Noah

OSCP, OSCE3, CARTP, CARTE

[brucexu.eth @brucexu_eth]

这两天一个 Linux 内核漏洞挺吓人：CVE-2026-98432，CVSS 9.8。

简单说：TCP 握手时，内核会把对方 SYN 里的 IP options 存下来，回包时要用。握手完成后，这块内存直接交给新连接，没有复制。如果对方马上关掉连接，同时重发一个 SYN：

CPU A：连接关闭 → 把 options 释放
CPU B：处理重发的 SYN → 还在读这块 options
→ 读到已释放的内存（use-after-free）

说人话就像两个人共看一张纸条，一个看完就扔进碎纸机，另一个还没看完。然后这张纸可能已经被别人拿去写了别的内容。结果第二个人在看黑客写入的内容。

更麻烦的是这一切都发生在握手阶段，连接还没交给应用。攻击者不用登录，时机也是他自己控制的；没抢到时机通常只是这次握手失败，不会崩，可以一直试。Anthropic 的研究员说 Claude 写出了能远程拿 root 的 PoC，前提是机器上有 multipath TCP 监听。Go 1.24 之后默认就会开。

修复是比较简单的，就是把“马上释放”改成“等所有在读的 CPU 读完再释放”。

我查了自己的服务器：Ubuntu 24.04 中招，MPTCP 也开着。上游 10 月中就修了，但 Ubuntu 的修复内核现在还是 pending。

如果你也在等补丁，可以先用 Red Hat / AlmaLinux 给的临时方案：用 nftables 丢掉带 IP options 的 TCP 包，正常流量基本不会带这个。只能降低风险，补丁出来还是要更新内核并重启。或者把这条信息发给你的 AI Agent 去修复。

自查：uname -r 看内核版本，ss -Mlnp 看有没有 MPTCP 监听，再对照自己发行版的 CVE tracker。

详情：https://t.co/WS6rcBb8Cy

[aas @aas_s3curity]

I wrote up a way to defeat enforced SMB signing for relay.

It abuses a documented SMB re-authentication behavior.

I'm surely missing nuance and prior art. Corrections welcome.

Writeup:
https://t.co/qzF9MUF9MJ

PoC:
https://t.co/O0UN4gdVfJ

[RedTeam Pentesting @RedTeamPT]

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

[Outflank @OutflankNL]

NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: https://t.co/fnNqGzJ9O0

[woshub - Windows OS Hub @woshub]

Deploy EXE Apps with Group Policy Using ZAP Files (No MSI Required)
https://t.co/pDwhCvEqFp

[cryptoshant🇮🇳 @cryptoshan484]

To find subdomains you can use this new technique:

https://t.co/OAAowvtwaT

[Noah @noah_dsjp]

Having a great time at DEF CON 34 in Las Vegas!
Thanks to my company for giving me the chance to attend.

[🕳 @sekurlsa_pw]

GitHub repo
https://t.co/8DqIdJVdtZ

[Dark Web Intelligence @DailyDarkWeb]

🔐 Microsoft Makes Passkeys the Default Authentication Method in Entra ID

Microsoft has announced that **passkeys are now the default authentication method in Microsoft Entra ID**, marking a significant step toward eliminating passwords and strengthening enterprise identity security.

* New users signing into Microsoft Entra ID will now be guided toward registering a passkey as their primary authentication method.
* Passkeys use phishing-resistant cryptographic authentication based on the FIDO2 standard, replacing traditional passwords.
* Microsoft says the change reduces the risk of credential theft, phishing, password spraying, and account takeover attacks.
* Organizations can manage passkey adoption through Entra ID policies while maintaining support for other authentication methods during the transition.
* The update is part of Microsoft's broader passwordless strategy to improve usability while enhancing enterprise security.

**Analyst Note:** Identity remains the primary attack surface for modern cyber threats. Moving to phishing-resistant authentication such as passkeys significantly raises the bar against credential theft and business email compromise (BEC). Organizations should accelerate passwordless adoption alongside MFA, Conditional Access, and continuous identity monitoring.

