Antonio Cocomazzi

@splinter_code

offensive security - windows internals | BlueSky: http://bsky.app/profile/splintercode.bsky.social | Mastodon: http://infosec.exchange/@splinter_code

Italy

splintercod3.blogspot.com

Joined August 2016

2KPosts 9KFollowers 325Following

You might like

@x86matthew

@ShitSecure

@decoder_it

$mpgn_x64's profile picture. Flibustier du net ̿ ̿̿'̿'\̵͇̿̿\=(•̪●)=/̵͇̿̿/'̿̿ ̿ ̿ ̿ Podcast Hack'n Speak @hacknspeak / https://t.co/GyACSFg9mw$

@mpgn_x64

@NinjaParanoid

@MDSecLabs

@matterpreter

@an0n_r0

@tifkin_

@KlezVirus

@Flangvik

@pentest_swissky

@0gtweet

@mariuszbit

@_xpn_

Pinned

Antonio Cocomazzi

@splinter_code

Nov 3, 2023

The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out! 👉 github.com/antonioCoco/in… cc @decoder_it

splinter_code's tweet image. The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out!

👉 github.com/antonioCoco/in…

cc @decoder_it

Antonio Cocomazzi reposted

Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

$diversenok_zero's tweet image. Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩$

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Sep 8

In my long history of submissions, I think this is the first time one has been marked as critical😅

Antonio Cocomazzi reposted

Cyber Saiyan | RomHack Conference, Training, Camp

@cybersaiyanIT

Jul 7

Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer… #infosec #securityconference

cybersaiyanIT's tweet image. Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you!

Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer…

#infosec #securityconference

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Apr 24

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

decoder_it's tweet card. While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

From NTLM relay to Kerberos relay: Everything you need to know

Source: decoder.cloud

Antonio Cocomazzi reposted

Microsoft Threat Intelligence

@MsftSecIntel

Apr 8

Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9

MsftSecIntel's tweet card. Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows...

Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security Blog

Source: microsoft.com

Antonio Cocomazzi reposted

Elad Shamir

@elad_shamir

Apr 9

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs. Read my detailed post - the most comprehensive guide on NTLM relay & the new edges: ghst.ly/4lv3E31

elad_shamir's tweet card. NTLM relay attacks have been around for a long time. While many security practitioners think NTLM relay is a solved problem, or at least a not-so-severe one, it is, in fact, alive and kicking and...

The Renaissance of NTLM Relay Attacks: Everything You Need to Know - SpecterOps

Source: specterops.io

Antonio Cocomazzi reposted

Boris Larin

@oct0xor

Mar 25

We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-foru…

oct0xor's tweet card. Kaspersky GReAT experts discovered a complex APT attack on Russian organizations dubbed Operation ForumTroll, which exploits zero-day vulnerabilities in Google Chrome.

Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain

Source: securelist.com

Antonio Cocomazzi reposted

Raffaele Sabato

@syrion89

Mar 25

Check out our new blog post!

SentinelOne

@SentinelOne

Mar 25

🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 📄 This new research from SentinelOne exposes how these new variants are…

SentinelOne's tweet image. 🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix.

📄 This new research from SentinelOne exposes how these new variants are…

Antonio Cocomazzi reposted

Samir

@SBousseaden

Mar 25

new #elastic defend rules out : - PPL bypass via ComDotNetExploit - Execution via Windows-Run (trending delivery method ITW) github.com/elastic/protec…

SBousseaden's tweet image. new #elastic defend rules out :
- PPL bypass via ComDotNetExploit
- Execution via Windows-Run (trending delivery method ITW)
github.com/elastic/protec…

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Mar 26

Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code 😂🤣

decoder_it's tweet image. Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code

😂🤣

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Mar 13

KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/Krb…

decoder_it's tweet image. KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ &amp; dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)
github.com/decoder-it/Krb…

Antonio Cocomazzi reposted

Samir

@SBousseaden

Mar 3

Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.

