ycnet59

Red Teaming | Exploit Development
HTB Pro Labs addict.

[Abdul Mhanni @abdo_mhanni]

You can now coerce HTTP authentication from Windows targets that are running MS-RPRN, using impacket with PR #2361!

The PR added a new opnum from the MS-RPRN spec, OPNUM 88 and an example script to make the process straight forward. Letting you now coerce and relay HTTP authentication from remote machine targets

Shoutout to sudonoodle for the BOF that inspired this and for the technique(at least I think it was them who found it) :3

[ycnet59 @ycnet59]

Agree.

[AB Kuai.Dong @_FORAB]

我发誓，我这辈子都不会卸载 X。

毕竟没有哪个平台，能看到世界万亿首富，亲自骂别人是智障。

[chompie @chompie1337]

Video of my @UnpromptedAU & Bsides Canberra talks out now

I built an autonomous N-Day exploit pipeline for the Windows kernel w/ mix of deterministic and AI-led stages. Results were comparable to what Anthropic achieved with Mythos using a much less powerful model.

[Co11ateral @co11ateral]

ADStrike

Using ADStrike to Compromise Active Directory

We used ADStrike with Qwen 2.5-Coder to orchestrate an attack on our Active Directory. It has all the common AD attacks and different levels of OPSEC modes with 52 attack modules integrated

https://t.co/ZM1XKYeNG1

@three_cube @_aircorridor

[pwn.ai @pwn_ai]

Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection

By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬

[cat3lyst @cat3lyst]

📜 From RCE to camera credentials in Axis Camera Station

https://t.co/KzHhCEdbs2

During a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026-63286, a weak credential encryption scheme, which allowed me to decrypt all the camera credentials stored in the application’s database and connect to the cameras.

Full attack chain summary:
• Identify Axis Camera Station on port 55752 during the network scan.
• Exploit CVE-2025-30026 + CVE-2025-30023 to get unauthenticated RCE as SYSTEM on both Windows servers, getting access to the factory network.
• Copy the .FDB database files.
• Exploit CVE-2026-63286 to decrypt all stored credentials.
• Connect to the factory cameras using the decrypted credentials.

Unauth RCE on Axis Camera Station (ACS)

https://t.co/tubFAVw90B

Offline decryptor for AXIS Camera Station (ACS) credentials

https://t.co/FDKNE7tC4Q

[🕳 @sekurlsa_pw]

Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory
Blog:
https://t.co/TkM86XT97s
POC:
https://t.co/76DqwDlH7I

Part 2:
https://t.co/giR9HTPjuc
Decrypting GPM Passkeys & Forging WebAuthn Assertions for Account Takeover

✍️: 0rcruxe

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

Google-CloudのFLAREチームが、アセンブリーの読解からWindowsマルウェア解析の基礎まで学ぶ講座「Malware-Analysis-Crash-Course」を無償公開。マルウェアについて正確な判断を下すには、ツールの出力に加えて手作業のリバースエンジニアリングによる理解が必要だと言及。教材集「FLARE-Learning-Hub」には、Go製実行ファイルの解析リファレンスと、実行を記録して前後に再生できるWinDbgのTTD入門も収録。

【要点の整理】

・講座は全9章で、x86の基礎、関数や条件分岐、x86-64の呼び出し規約、Windows APIやレジストリー操作の読み方まで解説。アセンブリーを書いてデバッグする演習、クイズ、詳細な解答付きの5本のラボを用意

・受講の前提は、Windowsのコマンドライン操作と、2の補数やエンディアン、プログラミング、ソケットを含むネットワークの基礎知識。C言語の経験は必須でないものの、簡単なCのコード片も使用

・教材本文はWeb公開のGoogleドキュメントで、演習・デモ用のバイナリーや逆アセンブラーのデータベース、スクリプトはMandiantのGitHubリポジトリーに収録。Goのリファレンスは、Go 1.24.0でコンパイルしたWindows AMD64向け実行ファイルが対象

・FLAREチームは、解析ツールの導入を自動化する「FLARE-VM」を導入した隔離VMと、スナップショット対応の仮想化製品の利用を推奨。教材の対応環境は現時点でIntel x86-64に限定

・配布物の一部はマルウェアに似た動作のため自動検知され得るとして、隔離VM外での実行による損害には責任を負わないとリポジトリーで明記

詳細は以下を参照：
https://t.co/XZzcwlnJn4

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[Smukx.E @5mukx]

Introduction to Windows shellcode development securitycafe series:-

Part 1:- https://t.co/wThrhnKO8Z

Part 2:- https://t.co/oWXRu6b4qk

Part 3:- https://t.co/419zHhEUQv

[Andrea P @decoder_it]

The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Everything in cybersecurity that isn't about vulnerabilities is boring as fuck.

[Orange Tsai 🍊 @orange_8361]

Bonus: I've also flipped the chain and popped MS Edge from calc.exe 😆

https://t.co/0ZgisaKl3V

[Alex Neff @al3x_n3ff]

Bypassing SMB signing enforcement🔥

@aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀

1/3🧵

[Alexander Popov @a13xp0p0v]

Slides for my talk at @TheSAScon
"Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device"
https://t.co/d1dx3K6cCv

[0xor0ne @0xor0ne]

Linux Kernel UaF to Root

Part 1: https://t.co/iWVoizBw7p
Part 2: https://t.co/KbPDa6Na7X
Part 3: https://t.co/c9qv8URcn8

Credits Quentin Buathier

#infosec

[Dark Web Intelligence @DailyDarkWeb]

⚠️ UPDATE: UNIT 42 CONFIRMS PHP2SHELL EXPLOITATION WITH AGENTIC AI POST-EX

Unit 42's Oct 23 threat-brief update confirms PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is being exploited in the wild, with attackers using agentic AI platforms for post-exploitation. Both flaws are unauthenticated RCE, CVSS 9.2 (CVSS 4.0).

In one European government case, within ~2 hours of initial exploitation attackers:
• Accessed password hashes and MFA secrets
• Stood up an NTLM-relay tunnel into Active Directory
• Attempted Domain Admin privilege escalation

Commands were wrapped in machine-parseable delimiters such as ==SHELLUSER== and ==PASSWD== — strong agentic-attacker markers. Cortex Xpanse still sees ~22.6M exposed PHP instances potentially vulnerable.

Not framed as a mass outbreak, but confirmed live post-ex. Patch PHP immediately (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or vendor fixed builds) and hunt for post-exploitation activity.

https://t.co/EwSJFbLUA7
#DDW #PHP2Shell #PHP #Unit42 #CyberSecurity #ThreatIntelligence #Vulnerability

[Joas Antonio @C0d3Cr4zy]

Syswhispers4

https://t.co/fFtGUmKgrt

[Florian Hansemann @CyberWarship]

''EDR Evasion: Process Injection Without WriteProcessMemory''

#infosec #pentest #redteam #blueteam
https://t.co/14WJx8l6Wi

[Raj Patel @GrayHatKiller]

1/2

LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.

Patched in October.

Blog: https://t.co/dUHIN6JfaE
PoC: https://t.co/xT98z64V96

[ycnet59 @ycnet59]

I just solved Vaccine on Hack The Box! https://t.co/Sz6GJ7Zcj3 #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting