Evangelos Mitakidis 

Cybersecurity is my passion and Offensive Security is my expertise. Follow me for the latest insights on Adversary Emulation and cutting-edge security content.

[vx-underground @vxunderground]

Another Windows zero day released by Nightmare Eclipse (sort of)

It turns out Microsoft just straight up didn't patch an old CVE from 2020 correctly.

https://t.co/sNWBtTo4at

[Pedro Domingos @pmddomingos]

TL;DR: Top hacker calls Anthropic’s bluff.

[_Ray @_RayRT]

Reusing part of the ESC1-unPAC BOF code to create a ShadowCreds + unPAC BOF

1. Write msDS-KeyCredentialLink attribute using obfuscated LDAP queries.
2. Authenticate to the KDC using PKINIT.
3. unPAC-the-hash.
4. Cleanup msDS-KeyCredentialLink.

https://t.co/4h4uWgcH4d

[Ruben Labs @RubenLabs]

I found a new one click NTLM leakage vulnerability / technique from a browser.

A web server can redirect a client to a ms-photos URI handler followed by a fileName parameter. If the parameter value is a UNC path instead of a local path, photos.exe will leak the client’s NTLMv2-SSP hash, enabling relay attacks or offline cracking.

Leaking hashes from URI handlers is not new, but combined with a browser redirection, it allows moving from website infection to capturing NTLMv2-SSP hashes (supply chain attack).

No LLMNR is required, and except if the firewall blocks outbound SMB queries, the hash will leak to public facing SMB servers.
The vulnerability can be combined in a supply-chain attack, by infecting public facing applications.

MSRC will not release a patch for this issue.

Find more details with a POC here:

https://t.co/2gMKtGZfQt

[hacker.house @hackerfantastic]

User Account Control (UAC) bypass technique exploits a DLL Search Order hijacking vulnerability in the Microsoft iSCSI Initiator Configuration Tool (iscsicpl.exe). Allows arbitrary command execution with elevated privileges without triggering UAC prompts. https://t.co/mMx7dkbtbN

[International Cyber Digest @IntCyberDigest]

🛠️ HikvisionExploiter

HikvisionExploiter is a powerful and automated exploitation toolkit targeting unauthenticated endpoints on Hikvision IP cameras, particularly those running firmware version 3.1.3.150324.

https://t.co/NFb2mlT867

[Aurélien Chalot @Defte_]

Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Dirk-jan @_dirkjan]

It seems there now is a BOF implementation of ADSyncDecrypt to dump Entra ID connect creds 👀

https://t.co/dm450St8GK

[Rad @rad9800]

Here's a fun one liner to check if an AWS access key was issued by Canary Tokens without triggering ANY alerts 🙃

aws s3api head-bucket --bucket terraformstate-$(aws sts get-access-key-info --access-key-id AKIA... --query Account --output text | tr -d '\n')

[Keanu Nys @RedByte1337]

Thanks to everyone who joined my DEFCON33 talk!🎉
For those of you who missed it and are interested in seeing how we can extract cleartext credentials and bypass MFA directly from the official Microsoft login page, I just uploaded the recording to YouTube:
https://t.co/MoPQiKgesd

[安坂星海 Azaka || VTuber @AzakaSekai_]

Just saw a sick live demo of wireless headphone hijacking that allows the attacker to perform the following without ever pairing the device. All the attacker has to do is be in range.
- read/write arbitrary bytes to device
- read headphones information
- dump firmware info
- extract paired devices information (name, link key, MAC address)

and since you can extract the above information, the attacker can then impersonate as the device and perform actions like
- access voice assistants (send text and other possibly sensitive actions; may require phone unlock)
- get phone numbers
- call control
- audio routing

Lots of devices using the Airoha chipsets are affected, especially Sony devices. The vulns were first disclosed back in June.
https://t.co/8qrS0IdcNP

[Soroush Dalili @irsdl]

I have launched YSoNet (https://t.co/Imw4otKTq9) and added #SharePoint CVE-2025-49704 payload generator to it as the first thing.

Here is how this can work:

Running command:
```
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 1 -c "calc"
```

Running C# code:

```
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\\temp\\ExploitClass.cs;System.dll"
```
Payloads will be url-encoded already.

YSoNet is a fork and replacement of YSoSerial .Net (for me) and I will try to maintain my own version now to have full control over the settings. There are many things I have to change there but all changes will be gradual.

Of course you can still use the great YSoSerial .NET repo but I won't be the one maintaining it. Hopefully I can make @pwntester proud 😊

[S3cur3Th1sSh1t @ShitSecure]

This is so much! 🔥🔥😎

Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.

https://t.co/H83AIxtskn

[Stephan Berger @malmoeb]

During a recent incident response case, we observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit

This is a clever method of accessing a Volume Shadow Copy (VSS) snapshot. Many EDR and detection systems typically monitor for commands such as 'vssadmin list shadows', and may trigger alerts based on their use.

However, by leveraging the "Previous Versions" feature in Windows (see screenshot), attackers can select a snapshot, view its properties, and enter the '@ GMT' path directly in Explorer. This allows them to browse the snapshot's contents without needing to use the command line.

Because this technique doesn't rely on typical shadow copy commands, it may evade detection by your EDR or SIEM solution. You might want to test it in your environment to identify and close this potential detection gap 🦸‍♂️🦸‍♀️

[TRAE @Trae_ai]

We’ve open-sourced Trae-Agent.
You can all `git clone` `cd trae-agent` now
https://t.co/NVgSvShsg1

[Evangelos Mitakidis  @mrpentest]

@digitalkensei @ayeejuju Reduce Transparency from Accessibility Settings

[Pirat_Nation 🔴 @Pirat_Nation]

You still can bypass microsoft Windows 11 requirement account, Microsoft has only removed the automatic script

You just need to create a new Registry value by following these steps, I tested on my PC:

>1 On the “Let’s connect you to a network” screen, press Shift + F10 to open Command Prompt.

>2 Type regedit to open the Registry Editor.

>3 In Registry Editor, navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE

>4 Right-click on the blank space in the right panel and select:

>5 New > DWORD (32-bit) Value

>6 Name it exactly: BypassNRO

>7 Double-click BypassNRO, and set the value data to 1.

>8 Close Registry Editor.

>9 Restart.

[Evangelos Mitakidis  @mrpentest]

@Print3M_ @_RastaMouse Similar material available here: https://t.co/gI4bNQiK5K. I hope this helps!

[mpgn @mpgn_x64]

imo way to complicated to extract the ntds, once you got a user with backup privilege group just do:

1⃣ nxc smb dc -u user -p pass -M backup_operator

🏆