Errant Packet

Danny Tanner x Neo with splash of captain morgan | General tech geek and tinkerer with red team flavor | ***personal account, tweets my own etc blah blah blah

[Matt Brown @nmatt0]

I've had this side project on the backburner for a long time...

The XGecu line of universal programmers are awesome, but they come with some of the sketchiest proprietary Windows software ever. (XGPro)

MiniPro is an software program made to interact with the XGecu hardware. An open source XGPro alternative.

[Tony @TJ_Null]

At @BsidesHbg yesterday I did a talk about how I built a modular asset discovery framework by using open source tooling to help automate my work when handling large engagements.

That tool is called cygor: https://t.co/5weW4QnQr5

[freemyipod @freemyipod]

Running a bleeding edge 🩸🔪 Linux kernel on iPod nano (7th generation) #linux #ipod #ipodnano

[Errant Packet @ErrantPacket]

Oblique Relay- Cloudflare Workers edge redirector for red team ops.

Validates implant traffic against your C2 profile. KV-backed profile import, Durable Object session tracking.
No more hand-translating C2 URIs into rewrite rules.

https://t.co/CJuwep0gdc

[Dirk-jan @_dirkjan]

It appears that Microsoft removed the discovery of all domains in a tenant through ACS, a technique that I shared at my BH/DC talks last summer (though probably not many people spotted the reference). I found it out during a live demo of course 🙃

[Zack Korman @ZackKorman]

New way to use skills to get RCE: Just include tests.

npx skills add will include test files. Most js/ts test runners (Vitest/Jest) execute **/*.test.* anywhere in the repo by default, including inside .agents/skills.

When the dev runs tests locally, your code executes.

[I am Jakoby @I_Am_Jakoby]

I swear the best advice i got was to learn your own path. If you follow too closely to tutorials you'll be stuck hunting the same bugs as everyone else

Learn the fundamentals then just start hunting until you are comfortable in your environment

Once your comfortable only THEN do you start referencing other people's more specific methodologies

[Wakedxy @Wakedxy1]

During your pentest mission, please don’t make the same mistake I did.
Add printer IPs to your exclusion list when running Nuclei. Otherwise, the printer will interpret every packet sent to port 9100 as a print job.

[Matt Brown @nmatt0]

Found this TINY flash chip on the DistrictCon conference badge and just had to remove it and dump the firmware 🤣

First time using my USON8 2x3 adapter

[Errant Packet @ErrantPacket]

@DistrictCon was a blast, stay warm and safe travels home! Until next time friends, be kind and hack on.

[vx-underground @vxunderground]

Hello,

The year is coming to a conclusion. Thank you everyone for another wonderful year.

Once the next round of giveaways finish I'll probably be AFK-ish. I am extremely fatigued from work and life. I'm not sure if it's possible, but I would like to be able to nap somewhere between 240 to 480 hours.

Thank you everyone for the fun times and sticking with me while I deal with a vx-underground and a newborn baby. I wholeheartedly appreciate all the kind words and support all of you have shown me. Many of you are great, caring, and compassionate people.

I have some good news and some neutral news. The good news is that I have completed (within reason) collecting every easily discoverable malware analysis paper on the internet. Yes, of course one or two may be missing here or there, but I feel like 14,000 papers over the time span of 2 decades is pretty good.

The neutral news is that moving forward vx-underground will primarily be keeping up to date on things. This isn't necessarily good or bad, but this means updates to vx-underground will be significantly smaller and fewer.

Truthfully, I'm not sure what to do anymore. I started the website with the goal of collecting malware source code, samples, and papers. I've collected 34TB (if decompressed) over 6.5 years. I feel like it would be a betrayal to my audience to continually make silly posts all day, everyday.

I sort of worked myself out of a job, I don't know.

[vx-underground @vxunderground]

Yesterday I shared my proof-of-concept on disabling Bitlocker using undocumented COM objects.

@thebookisclosed decided to implement my code in C#.NET

C: https://t.co/va9V1ozoM4
C#: https://t.co/f9PH9fHced

Behold the pain of C/C++ WINAPI vs. C#.NET.

[BSides CT @BSidesCT]

Calling all students! We’re giving away free tickets to our upcoming conference.
To apply, email [email protected] us with:
Why you’re interested in infosec &
Something that shows your effort (project, blog, etc.) We’ll pick winners based on passion & initiative. Don’t miss out!

[Errant Packet @ErrantPacket]

@bl4sty @leinn32 Would you be kind to share left half with me too- if you have?

[Errant Packet @ErrantPacket]

@Miizix @SolidSnake9105 @defcon @phrack @netspooky @chompie1337 @richinseattle

[solst/ICE of Astarte @IceSolst]

Remove the v word, and keep the second part of that sentence, what changes?

I don’t get the hysteria, it’s the exact same principles and methodology that you apply. You think code blindly pasted from stackoverflow or random forums was adequate?

[Dmitriy Kovalenko @neogoose_btw]

I tried using Claude Code to write platform-specific SIMD implementations for several functions I never got around to optimizing.

I gave it full control to modify the code, run tests, benchmark, and make any tweaks it deem necessary. And here's the most amazing part: it actually DID IT

P.S.
even though nothing works, all the tests are failing, and, hilariously enough, there's not a single SIMD intrinsic used lol.🫡 Claude

[Avi @avi_lum]

CVE-2025-49596: Critical RCE in Anthropic MCP Inspector

I stumbled across a nasty 0day in Anthropic’s official MCP Inspector. Turns out: any public website could have exploited it to run arbitrary bash commands.

[her0x0ftime @her0x0ftime]

@snackspacecon @HackRedCon @HackSpaceCon thank you all so much for making me and my friends feel like family. Everyone involved pours their heart into this community and it shows. I hope to pay it back and pay it forward for years to come.

[Phrack Zine @phrack]

PHRACK is coming to @defcon! We're printing ~10,000 zines and giving an hour-long talk you won't want to miss! Stay tuned. 🔥 #40yrsOfPhrack #phrack72