drm

@AlmondOffSec but mostly shilling for #pywerview

[drm @lowercase_drm]

Choose your poison
🦋 https://t.co/xKbJwJzT8m
🐘 https://t.co/KtIiGxzUzZ

(still posting here too)

[Pascal Gujer  @pascal_gujer]

🔍 One loupe to find the chip. Another to follow the signal.

Meet BoardLoupe — our new open-source boardview tool for hardware hackers and reverse engineers!

Already being put to work by students at our Breaking BitLocker training in Zurich. 🔬💻

🔗 https://t.co/9yxBsxNdMU

#HardwareHacking #OpenSource #DigitalForensics

[drm @lowercase_drm]

@RedTeamPT Which Windows versions were patched ?

[drm @lowercase_drm]

@GiliYankovitch The Golden Sword is here! Thanks

[drm @lowercase_drm]

@GiliYankovitch Indeed, replied to the challenge address, my bad. I've just resend the email. Thanks!

[drm @lowercase_drm]

5ebc8a47a4efd588b7b424ec7e8552843731ed4a39f999314b60985e0088ae85

[drm @lowercase_drm]

@pascal_gujer @en4rab @NoobieDog @ghidraninja Nice, thanks for the tips

[drm @lowercase_drm]

It’s the first time I see some resin (epoxy?) on flash pins that prevents SPI sniffing (and thus VMK dumping too) 😮. Can it be removed easily? Model: Lenovo X1 Gen 9 @en4rab @NoobieDog @ghidraninja @pascal_gujer

[drm @lowercase_drm]

@craigsblackie @en4rab @NoobieDog @ghidraninja @pascal_gujer Yes but my lack of skill in micro soldering is preventing me from doing it haha

[drm @lowercase_drm]

For the record, it is a known problem on badcaps.

https://t.co/XkoQV7K1RW

[drm @lowercase_drm]

@GiliYankovitch Hi Gili, have you an update on the ENIG one ? I answered your email about the shipping address in may. Thanks

[drm @lowercase_drm]

@SipeedLab @en4rab Already have a #SLogic16u3, nice hardware but unfortunatly software is not as good as Logic2

[drm @lowercase_drm]

Recently sniff a SPI bus for the first time (with and without PIN) on a Lenovo T470. It's quite fun, event with a DSLogic! s/o @en4rab for SPITkey.

[drm @lowercase_drm]

@_dirkjan “Fun” fact: wam is slang for “moi” (me) in French. So at first I read the project name as a “askMe”

[Quentin Texier 🦀 @g0h4n_0]

None of this exists without the original research and tooling. 🙏 Massive thanks to @lowercase_drm and @AlmondOffSec for PassTheCert, this Rust port stands entirely on their work: https://t.co/Akv0oBydLd

[Outflank @OutflankNL]

NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: https://t.co/fnNqGzJ9O0

[drm @lowercase_drm]

You can know dump TDO with secretsdump dot py, thanks to Goultarde 🥳

[Almond OffSec @AlmondOffSec]

Are one-way trusts really one way? @lowercase_drm sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets.

https://t.co/jh9MRAeHk9

[Aurélien Chalot @Defte_]

I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer

https://t.co/5lYSxQpXq7

[drm @lowercase_drm]

10 years ago, my colleague Yannick published pywerview. I was an early adopter and later became an official co-maintainer. I still use it on every pentest. Nowadays, a project like that could probably be vibe-coded in no time by burning tokens, but it was a f* great adventure!

[drm @lowercase_drm]

HP EliteBook x360 1030 G8: sniffed on the bios chip (UC3)

[drm @lowercase_drm]

HP Probook 440 G5: TPM sniffed on the BIOS flash (SOIC 8)

[drm @lowercase_drm]

(near) Instant dumping of the Bitlocker VMK using @SipeedIO #SLogic16U3 and #ngscopeclient 🥰. Full disclosure: i know nothing about C++, filter was fully vibe coded (with a Claude free plan)

[🕳 @sekurlsa_pw]

Padding Oracle in MS-BKRP (BackuprKey RPC)

“decrypt DPAPI v2/v3 domain backup
blobs via distinguishable error codes on the DC's BackuprKey endpoint.”

You need the masterkey in users roaming dir: Roaming\Microsoft\Protect\<SID>\<GUID>

Creds: Bad-Jubies

https://t.co/oohapnM0HP