Source:
https://t.co/ko8XlbabnX

#Microsoft #EntraID #Passkeys #CyberSecurity #DDW

[DbgMan ^_^ @0XDbgMan]

New blog
Spent way too much time reverse engineering CrowdStrike Falcon.
Somewhere along the way, I found a bug. It's low and not practically exploitable... but a bug is a bug :)
Publishing soon
https://t.co/VNo4gpNVED

[R.B.C. @G3tSyst3m]

Hey everyone! Here's my latest blog post demonstrating another Initial Access method, this time using WebDav to bypass Smartscreen, MOTW, and another pesky alert.

https://t.co/dFItBnx2oM

[forefy @forefy]

(Redteam) This is how macOS devs get compromised by opening a .docx (file opening a resume, opening a p.o. sow whatever)

In short:
> docx can have a remote template (feature to let it pull styles from an http server)
> docx remote template runs VBA in your machine
> this VBA can run an osascript like the one below

>Word has sandboxing in place, but not if the file name starts with `~$.myfile` - they regexed it out for allowing Word itself to write temp files

> macOS on start unzips any zip files /Users/youruser/Library
> if that zip has a folder LaunchAgents with a plist file inside - that plist can invoke any command as a perfectly root level persistency (e.g. connect to a C2)

I made this one open source as well, to increase awareness and improve the redteam around macOS endpoints to make sure EDR products raise the standards (and not, for example, trust the Word signed binary to write to login items as it pleases)

Please share to increase awareness, and think twice when opening a Word file!

[GMOサイバーセキュリティ byイエラエ株式会社【公式】 @gmo_ierae]

【ブログを更新しました】LLM発展後のEDRとの攻防 - 検知ロジックの解析がもたらす攻撃・防御の変化
https://t.co/b1HE4tzYjk

[SpecterOps @SpecterOps]

Proxied execution leaves almost nothing on disk. No new process, no dropped tool, just a socket doing its job.

@brian_psu & John Wotton break down why that's hard to detect, and introduce Proxywatch, our behavior-based approach to catching it. https://t.co/t2tBUdBapU

[Justin Elze @HackingLZ]

The current lolz is that everyone is AI assisted REing EDR products, backchanneling stories and findings, and quietly comparing notes.

People are just avoiding talking about it publicly so vendors don’t start harassing them, targeting tenants, or doing other fun things.

[dbugs @ptdbugs]

🔒 Onelogon: How Legacy Netlogon Settings Enable Active Directory Takeover

Researchers have introduced the Onelogon attack as a new way to compromise Active Directory via the Netlogon mechanism. The vulnerability stems from outdated allow-lists that were introduced after Zerologon to maintain compatibility with vulnerable legacy systems. If these exceptions remain in place, an attacker can exploit them to bypass authentication and take over accounts.

What makes this especially critical is that the attack can lead to full domain compromise if domain controller accounts are affected. The paper emphasizes that the root cause lies in configuration and operational practices, not just missing patches or updates.

📎 Article: https://t.co/BAdBK6vzZ4

⚙️ Exploit: https://t.co/I5o0wzSsFR

#dbugs_attacks

[Steven Lim @0x534c]

🗺️ 𝗥𝗕𝗔𝗖𝗠𝗮𝗽 - 𝗜𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝘃𝗲 𝗺𝗮𝗽 𝗼𝗳 𝗠𝟯𝟲𝟱 𝗥𝗕𝗔𝗖 𝗿𝗼𝗹𝗲𝘀

Just came across this cool tool built by 𝗝𝗮𝗰𝗼𝗯 𝗦𝗵𝗲𝗿𝗶𝗱𝗮𝗻 (𝗦𝗲𝗻𝗶𝗼𝗿 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗣𝘂𝗿𝘃𝗶𝗲𝘄 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿) and sharing it with fellow defenders.

𝗥𝗕𝗔𝗖𝗠𝗮𝗽 𝗰𝗼𝘃𝗲𝗿𝘀 𝟵 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 𝗮𝗻𝗱 𝟯𝟮𝟳 𝗿𝗼𝗹𝗲𝘀: Entra, Purview, Intune, Exchange, SharePoint, Defender XDR, Fabric, Power Platform, and Security Copilot.

For each role you get:
• Permissions and scope
• Use cases and when to assign it
• Prerequisites, best practices, and security considerations
• Service-specific gotchas and related roles

Tool's link:🫡
https://t.co/U7u3emEmsn

#Cybersecurity #RBACMap #RBAC

[Aurélien Chalot @Defte_]

Great blogpost, worth a read. This is a mistake I made that was reported to me via the following NXC PR as well https://t.co/Z0YrrJfujx Sorry for the wrong information, I'll have to modify the blogpost about MSSQL and CBT to fix this. Thank you @abdo_mhanni for the deep dive :)

[R.B.C. @G3tSyst3m]

My latest blog post: Using BYOVD to loot LSASS bypassing HVCI and all other security protections built in to Windows 11 25h2:

https://t.co/xuKSBQSwYr

[yousukezan @yousukezan]

TLS証明書の有効期間が短縮、段階的に47日へ　更新漏れが障害リスクに https://t.co/7hk6fn9snz