Gavin K

building and breaking | opinions are my own

[Gavin K @atomiczsec]

‼️new tradecraft release: I am publishing Blacklight with @SpecterOps, an open-source toolkit and blog for mapping and analyzing the local attack surface created by AI agents on endpoints

local agents are becoming apart of everyday workflows and they leave behind a growing set of endpoint artifacts: session history, configuration, auth material, rules, and other evidence that can matter during an assessment

Blacklight started with one question: what can we learn about AI agent usage from the endpoint itself?

it grew into a two-stage toolkit for safely scouting those artifacts, selectively collecting what matters, and reconstructing agent activity for deeper security analysis

would teams for people to try it, break it, and send feedback

links to blog and GitHub below ↓

[Gavin K @atomiczsec]

@marvinvonhagen @interaction cooking

[Gavin K @atomiczsec]

@Ivanklydz @GrahamHelton3 1day no 0day

[Gavin K @atomiczsec]

@GrahamHelton3 @Ivanklydz not a 0day

[Gavin K @atomiczsec]

"Existing submissions for this program will still be handled by the company without any exception. If you are currently awaiting feedback on a submitted report, hang in there for further news."

[Gavin K @atomiczsec]

@mdp_sec 3 months

[SpecterOps @SpecterOps]

Meet Sage: open-source AI for assumed-breach operations, built into Mythic. State your objective; Sage prepares commands for your approval in supervised mode.

@Ne0nd0g breaks it down in his new blog ⤵️ https://t.co/haYwfjObTc

[Gavin K @atomiczsec]

@shottr_cc here for the dancing gif

[Gavin K @atomiczsec]

@N_ambush 😭

[Gavin K @atomiczsec]

@elonmusk bang

[Gavin K @atomiczsec]

@_xpn_ theres someone waiting for you on the ferris wheel

[Gavin K @atomiczsec]

wow the @SpecterOps merch is hard to beat. and the IDOT coin to complement 👻

[Gavin K @atomiczsec]

@iamjasonlevin o wait

[Gavin K @atomiczsec]

@iamjasonlevin memelord hitman service

[SpecterOps @SpecterOps]

Without CHAP authentication, attackers can impersonate an authorized iSCSI initiator and access shared virtual disks, bypassing NTFS permissions.

@unsigned_sh0rt shows how the attack path works and what defenders can do: https://t.co/oVlRuhxrsu

[Gavin K @atomiczsec]

@ujustgotleid bro needs some sleep

[Gavin K @atomiczsec]

@0x4D31 WOOOOOOO

[Gavin K @atomiczsec]

@leerob More detail in the usage analytics section would be helpful. It would be cool to see things like individual bot usage & graphs of usage over time

[Gavin K @atomiczsec]

@charles_maddock ahaha strong enough for the first go around, let's see what happens next time 😈

[Raj Patel @GrayHatKiller]

1/2

LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.

Patched in October.

Blog: https://t.co/dUHIN6JfaE
PoC: https://t.co/xT98z64V96