n00py retweeted
The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)
n00py retweeted
A fork of ntlmrelayx is available here github.com/grayhatkiller/imp… with the LDAP signing bypass implemented. If anyone wants a quick win to fully compromise a domain…here you go!
n00py retweeted
So good news folks, especially @Bandrel , github.com/evilmog/hashcat-u…
Yes you can replace the ntlmv1 multi tool (and all the shucking clones) with mode 4000, takes a lot of the pain out, I'm going to finish prepping the talk and give it in a day or two at hackfest
thanks @hashcat
n00py retweeted
Last week me and GPT-6 wrote a wrapper library for ldap3 AD auth methods and ported several of my AD tools to use it. BloodHound-py, krbrelayx and adidnsdump now use it for their LDAP connections: signing/sealing over 389 by default (ntlm+kerberos) and channel binding for ldaps.
n00py retweeted
Apparently tweeting “I have a working PoC” creates a small obligation to explain how the thing works 😅
So here it is: both PHP bugs, the memory leaks, the ASLR bypass, worker pinning, and how I eventually got to execution
andrewmohawk.com/2026/10/26/…
n00py retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
n00py retweeted
🧵👀 ahh shit, might’ve caught a potential RCE. investigating…
🍯 phpot - first 26+ hours, with just 6 sensors!
> repeated leak-stage attempts, distributed probes, and a 38-request serializer-testing wave. 30 OOMs, 11 worker crashes, but no confirmed RCE.
full report: gist.github.com/0x4D31/6b1e7…
This has proven to be extremely incorrect. Non-tech people have only made slop. All the good AI-assisted research comes from people who are already really good at it.
n00py retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
If I see one more fake PoC I'm going to lose my mind
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Readers added context they thought people might want to know
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess…
n00py retweeted
PHP 8.5.4 and 8.5.11 reached fixed-command execution; 8.4.26 reached address disclosure only; 8.2.34 and 8.3.35 stopped safely before exploit requests...more anime powered things soon.
n00py retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
n00py retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
n00py retweeted
Little upgrade on NetExec WMI protocol 🚀
Now NetExec supports SAM, LSA and NTDS dump using only WMI. Thanks a lot to @al3x_n3ff for all the help on this PR (and all the work on NetExec overall, you rock bro 🫶)
n00py retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
n00py retweeted
I’m significantly older than you. I started coding in the late 60s. My current strategy is to not read any of the code written by my agents. That’s the only way I can take advantage of their productivity. What I do instead is to surround the agents with extreme constraints. Unit tests, gherkin tests, QA procedures, quality metrics, mutation testing, test coverage, and a plethora of others. In the end, I have very high confidence in the code they produce because they’ve had to run the gauntlet of all of my constraints and tests.