have some spare time I'll be recording more. Enjoy!

https://t.co/AJsQvUgFws

[BlackArrow @BlackArrowSec]

Watchguard has fixed 4 vulnerabilities in Watchguard EPDR discovered by our researchers @antuache and @Calvaruga.

These vulnerabilities can be used to turn-off the defensive capabilities of the product and achieve privilege escalation.

➡️ Advisories: https://t.co/uJGhFsI5VR

[José M. Aparicio @_apanonimo]

@chavesmiguel @PGonzalezMedina 10/10

[Kurosh Dabbagh @_Kudaes_]

Finally I figured it out how to remove your username and other undesired absolute path strings from Rust binaries. It's pretty simple, but I've added it to the tips and tricks repository in case anyone has been struggling with this issue as well. https://t.co/bRpjF1CeSp

[BlackArrow @BlackArrowSec]

In our latest post, @xassiz introduces a new technique to obtain cleartext passwords from MSSQL by abusing linked servers through the ADSI provider.

➡️ Read more: https://t.co/KUDKJiV4KY

[Kurosh Dabbagh @_Kudaes_]

New process injection technique through entry points hijacking.
- Threadless or threaded, at will.
- No hooking.
- No RWX memory permissions.
- No new threads with start address pointing to the injected shellcode.

https://t.co/2Hjq9pOdsA

[Kurosh Dabbagh @_Kudaes_]

I've found that fibers may be something to look at when it comes to execute local in-memory code. This is a simple PoC of how you can leverage fibers to execute in-memory code without spawning threads and hiding suspicious thread stacks among others.
https://t.co/kjIPOunGun

[José M. Aparicio @_apanonimo]

@spoksponha

[BlackArrow @BlackArrowSec]

Have you ever tried exploiting a Spring Boot Actuators RCE but the restart endpoint was disabled?

⬇️ Abuse this behaviour using this #TrickOrThreat by @antuache