James Shewmaker

Combatting entropy since 1975

[James Shewmaker @jimshew]

I don't always Invoke-RestMethod, but when I do, I always forget first do { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 }

[vx-underground @vxunderground]

Tired of noobs complaining the WINAPI for malware development is weird. It's not.

How do you create a file?
The CreateFile function.

How do you open a file for reading?
The CreateFile function.

How do you open a file for writing?
The CreateFile function.

How do you get a handle to a directory?
The CreateFile function.

How do delete a file?
The CreateFile function.

How do you get access to a physical disk?
The CreateFile function.

How do you get access to a file stream?
The CreateFile function.

How do you get access to the console buffer?
The CreateFile function.

How do you get access to pipes?
The CreateFile function.

How do you perform interprocess communication?
The CreateFile function.

Just make sure you use the appropriate version of CreateFile (CreateFileA for ANSI, or CreateFileW for wide characters).

Alternatively, you can use CreateFile2 which is the same as CreateFile except the parameters are passed as a data structure named CREATEFILE2_EXTENDED_PARAMETERS. However, be aware CreateFile2 only works on Windows 8 and above and designed more or less for programs running from the Windows app store.

Alternatively, alternatively, you could use CreateFile3 which is nearly identical to CreateFile2 except it uses the CREATEFILE3_EXTENDED_PARAMETERS structure and is more or less designed for sandboxed packaged applications. However, be aware CreateFile3 only works on Windows11 24H2 and above.

It's shrimple, honestly.

[Calif @calif_io]

How to format a ciphertext

https://t.co/oMD9b0SzPO

[BRute Logic @BRuteLogic]

The Crypto Layer Bug Bounty Misses

Every bug bounty hunter tests for SQLi, XSS, IDOR, auth bypass.

Almost nobody tests the crypto layer.

Not because it's hard. Because nobody showed them where to look.

The server doesn't hand you the key. It leaks math through its behavior.

A timing delta. A Content-Length difference of three bytes. A distinct HTTP status code on bad padding.

That's the oracle. The oracle exists before you exploit it.

CVE-2025-22150 undici, the HTTP client behind Node.js fetch, insufficient randomness in session token generation. Every modern Node.js app is a candidate. One curl captures the token. UUIDv1 structure exposes MAC address and timestamp. The Iterate step enumerates a ±1 second window, 10 million 100ns ticks. The Take step hijacks the session.

BREACH turns HTTP compression into a CSRF token extractor. The oracle isn't in the app: it's in Nginx, running silently at the proxy layer. Most hunters check "does the app use compression" and move on. The oracle is already there.

Padding oracle: one malformed ciphertext, one status code difference. Byte by byte, the plaintext surrenders. Then you forge the admin token and fire it.
That's LIT. Leak. Iterate. Take.

This work covers 4 attack families. 21 CVEs. 5 chapters. Padding oracles. Compression oracles. PRNG seed recovery. Hash length extension.

Every technique has a LIT-labeled PoC. Every command tested on Ubuntu 24. No theory without payload. No placeholder code.

Three original detection primitives named here first: Oracle Classifier, Compression Oracle Probe, Signature Surface Probe. No existing scanner packages these as standalone pre-flight checks.

Most hunters walk past this every day.

Full breakdown in the replies.

[Panos Gkatziroulis 🦄 @ipurple]

HallWatch - User-mode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more https://t.co/pPc7o9NnwP

[7h3h4ckv157 @7h3h4ckv157]

Kernel-Exploit-Dojo 📍

Curated archive of 100+ Linux kernel exploitation CTF challenges, organized by bug class, exploitation primitive, final technique, difficulty, and solve count.

The goal is to organize practical kernel pwn techniques such as UAF, heap spraying, pipe_buffer abuse, msg_msg, modprobe_path overwrite, and cred overwrite.

Resource: https://t.co/h1F2CD70Oc

[chompie @chompie1337]

i love this exploit! universal SELinux bypass still works to this day. I released it for Qualcomm based processors and just realized I never released the Exynos version so here it is unprivated: https://t.co/rW1Kr8CLva

[cr3ghost @cr3ghost]

Wormable RCE in Windows DNS. Wormable RCE in SMBv3. Linux kernel exploitation via eBPF and io_uring. Windows 11 kernel LPE. Android kernel exploitation bypassing DAC, SELinux, and Knox.

Full exploit chains with working PoCs. Heap grooming. ASLR bypass. CFG bypass. Type confusion. Kernel privilege escalation across three operating systems.

