maeru

Offensive & Defensive Security Consultant | @scipag #RedTeam | @m8r1us on most other platforms

[maeru @m8r1us]

I wrote an article about Microsoft Cloud access tokens. If you are interested in seeing some methods to extract them specifically for RoadTools or AzureHound, you can find the article here:

MS Cloud Access Tokens - Control the Token, Control the Cloud (https://t.co/7WCjCGZEFx)

[MSec Operations @MSecOps]

New Blogpost regarding to "Backdooring Open-Weight Models" just published by @ShitSecure:

https://t.co/TTsppGiqog

[DbgMan ^_^ @0XDbgMan]

New blog
Spent way too much time reverse engineering CrowdStrike Falcon.
Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :)
Publishing soon
https://t.co/VNo4gpNVED

[Smukx.E @5mukx]

In this research, I turn Chrome Remote Desktop into a complete red team scenario that can be used for monitoring and even leads to spying.. I explain different use cases how to make it possible and operate without triggering security solutions..

Link :- https://t.co/6ZeFjVAUVF

[SpecterOps @SpecterOps]

Compromise one node in a Windows Server Failover Cluster and you've compromised all of them.

@unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster.

Check it out! https://t.co/53K9xgF7rY

[Murray @MyNameIsMurray]

I have no idea how I missed the "IsExchangeCloudManaged" announcements (if there were any), but if you're an environment that has been forced to keep a sketchy old Exchange server around for AD user mailbox configuration... the fix is here!
https://t.co/BlEMn4FEkJ

[Quang Vo @smuggiekeplar]

Turn out there are heaps of interesting stuffs you can do with Chrome Debugging ( CDP ). From a Red teaming perspective, you can totally enable CDP within memory of running chrome/edge processes. From there, you can grab cookies, even extracted raw creds

https://t.co/p094YdP6gO

[Enno Rey @Enno_Insinuator]

#TROOPERS26 videos published:
https://t.co/Va14UVCSpj

[ThomasByrne_infosec @Thomasbyrne__]

Aaaaand part 2 is live! Following on from my previous post, here is another method of executing code on Azure VMs. This time using Salt Minion.

https://t.co/aVdu6pz4jI

[Merill Fernando @merill]

Folks, Maester 2.2 is here!!

It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy.

The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this.

We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷‍♀️).

That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more.

Here are the highlights

🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control

🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI

🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell

🔥 5 CIS GitHub organization controls and first-class GitHub connectivity

🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access

🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer

🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps

🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first

🔥 Contributor credits across https://t.co/QbUp63ffXf, so the people writing these tests get the recognition they deserve

Huge thanks to our contributors Artem Borodai, @BrianReidC7, @cbrhh, Christopher Edwards, @fabian_bader, Henrik Piecha, @janbakker_, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, @SamErde, Simon Albers, Stephan van Rooij, @thomas_live, Thomas Schmidt, Travis McDade, Truls Dahlsveen

(PS Please let me know if I've missed anyone)

Plus a huge personal thank you from me to all the https://t.co/WIylWUGiwc founding sponsors https://t.co/LdtEsoNMwV who have helped me go full time on Maester. This release wouldn't have been possible without you.

Learn all about this release at https://t.co/s088qZRUSy

[Mohamed Alzhrani @0xMaz]

From a normal domain user to Domain Admin, bypassing the SID patch.
ESC1 is alive again, under some conditions.
MSRC closed it as “By design.” Writeup and PoC below, judge for yourself.

https://t.co/LlkaoJ7tvG

[shif/tty/mike @shifttymike]

@singe @BlackHatEvents It’s the default tool for WiFi hacking but there were a few things that bugged me, so I made it better. Then I made it nicer.
Here’s the link: https://t.co/nQXthAs938
Static binaries available in releases :)

[Florian Roth ⚡️ @cyb3rops]

CertiGhost (CVE-2026-54121) deserves much more attention than it is getting right now, from my point of view.