$SBousseaden's tweet image. Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.$

T3nb3w

@T3nb3w

Mar 2

🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/red-teamings-d… 💻 Code: github.com/T3nb3w/ComDotN…

T3nb3w's tweet card. A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases...

GitHub - T3nb3w/ComDotNetExploit: A C++ proof of concept demonstrating the exploitation of Windows...

Source: github.com

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Feb 25

Another simple standalone tool for creating machine accounts with custom password in Windows AD github.com/decoder-it/New…

decoder_it's tweet card. Contribute to decoder-it/NewMachineAccount development by creating an account on GitHub.

GitHub - decoder-it/NewMachineAccount

Source: github.com

Antonio Cocomazzi reposted

Andrea P

@decoder_it

Feb 22

Skiing with @cybersaiyanIT sticker is priceless 😀

Antonio Cocomazzi reposted

Will

@BushidoToken

Feb 21

This tweet was mentioned in the BlackBasta Leak bestflowers.json ( timestamp: 2023-10-23 16:17:02 )

Antonio Cocomazzi reposted

Cyber Saiyan | RomHack Conference, Training, Camp

@cybersaiyanIT

Feb 17

🚀 #RomHack 2025 #callforpapers is OPEN! Are you a #cybersecurity pro with a passion for sharing knowledge? This is your chance to take the stage at #RomHack2025 📩 Apply now: cfp.romhack.io/romhack-2025/c… #InfoSec #hackercommunity

vx-underground

@vxunderground

Florian Roth ⚡️

@cyb3rops

Justin Elze

@HackingLZ

chompie

@chompie1337

Rasta Mouse

@_RastaMouse

Grzegorz Tworek

@0gtweet

S3cur3Th1sSh1t

@ShitSecure

Oliver Lyak

@ly4k_

mgeeky | Mariusz Banach

@mariuszbit

sn🥶vvcr💥sh

@snovvcrash

Andrea P

@decoder_it

an0n

@an0n_r0

Josh

@passthehashbrwn

Charlie Bromberg « Shutdown »

@_nwodtuhs

Filip Dragovic

@filip_dragovic

Will Dormann is on Mastodon

@wdormann

Yarden Shafir

@yarden_shafir

klez

@KlezVirus

n00py

@n00py1

Stephan Berger

@malmoeb

Hosein

@Hosein635643

Luke H

@3z57uff

Marshall Livingston

@digitr33

0xd3adb33f

@0xd3adb33f_

Riad Guerni

@RiyadGuerni

Georges Fournel

@Fournel0

Vincent

@Vinc3_V

Yuu

@sumaka0322

Hidaro

@HidaroTrue

Sh2ch2r

@Sh2ch2r

Shreygami

@shreygami

S A

@flafee_fluff

duskxy

@duskxy

TelWha.

@TelWha

S.Gobi

@SGobi19955500

Axta

@Asta_nine

weeri

@weeri161546

er wang

@QiwuSec

Irklaxui

@Irklaxui473

ScriptJester

@Script_J3st3r

Lenard

@Lenard___

@Cravaterouge.bsky.social

@rouge_cravate

sdsf fd

@fd_sdsf17088

Muhammad Farid

@Mu7ammadfared

cfpdirectory

@cfpdirectory

Chromos2me

@chnxuny42099292

Brown Jack

@BrownJack596114

Sebadtian Kalsberger

@_sebuba

Gt'/cosπ

@cos_pgt

Aspen Mayer

@aspenmayer

Matthew

@Matthew1_mur

D

@dsquare360

Hani afira

@ReginaAndrew205

Vrierarq

@Vrierarq29193

David Legate

@david_legate

$soahcerup's profile picture. 01000110 01010101 01000011 01001011 01011001 01001111 01010101 00100001 \u0067\u0065\u0074\u0020\u0061\u0020\u006c\u0069\u0066\u0065\u0020 %26%2398%3b%26%2311$