Jack Halon

Red Team and Offensive R&D at @CrowdStrike | Powered by ☕🍻🍩

[Jack Halon @jack_halon]

To wrap up 2022, I'm releasing the final part of my 3-part browser exploitation series on Chrome!

In this post, we demonstrate the practical use of the concepts we've learned throughout the series by analyzing and exploiting CVE-2018-17463.

Enjoy!
https://t.co/Xhrnh4fqNB

[Michael Weber @BouncyHat]

We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC

#wasm #malware #sliver

[Michael Weber @BouncyHat]

I'm tired of my tools getting sig'd so I built a pipeline to keep our tools alive for longer and bring some classics back.

Post 1 of 3 is live now. The final post will drop our Go/C# -> WASM toolchain. It builds #Sliver, #Chisel, and some of #GhostPack.

https://t.co/yFF65A8MQO

[watchTowr @watchtowrcyber]

🫡 We’re back.

Today, we’re publishing vulnerabilities we discovered, disclosed, and chained to achieve pre-auth RCE against Progress ShareFile.

Enjoy the journey with us, while you sob into your hands 🫠

https://t.co/fHR6dsaILM

[watchTowr @watchtowrcyber]

while we’re eating our best writing crayons and using finger paint to finish our latest research, we’ve decided to take this opportunity to share research from the archives with new followers 🙂

happy Friday… for now 🥹

https://t.co/maUn3dGPoG

(Yes this is not new don’t @ us)

[watchTowr @watchtowrcyber]

What's new is old, and what's old is new - as is relentlessly proven.

Join us in our analysis of CVE-2026-32746, the recent pre-auth RCE in inteutils' Telnetd

Speak soon.

https://t.co/taD1iltZBB

[watchTowr @watchtowrcyber]

In 2025, we achieved pre-auth RCE against another solution in a ransomware gang favourite category. Today, we finally click publish.

Join us as we walk through a chain of vulnerabilities we identified in BMC’s FootPrints ITSM solution.

Enjoy!

https://t.co/gtCNb05QHu

[watchTowr @watchtowrcyber]

We promised we'd be back!

Join us on our journey, from repro'ing N-days to stumbling into 0-days in SolarWinds Web Help Desk, eventually achieving pre-auth RCE.

This research fuels the watchTowr Platform, our Preemptive Exposure Management technology.

https://t.co/TzNBT1Ghs7

[Stephen Fewer @stephenfewer]

We just published our @rapid7 analysis of CVE-2026-1731, a critical command injection affecting BeyondTrust Privileged Remote Access (PRA) & Remote Support (RS). Unauthenticated RCE, with a root cause due to Bash arithmetic evaluation. Analysis/PoC here: https://t.co/TexLowi4Lk

[Back Engineering Labs @BackEngineerLab]

We’re releasing our analysis of https://t.co/cAmTrO7mvx, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.

https://t.co/ykGrHdl6ty
https://t.co/LhEXxeIcnF

[b33f | 🇺🇦✊ @FuzzySec]

I wrote a post on creating "scalable research tooling for agent systems" and I'm also releasing the companion MCP server which lets you do autonomous Frida instrumentation on Android. Details in thread 👇📲🪝

[X-C3LL @TheXC3LL]

A small rant:

The State of Art in Red Team is whatever you want to believe
https://t.co/ZihtNl8WEF

[watchTowr @watchtowrcyber]

Someone knows Bash disgustingly well, and we love it.

Here's our analysis of the Ivanti EPMM Pre-Auth RCE vulnerabilities - CVE-2026-1281 & CVE-2026-1340.

This research fuels our technology, enabling our clients to accurately determine their exposure.

https://t.co/BT9c78uuh5

[Michael Weber @BouncyHat]

Early last year @rad9800 shared an idea he'd discussed with @jonasLyk about how to stealthily write to the registry without using the traditional registry APIs EDR watches. The time has come to open source the tool. Hope this helps someone hit their goal!

https://t.co/LplZgvEa6p

[watchTowr @watchtowrcyber]

Earlier this month, we reported a zero-day auth. bypass in the SmarterTools SmarterMail email solution.

Someone has reversed the patch (released on 15th Jan) and begun exploiting it in the wild.

Read our analysis and please, ASSUME BREACH + PATCH NOW.

https://t.co/Guz3tfYqgE

[Sean Heelan @seanhn]

Blog post: On the Coming Industrialisation of Exploit Generation with LLMs https://t.co/aK4pysY1wD

TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.

Code: https://t.co/47xHRObhRy

[Natalie Silvanovich @natashenka]

Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.

https://t.co/tMhM7OFLBp

[watchTowr @watchtowrcyber]

And, we're back - analyzing CVE-2025-52691, a pre-auth RCE in SmarterTools SmarterMail mail server solution.

Speak soon (:^)) and enjoy..

https://t.co/G0FNUC9tqK

[Jack Halon @jack_halon]

@HackingLZ The only offsec people who write off TTPs as dead are the ones that don't actually know what they're doing or how EDR works 🤷🏻‍♂️

[Jack Halon @jack_halon]

A fun little Friday night project porting @AndrewOliveau C# SessionHop code to a BOF. Built off of @tiraniddo session moniker research & @CICADA8Research original IHxHelpPaneServer blog. Enjoy!
https://t.co/QYcsPKaOii

[watchTowr @watchtowrcyber]

Today, we’re releasing watchTowr Labs’ @chudyPB’s BlackHat .NET research, owning Barracuda, Ivanti and more solutions.

Enjoy the read as Piotr explains a new .NET Framework primitive, used to achieve pre- and post-auth RCE on numerous enterprise appliances.

https://t.co/UvsetqL5yj