In a common/default AD CS setup, a low-privileged domain user can create a rogue machine account, trick the CA into issuing a certificate with the identity of a Domain Controller, authenticate as that DC via PKINIT, gain replication access and basically compromise the whole domain.

So if you run on-prem Active Directory with AD CS and your CA is still unpatched, an ordinary domain user may currently have a path to the highest privileges in your domain.

Patch it, obviously, or apply the temporary mitigation. But if you patched only recently, the harder and from my point of view more important question is: did someone already exploit it?

A patch closes the hole. It does not unfuck a domain that was already compromised.

I put a list of things I would check in the first reply.

Overview:
https://t.co/NHaJD5hlFi

Technical details:
https://t.co/ucGrc2SLbJ

PoC:
https://t.co/nvWARPtmso

Microsoft advisory:
https://t.co/kYoXWRKTyz

Temporary mitigation:
https://t.co/hVOHBYO5hD

[Yuhang Wu @wupco1996]

We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!

Read more about this in the comment...

[Fabian Bader @fabian_bader]

If you want to hunt for signs of Certighost (CVE-2026-54121) by @h0j3n and @aniqfakhrul in your #XDR environment try this query.

1. Exclude DCs
2. Identify ADCS servers
3. Check for LDAP or SMB connectivity to any non DC from ADCS

BP for SMB possible!

https://t.co/BGOhTzsP40

[torry2 @torry2_]

looked into Device Bound Session Credentials (DBSC) now on Windows+Chrome and built a tool to inspect and refresh registered sessions :) super cool protocol, link in reply

[Adam Chester 🏴‍☠️ @_xpn_]

Drafted a quick article looking at "constrained decoding" to Jailbreak local models. https://t.co/8XEoD3m6l4

[Uncle Bob Martin @unclebobmartin]

I’m significantly older than you. I started coding in the late 60s. My current strategy is to not read any of the code written by my agents. That’s the only way I can take advantage of their productivity. What I do instead is to surround the agents with extreme constraints. Unit tests, gherkin tests, QA procedures, quality metrics, mutation testing, test coverage, and a plethora of others. In the end, I have very high confidence in the code they produce because they’ve had to run the gauntlet of all of my constraints and tests.

[LaurieWired @lauriewired]

How do you protect an immensely vulnerable system against a stronger, even God-like adversary?

Well, you use a Shadow Server of course.

Power plants have lots of interesting ideas.

The NIST published a “Situational Awareness For Electric Utilities”. One fun concept is when you absolutely *cannot* protect a system, (imagine a Window XP box that controls the turbines), but still need to interact with it, do the following:

1. Create an (optical) one way diode to another machine
2. Said machine becomes the “shadow historian”
3. All queries interact with shadow data.

To *write* to the vulnerable box, a “protocol break” is required. The data model has to be converted.

In other words, you have a middleman server with a drastically different OS, communication protocol, auth, etc. Conceptually, it’s known as a virtual patch; although the underlying legacy software hasn’t changed, data conversion from say, an HTTP API to an ancient serial protocol.

The patch blocks, or is otherwise physically incapable of satisfying known vulnerability preconditions.

Neat to think about, there’s nothing really preventing you from doing this in your own homelab!

[Altered Security @AlteredSecurity]

The recording and slides for our Hacker Summer 2026 webinar, From Initial Access to Persistence: Abusing Synced Passkeys in Azure, are now available.

Video: https://t.co/FYmvWj48Pb

Slides: https://t.co/7KFt2BhaMP

Special thanks to @NathanMcNulty for an excellent session.

#HackerSummer2026 #CloudSecurity #RedTeaming #AlteredSecurity

[SpecterOps @SpecterOps]

Introducing Tradecraft Academy 📚

Our new on-demand training platform brings the practitioner-led education we are known for to learners anywhere, anytime. Get started with BloodHound Basics today.

Read more: https://t.co/oiKMBrm0dB

Start learning: https://t.co/uV9Zb5WavQ