You don't need a USB. You need to look like one.
Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.
DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.
0xedh retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
Unlocking everything on the AMD CPU with DRAM scrambling (@xoreaxeaxeax)
github.com/xoreaxeaxeax/skit…
#infosec
0xedh retweeted
Even more privileged ADCS ESC_CES adhdmurky.github.io/posts/po…
0xedh retweeted
How a SIM can (and will) hack you: Security analysis of SIMs, attacks, and tools for research. 👨🏻💻🎫📱🩻👾
More details on:
LinkedIn: linkedin.com/posts/dlaskov_c…
Substack: it4sec.substack.com/p/how-a-…
0xedh retweeted
My recent post on the mediatek 0day has been added to the legendary collection of Linux kernel exploitation resources by @andreyknvl !!!
This is a huge milestone, thanks a lot!! :D
github.com/xairy/linux-kerne…
I wrote a book (in Spanish 🥲). It's a fairly niche book where I recount some anonymized Red Team operations I've executed over the last ten years. It doesn't cover modern TTPs, nor does it reveal anything "juicy", but I think it might be of interest to see how things changed.
0xedh retweeted
Tired of noobs complaining the WINAPI for malware development is weird. It's not.
How do you create a file?
The CreateFile function.
How do you open a file for reading?
The CreateFile function.
How do you open a file for writing?
The CreateFile function.
How do you get a handle to a directory?
The CreateFile function.
How do delete a file?
The CreateFile function.
How do you get access to a physical disk?
The CreateFile function.
How do you get access to a file stream?
The CreateFile function.
How do you get access to the console buffer?
The CreateFile function.
How do you get access to pipes?
The CreateFile function.
How do you perform interprocess communication?
The CreateFile function.
Just make sure you use the appropriate version of CreateFile (CreateFileA for ANSI, or CreateFileW for wide characters).
Alternatively, you can use CreateFile2 which is the same as CreateFile except the parameters are passed as a data structure named CREATEFILE2_EXTENDED_PARAMETERS. However, be aware CreateFile2 only works on Windows 8 and above and designed more or less for programs running from the Windows app store.
Alternatively, alternatively, you could use CreateFile3 which is nearly identical to CreateFile2 except it uses the CREATEFILE3_EXTENDED_PARAMETERS structure and is more or less designed for sandboxed packaged applications. However, be aware CreateFile3 only works on Windows11 24H2 and above.
It's shrimple, honestly.
0xedh retweeted
shipping v5 of LitterBox after way too many late nights
real EDR in the loop now. drop an agent on your VM, fire payloads at it, alerts land back with full call stacks. Elastic Defend + Fibratus work. new UI + better performance — notes in the release.
github.com/BlackSnufkin/Litt…
0xedh retweeted
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
0xedh retweeted
My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂
projectzero.google/2026/05/p…
to celebrate the release of Copy Fail and the professional way the embargo and disclosure was handled by all involved parties i have sacrificed my lunchbreak to do a quick C port (with aarch64 support and some other small things) of the original PoC
gist.github.com/blasty/d7b5d…
0xedh retweeted
So here is new local privilege escalation zero-day I discovered, not patched yet too :).
In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint.
Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client.
In the white paper below, I describe five exploit paths you can abuse.
However it's architecture problem and maybe there are more. It's Not A Potato
securelist.com/phantomrpc-rp…
0xedh retweeted
Introducing OpenMythos
An open-source, first-principles theoretical reconstruction of Claude Mythos, implemented in PyTorch.
The architecture instantiates a looped transformer with a Mixture-of-Experts (MoE) routing mechanism, enabling iterative depth via weight sharing and conditional computation across experts.
My implementation explores the hypothesis that recursive application of a fixed parameterized block, coupled with sparse expert activation, can yield improved efficiency–performance tradeoffs and emergent multi-step reasoning.
Learn more ⬇️🧵
An automated N-day research pipeline at PwnFuzz.
Ghidra + Ollama + n8n →Diffs Patch Tuesday binaries → LLM analyzes the output → Structured vuln reports, monthly AI-generated reports gets you oriented fast!
Blog: ghostbyt3.github.io/blog/nda…
Repo: github.com/ghostbyt3/nday-au…
0xedh retweeted
Spread the word! @phrack CFP with demoscene cracktro is live. Turn up the volume and enjoy the awesome stylings of @PiotrBania with some hopefully inspiring text from phrack staff :)
phrack.org/
0xedh retweeted
Want to launch the REAL Notepad, and not the Copilot, tabbed, restart-surviving one? Use psexec.exe -s.
And follow me for more Windows optimization tips!!1 ;)
PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026
outflank.nl/blog/2026/01/07/…





























