Antón Ortigueira retweeted
Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).
➡️ Read the write-up: github.com/blackarrowsec/red…
➡️ Microsoft bulletin: msrc.microsoft.com/update-gu…
Antón Ortigueira retweeted
All materials from BlackArrow’s talks are now available in our GitHub repository.
➡️ github.com/blackarrowsec/tal…
Antón Ortigueira retweeted
Hi! I just published a technical deep dive into a complex and fun N-day vulnerability that allows to get RCE in a very popular e-commerce platform.
Check it out!
hiddeninslack.github.io/post…
Antón Ortigueira retweeted
Meetings You Didn’t Plan, But We Did
In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction
➡️Read more: tarlogic.com/blog/abusing-ca…
Antón Ortigueira retweeted
Our colleague @IagoAbad has weaponized the leaked token handles technique for MSSQL.
Now open token handles in MSSQL's process (sqlservr.exe) can be abused to change security context and escalate privileges both locally and in the domain.
github.com/blackarrowsec/Han…
Antón Ortigueira retweeted
The @NavajaNegra_AB conference is just around the corner! @_Kudaes_ will be on-site to talk about malware development and EDR evasion.
➡️ Read more: navajanegra.com/2023/speaker…
Antón Ortigueira retweeted
Watchguard has fixed 4 vulnerabilities in Watchguard EPDR discovered by our researchers @antuache and @Calvaruga.
These vulnerabilities can be used to turn-off the defensive capabilities of the product and achieve privilege escalation.
➡️ Advisories: watchguard.com/es/wgrd-psirt…
Antón Ortigueira retweeted
Sumérgete en el corazón de Kraken con Raúl Caro y su taller “Practical Explotation with Kraken”. Añade componentes y resuelve escenarios desafiantes en la post-explotación web! Registro: forms.gle/n8QYzkuziR3cVUVw8 @secu_x11 #ESCVI #aforolimitado
Antón Ortigueira retweeted
In our latest post, @xassiz introduces a new technique to obtain cleartext passwords from MSSQL by abusing linked servers through the ADSI provider.
➡️ Read more: tarlogic.com/blog/linked-ser…
Antón Ortigueira retweeted
New process injection technique through entry points hijacking.
- Threadless or threaded, at will.
- No hooking.
- No RWX memory permissions.
- No new threads with start address pointing to the injected shellcode.
github.com/Kudaes/EPI
Antón Ortigueira retweeted
I've found that fibers may be something to look at when it comes to execute local in-memory code. This is a simple PoC of how you can leverage fibers to execute in-memory code without spawning threads and hiding suspicious thread stacks among others.
github.com/Kudaes/Fiber
Antón Ortigueira retweeted
This was such a simple and "stupid" idea, but at the end it seems it's working. Apply a divide and conquer approach to perform remote process injection (or any other activity) bypassing some of the most common EDRs out there.
github.com/Kudaes/Split
Antón Ortigueira retweeted
Unwinder, another approach to Thread Stack Spoofing by walking PE's unwind information. This technique allows to automatically create "any" desired call stack by parsing .pdata structures.
It took me a little bit longer than expected, but worth the effort!
github.com/Kudaes/Unwinder
Antón Ortigueira retweeted
AutoDial(dll)ing Your Way - Lateral Movement and LSASS SSP using AutodialDLL, a new blog post and tool release (DragonCastle) by @TheXC3LL
mdsec.co.uk/2022/10/autodial…
Antón Ortigueira retweeted
💥One shell to HANDLE them all
New approach to escalate privileges from a web shell by abusing open token handles. #RedTeam /cc @_Kudaes_
➡ tarlogic.com/blog/token-hand…
Antón Ortigueira retweeted
We've extended @nopfor\ntlm_challenger with MSSQL support! This is useful when network segmentation prevents from reaching the SMB port
➡️ github.com/nopfor/ntlm_chall…
Antón Ortigueira retweeted
Elevator (UAC bypass) is finally released: github.com/Kudaes/Elevator. One of the most curious UAC bypasses that I've ever seen, and also it works like a charm. Give it a try and send me your feedback!
Antón Ortigueira retweeted
Minor changes to @ly4k_\Certipy to make it compatible with @AlmondOffSec\PassTheCert. Now you can use both PKINIT and Schannel when dealing with ESC4!
Find out more 👇
github.com/ly4k/Certipy/pull…
Antón Ortigueira retweeted
From ManageCA to RCE: abuse an AD CS "feature" to deploy a webshell and pwn the CA server #RedTeam /cc @_Kudaes_ @antuache @xassiz
blackarrow.net/ad-cs-from-ma…
