Pinned Tweet
My #Blackfield VM for @hackthebox_eu is retired. Some writeups here:
- youtube.com/watch?v=IfCysW0O…
- snowscan.io/htb-writeup-blac…
- 0xdf.gitlab.io/2020/10/03/ht…
aas retweeted
Bypassing SMB signing enforcement🔥
@aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀
1/3🧵
aas retweeted
Implemented SMB "reauth" from @aas_s3curity in my KreRelayEx tool too :-)
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
Impressive work by @GrayHatKiller on smb AND ldap signing
nitter.cf/GrayHatKiller/status/2…
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
aas retweeted
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
aas retweeted
Windows kernel pool internals are a goldmine for vulnerability researchers.
Large pool allocations have page-aligned addresses and can land adjacent in memory, a powerful primitive when combined with an off-by-one.
A great CTF/write-up on exploiting a Windows 10 paged-pool off-by-one:
j00ru.vexillium.org/2018/07/…
aas retweeted
You Don't Need Mimikatz for DCSync Anymore (SharpDCSync)
Credit/Resource: lsecqt.github.io/Red-Teaming…
Two new logical flaws in Kerberos just dropped at Black Hat. Low-privileged user to full domain takeover, including domain admins.
If you're doing Active Directory pentesting, Kerberos attacks, red teaming, identity security, or detection engineering, read this.
KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Both are logical bugs, not memory corruption. Described as surprisingly easy to exploit.
semperis.com/blog/identity-c…
#Infosec #RedTeam #DetectionEngineering
aas retweeted
CrowdStrike 月初发表blog,揭露新的提示词注入技术。本次新增18项注入技术,项目累计覆盖200多种不同的注入技术。CrowdStrike AI安全研究团队号称维护业内最大规模的提示词注入分类体系,提供了一个结构化的层级结构,清晰的展示了人工智能威胁的全部风险。
aas retweeted
Android emulator in a Docker container
github.com/HQarroum/docker-a…
aas retweeted
The @GooglePixel_US is an engineering marvel in mobile security.
Titan M2 is physically separate silicon with its own processor, RAM, and flash. Your encryption keys live there and the main CPU has no electrical pathway to extract them. Keys are generated on die during manufacturing and never exposed to factory systems.
(That’s defense against nation state interdiction)
Pixel 8 deployed Memory Tagging Extension at consumer scale using the Tensor G3. Hardware enforced memory tagging catches buffer overflows and use after free bugs instantly. These vulnerability classes account for 70% of critical mobile exploits. MTE doesn’t mitigate them - it eliminates them.
Protected KVM isolates sensitive computation in VMs the Android kernel cannot access even with root. Kernel compromise no longer equals game over.
The Pixel is the only Android device supporting bootloader relocking with custom keys. This enables @GrapheneOS to run with full verified boot integrity. Hardware that empowers third party hardening rather than preventing it.
Seven years of security updates. Published security bulletins. Open vulnerability research program.
This is what defense in depth looks like when you control the silicon.
What piece of hardware (past or present) do you consider a true marvel of engineering design? #CloudflareChat
Introducing ScEntra
linkedin.com/pulse/introduci…
aas retweeted
Welcome to the new AD Mindmap upgrade !
v2022_11 will be dark only (this is too painful to maintain two versions).
Thx again to : @Vikingfr and @Sant0rryu for their help 👍
Full quality and zoomable version here :
orange-cyberdefense.github.i…
Overview :
aas retweeted
Tiered Administration is among the strongest security controls that exist.
But the vast majority of organizations do not use it.
Here is how you can get started using Tiered Administration TODAY in your #Azure environments: 🧵




























