Cr0Eax

reverse engineer.

[%TEMP% @TEMP43487580]

It was a great opportunity to give a talk with @kai6u at #SOCON2026 !

Thank you all we had the chance to talk with, and @SpecterOps for having us.
The slides from our session have been uploaded here for anyone interested.

https://t.co/3N24yFuCim

[Cr0Eax @dotcrx]

#flareon12 Annual report🫡

[Andrew Oliveau @AndrewOliveau]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

https://t.co/ch9WuSP6bm

[Cobalt Strike @_CobaltStrike]

Wow, we can't believe you remembered the 2-weekiversary of the 4.11 release! Let's cut the cake and celebrate the novel Sleepmask, a novel process injection technique, new prepend reflective loader with new evasive options, asynchronous BOFs, and more!

https://t.co/h6ly1wxWp0

[Bobby Cooke @0xBoku]

As promised... this is Loki Command & Control! 🧙‍♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!
https://t.co/fR44ukK1Y2

[T3nb3w @T3nb3w]

🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection

Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research!

🔍 Blog: https://t.co/TKdtwuj509
💻 Code: https://t.co/tlppakaLPO

[Panos Gkatziroulis 🦄 @ipurple]

RedEDR: Collect Windows telemetry for Malware Development https://t.co/HwJseshxyX #redteam

[SuperFashi @SuperFashi1]

flare-on 11 write up is out on my company's blog:
https://t.co/86Ucnx3vx6

[Eli @elikaski]

I wrote an article about known attacks on Elliptic Curve Cryptography, check it out! https://t.co/hFAatykkxo

[Clement Rouault @hakril]

In our search for new forensic artifacts at @ExaTrack, we sometimes deep dive into Windows Internals.
This one is about COM and interacting with remote objects using a custom python LRPC Client.

STUBborn: Activate and call DCOM objects without proxy: https://t.co/FKPocJRN2Z

[Ivan Komarov (dfyz) @i_komarov]

#flareon11 For task 9, massive thanks to the hero who wrote Python bindings for the Time-Travel Debugger (https://t.co/O6ifl1PfUX). Being able to record a process execution once and then arbitrarily navigating it (reading regs/memory along the way) really feels like a superpower.

[Ruslan Sayfiev @cryptopeg]

Here is my light session presentation about MS OneDrive EoP vulnerability that we found and successfully exploited with my friend and colleague Denis (@dotcrx)!
https://t.co/xWRGSDd8ud

[Cobalt-57 @cobalt57dev]

Xen!

Namely in regards to the chapter "Nihilanth."

In this build are functional versions of C4A1Y and C4A1Z that were seen in the Half-Life: Source VMF sources and were also accidentally released (as BSPs) in the 2013 updates to Half-Life: Source.

[sixtyvividtails @sixtyvividtails]

Outrageous technique: barely legal use of x86 CPU instruction enables you to catch and 𝗰𝗮𝗻𝗰𝗲𝗹 impeding pagefault before it actually happens.

③: catch PAGE_GUARD or invalid access
⓪: do previously illegal reads at high IRQL, safely

#vpgatherqq #vpscatterqq scatter/gather

[sabotage @saab_sec]

New blog!

I hate you COM – Pitfalls of COM object activation!

Addressing few issues in .NET unmanaged apis when used in offensive coding

https://t.co/KKpAlkM4fh

[James Forshaw @tiraniddo]

It seems amazing to me that MS have spent years talking about this feature and have not fixed well known public bypasses. My similar Kerberos trick probably works https://t.co/mzhtPBR94D as does https://t.co/C9uFogNE4B if you accept a prompt :)

[Cr0Eax @dotcrx]

Thank you for challenges! 💕#flareon11

[Eleemosynator @Eleemosynator]

#flareon11 challenge 9 - serpentine was one of the best challenges I've ever seen. Up there with break, evil, anode, wizardcult, help, missing, golf, Suspicious Floppy Disk, FLAVA, and you_are_very_good_at_this.

[Aurélien Chalot @Defte_]

Working on some NetExec modules I realized that on Windows you can get a list of recently modified files looking at the %appdata%\Roaming\Microsoft\Windows\Recent folder. New NXC module coming soon 👀