All I know is that I know nothing. I like Windows, Active Directory and IoT/Hardware hacking. "Responsable mais pas coupable" de PetitPotam
Paris
Joined June 2015
- Tweets5.4K
- Following687
- Followers4.7K
- Likes5.8K
topotam retweeted
⚠️CVE-2026-18963 (CVSS 9.1)⚠️
Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow.
In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow.
This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover.
Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release.
🔥PoC + Vulnerable environment:
github.com/EQSTLab/CVE-2026-…
#Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963
topotam retweeted
PoC is public. Internet-facing MikroTik SSH → full admin. No password. No key.
MikroTrick: CVE-2026-67279 + CVE-2026-86060. Fresh on CISA KEV.
Chain: password auth as `-2` (rejected but left sticky) → pre-auth rekey drops the auth gate → `/nova/bin/login` treats `-2` as “read identity + policy from fd 2” → all-ones mask = full admin.
IoC: `login failure for user -2 via ssh` then `user added by ssh:-2@…`
PoC: github.com/digiprosec/MicroT…
Writeup: cert.pl/en/posts/2026/09/mik…
Patch: 7.23.4 / 7.24.2 / 6.49.21 - then hunt `ops` + Flagged.
#MikroTik #RouterOS #CVE #PoC #InfoSec #CyberSecurity
topotam retweeted
⚠️CVE-2026-49869 (CVSS 10.0)⚠️
Unauthenticated RCE in Kestra OSS workers.
A `/configs` suffix bypasses Basic Auth, letting attackers create and run shell-task flows.
It affects OSS instances using Basic Auth when an attacker can reach the API; no credentials or pre-existing flow are required.
🔥PoC + Vulnerable environment:
github.com/EQSTLab/CVE-2026-…
#Kestra #RCE #CyberSecurity #CVE #PoC #Exploit #CVE_2026_49869
topotam retweeted
A Havoc C2 plugin that creates an invisible alternate Windows desktop, streams it to a browser-based viewer, and supports full mouse/keyboard interaction like RDP, but invisible to the target user. Created by dagowda.
Github:- github.com/dagowda/notRDP.gi…
topotam retweeted
Gentle reminder that earlier this year, I published an article containing a full purple team playbook with six procedures for blocking EDR traffic.
✅ Windows Filtering Platform
✅ Hosts File
✅ Routing Table
✅ Name Resolution Policy Table
✅ IPSec Filter Rules
✅ Secondary IP Addresses
ipurple.team/2026/01/12/edr-…
EDR traffic and the roadblocks...
Windows Firewall COM API to "shape" the traffic originating from the machine.
A tool by Jony Schats (@_0xJs_).
Source: github.com/0xJs/BlockEDRTraf…
#redteam #blueteam
topotam retweeted
EDR traffic and the roadblocks...
Windows Firewall COM API to "shape" the traffic originating from the machine.
A tool by Jony Schats (@_0xJs_).
Source: github.com/0xJs/BlockEDRTraf…
#redteam #blueteam
topotam retweeted
⚠️CVE-2026-85706 (CVSS 10.0)⚠️
Your GitLab will hand a stranger its files. 😱
No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in.
Already in CISA KEV — exploited in the wild. 🚨
If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now.
🔥PoC + setup: github.com/EQSTLab/CVE-2026-…
#GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706
topotam retweeted
Even more privileged ADCS ESC_CES adhdmurky.github.io/posts/po…
topotam retweeted
Group3r from @mikeloss also ported to Python now with a beautiful HTML report for easy review:
github.com/S3cur3Th1sSh1t/Py…
topotam retweeted
Olvídate de DCSync y las copias de sombra de NTDS. Si quieres extraer hashes de Active Directory sin hacer ruido, este es el camino.
Timeroasting abusa del servicio de tiempo de Windows (NTP) para robar hashes de forma sigilosa. Y lo peor: pasa desapercibido en la mayoría de pipelines de detección.
🧵 ¿Cómo funciona y cómo detectarlo?
1️⃣ El protocolo olvidado: Abusa de la extensión NTP de Microsoft para recolectar hashes de cuentas de máquina (y en escenarios avanzados, cuentas manipuladas).
2️⃣ Cero alertas: El tráfico NTP es omnipresente en cualquier red corporativa, por lo que el ruido generado es prácticamente nulo comparado con otras técnicas.
3️⃣ Crackeo offline: Los hashes obtenidos se pueden tirar contra Hashcat (-m 31300) para romper contraseñas débiles.
Los defensores necesitan empezar a monitorear anomalías en peticiones MS-SNTP ya mismo.
Aprende a implementarlo paso a paso con PowerShell aquí 👇
topotam retweeted
The AD Grave: Tombstoned objects🪦
If the AD Recycle Bin is enabled, objects are moved to the "Deleted Objects" container if they are "deleted". With the new "tombstone" NetExec module, you can query and restore such objects (given you have the privs).
Made by Fabrizzio🚀
ALT List, delete and restore AD objects using the tombstone NetExec module.
topotam retweeted
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public.
github.com/MSNightmare/Shiel…
The PoC works with the latest August 2026 patch
topotam retweeted
Check out @bagelByt3s' blog series to dive even further!
Part 1: ghst.ly/4w4SDt7
Part 2: ghst.ly/4gerXBr
Part 3: ghst.ly/4wcprk3
Part 4: ghst.ly/45al263
topotam retweeted
✈️ blog to kick off BH/DC week: Borrowing Windows Hello keys for authentication and persistence. dirkjanm.io/borrowing-window…
topotam retweeted
The difference between a standard cloud test and a subscription takeover? Finding the right secrets. In this blog, @rootsecdev introduces two open-source tools designed to minimize the time spent hunting for Azure secrets that probably shouldn't be there. hubs.la/Q04s6QLd0
topotam retweeted
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector.
Whitepaper: specterops.io/passkeys
topotam retweeted
Two new logical flaws in Kerberos just dropped at Black Hat. Low-privileged user to full domain takeover, including domain admins.
If you're doing Active Directory pentesting, Kerberos attacks, red teaming, identity security, or detection engineering, read this.
KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Both are logical bugs, not memory corruption. Described as surprisingly easy to exploit.
semperis.com/blog/identity-c…
#Infosec #RedTeam #DetectionEngineering
Bypassing Windows authentication reflection mitigations for SYSTEM synacktiv.com/en/publication…