All free. All published with full writeups.

https://t.co/txZSShQlnW

Author: @chompie1337

#ExploitDevelopment #ReverseEngineering #InfoSec

[Trail of Bits @trailofbits]

RSA private keys biased toward 0 bits can be factored by swapping a hard math problem for an easy one: integer factorization becomes polynomial factorization.

We found hundreds of real-world keys vulnerable to this. Many traced to a type mismatch in CompleteFTP (now patched): each 32-bit limb got only 8 bits of randomness. We recovered 603 RSA and 74 DSA private keys. https://t.co/C2jcxVW9WG

[James Shewmaker @jimshew]

@c2_matrix next C2Matrix VM getting a JS-Tap update? Looks like it's beyond BeEF (not a dig on @beefproject, needed a pun or nobody retweets)

[Drew @hoodoer @hoodoer]

I'm excited to get v3 of JS-Tap released publicly.

3 new beacons for persistence on endpoints, BEX (malicious browser extension), Atom (electron app implant), and V8 (node/bun app implant). Read more here:
https://t.co/7LphrdF0Fo

Find me at BlackHat Arsenal for a demo.

[SpecterOps @SpecterOps]

MSSQL has always been a favorite target. Now it ships its own egress channel.

@gershsec's latest research breaks down how SQL Server 2025's native AI features enable exfil, NTLM coercion, and C2 transport, all functioning as intended.

Read more 👇 https://t.co/ugDN4IcZXW

[Duncan Ogilvie 🍍 @mrexodia]

Forgot to add this to the release notes, but nibble wildcard patterns also work now! `67 6? ?7 67`

[V4bel @v4bel]

🚨 Introducing "ITScape" (CVE-2026-46316)

A Guest-to-Host Escape in KVM/arm64. Guest-side actions alone exploit a use-after-free to run root-privileged code in the host kernel.

Unlike the commonly published QEMU escapes, the bug lives in in-kernel KVM, not QEMU. On a successful exploit, commands run with host kernel privilege rather than the privilege of a user process, threatening the guest-host isolation of multi-tenant arm64 public clouds.

To the best of public knowledge, the first Guest-to-Host Escape Exploit targeting in-kernel KVM/arm64.

Details: https://t.co/CtZOQEzIdg

[cje @caseyjohnellis]

yeh so anyways this is is a thing now (this is from yesterday, fwiw)

[HyperDbg @HyperDbg]

Along with extensive refactoring & numerous bug fixes, two new LBR commands have been added:

The '!lbr' command:
https://t.co/gxVZoKliYy

The '!lbrdump' command:
https://t.co/RSEvHy5CUt

Also, the script engine now includes 5 new functions to support LBR:
https://t.co/EEn9oM6J3A

[Justin Elze @HackingLZ]

👀

https://t.co/6lVX1uy06T

[🕳 @sekurlsa_pw]

Padding Oracle in MS-BKRP (BackuprKey RPC)

“decrypt DPAPI v2/v3 domain backup
blobs via distinguishable error codes on the DC's BackuprKey endpoint.”

You need the masterkey in users roaming dir: Roaming\Microsoft\Protect\<SID>\<GUID>

Creds: Bad-Jubies

https://t.co/oohapnM0HP

[hasherezade @hasherezade]

New release: #PEbear 0.7.2: https://t.co/AsAbJGR9nb - with important bugfixes and new features:

[Zhenpeng (Leo) Lin @Markak_]

We helped FFmpeg find and fix 21 security vulnerabilities.

In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.

We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.

Full write-up: https://t.co/mIrjirCgcB

[James Shewmaker @jimshew]

Both Marginally and a Border-line issue ...

[Dave W Plummer @davepl1968]

We got married on a Saturday in Canada. On Monday, we were emigrating to the United States. My new wife and I said goodbye to the movers, flew to the border, and I got pulled into the big glass room for "extra questioning".

From her vantage point, she could see the immigration officer yelling, turning red, and waving his arms. She thought we were being denied entry... my Microsoft dreams crashing down right there.

What she couldn’t hear was that he had already approved my work visa. He was furious because their copy of Microsoft Word was printing a blank page at the end of every document, and it was wasting paper, and he wanted it fixed.

I helped adjust the margins. And so, after fixing the borders at the border, they released us to our new life in America.

[Steven Murdoch @sjmurdoch]

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. https://t.co/xz3svmqiDa