Antonio Cocomazzi

@splinter_code

offensive security - windows internals | BlueSky: http://bsky.app/profile/splintercode.bsky.social | Mastodon: http://infosec.exchange/@splinter_code

Italy

splintercod3.blogspot.com

8월 2016에 가입

2천게시물 9천팔로워 325팔로우 중

내가 좋아할 만한 콘텐츠

@x86matthew

@ShitSecure

@decoder_it

$mpgn_x64's profile picture. Flibustier du net ̿ ̿̿'̿'\̵͇̿̿\=(•̪●)=/̵͇̿̿/'̿̿ ̿ ̿ ̿ Podcast Hack'n Speak @hacknspeak / https://t.co/GyACSFg9mw$

@mpgn_x64

@NinjaParanoid

@MDSecLabs

@matterpreter

@an0n_r0

@tifkin_

@KlezVirus

@Flangvik

@pentest_swissky

@0gtweet

@mariuszbit

@_xpn_

고정된 트윗

Antonio Cocomazzi

@splinter_code

2023. 11. 3.

The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out! 👉 github.com/antonioCoco/in… cc @decoder_it

splinter_code's tweet image. The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out!

👉 github.com/antonioCoco/in…

cc @decoder_it

Antonio Cocomazzi 님이 재게시함

Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

$diversenok_zero's tweet image. Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩$

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 9. 8.

In my long history of submissions, I think this is the first time one has been marked as critical😅

Antonio Cocomazzi 님이 재게시함

Cyber Saiyan | RomHack Conference, Training, Camp

@cybersaiyanIT

. 7. 7.

Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer… #infosec #securityconference

cybersaiyanIT's tweet image. Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you!

Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer…

#infosec #securityconference

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 4. 24.

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

decoder_it's tweet card. While I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …

From NTLM relay to Kerberos relay: Everything you need to know

출처: decoder.cloud

Antonio Cocomazzi 님이 재게시함

Microsoft Threat Intelligence

@MsftSecIntel

. 4. 8.

Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9

MsftSecIntel's tweet card. Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have discovered post-compromise exploitation of a newly discovered zero-day vulnerability in the Windows...

Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security Blog

출처: microsoft.com

Antonio Cocomazzi 님이 재게시함

Elad Shamir

@elad_shamir

. 4. 9.

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs. Read my detailed post - the most comprehensive guide on NTLM relay & the new edges: ghst.ly/4lv3E31

elad_shamir's tweet card. NTLM relay attacks have been around for a long time. While many security practitioners think NTLM relay is a solved problem, or at least a not-so-severe one, it is, in fact, alive and kicking and...

The Renaissance of NTLM Relay Attacks: Everything You Need to Know - SpecterOps

출처: specterops.io

Antonio Cocomazzi 님이 재게시함

Boris Larin

@oct0xor

. 3. 25.

We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-foru…

oct0xor's tweet card. Kaspersky GReAT experts discovered a complex APT attack on Russian organizations dubbed Operation ForumTroll, which exploits zero-day vulnerabilities in Google Chrome.

Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain

출처: securelist.com

Antonio Cocomazzi 님이 재게시함

Raffaele Sabato

@syrion89

. 3. 25.

Check out our new blog post!

SentinelOne

@SentinelOne

. 3. 25.

🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 📄 This new research from SentinelOne exposes how these new variants are…

SentinelOne's tweet image. 🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix.

📄 This new research from SentinelOne exposes how these new variants are…

Antonio Cocomazzi 님이 재게시함

Samir

@SBousseaden

. 3. 25.

new #elastic defend rules out : - PPL bypass via ComDotNetExploit - Execution via Windows-Run (trending delivery method ITW) github.com/elastic/protec…

SBousseaden's tweet image. new #elastic defend rules out :
- PPL bypass via ComDotNetExploit
- Execution via Windows-Run (trending delivery method ITW)
github.com/elastic/protec…

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 3. 26.

Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code 😂🤣

decoder_it's tweet image. Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code

😂🤣

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 3. 13.

KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/Krb…

decoder_it's tweet image. KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ &amp; dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)
github.com/decoder-it/Krb…

Antonio Cocomazzi 님이 재게시함

Samir

@SBousseaden

. 3. 3.

Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.

$SBousseaden's tweet image. Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.$

T3nb3w

@T3nb3w

. 3. 2.

🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/red-teamings-d… 💻 Code: github.com/T3nb3w/ComDotN…

github.com

GitHub - T3nb3w/ComDotNetExploit: A C++ proof of concept demonstrating the exploitation of Windows...

A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases...

출처: github.com

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 2. 25.

Another simple standalone tool for creating machine accounts with custom password in Windows AD github.com/decoder-it/New…

decoder_it's tweet card. Contribute to decoder-it/NewMachineAccount development by creating an account on GitHub.

GitHub - decoder-it/NewMachineAccount

출처: github.com

Antonio Cocomazzi 님이 재게시함

Andrea P

@decoder_it

. 2. 22.

Skiing with @cybersaiyanIT sticker is priceless 😀

Antonio Cocomazzi 님이 재게시함

Will

@BushidoToken

. 2. 21.

This tweet was mentioned in the BlackBasta Leak bestflowers.json ( timestamp: 2023-10-23 16:17:02 )

Antonio Cocomazzi 님이 재게시함

Cyber Saiyan | RomHack Conference, Training, Camp

@cybersaiyanIT

. 2. 17.

🚀 #RomHack 2025 #callforpapers is OPEN! Are you a #cybersecurity pro with a passion for sharing knowledge? This is your chance to take the stage at #RomHack2025 📩 Apply now: cfp.romhack.io/romhack-2025/c… #InfoSec #hackercommunity

vx-underground

@vxunderground

Florian Roth ⚡️

@cyb3rops

Justin Elze

@HackingLZ

chompie

@chompie1337

Rasta Mouse

@_RastaMouse

Grzegorz Tworek

@0gtweet

S3cur3Th1sSh1t

@ShitSecure

Oliver Lyak

@ly4k_

mgeeky | Mariusz Banach

@mariuszbit

sn🥶vvcr💥sh

@snovvcrash

Andrea P

@decoder_it

an0n

@an0n_r0

Josh

@passthehashbrwn

Charlie Bromberg « Shutdown »

@_nwodtuhs

Filip Dragovic

@filip_dragovic

Will Dormann is on Mastodon

@wdormann

Yarden Shafir

@yarden_shafir

klez

@KlezVirus

n00py

@n00py1

Stephan Berger

@malmoeb

Hosein

@Hosein635643

Luke H

@3z57uff

Marshall Livingston

@digitr33

0xd3adb33f

@0xd3adb33f_

Riad Guerni

@RiyadGuerni

Georges Fournel

@Fournel0

Vincent

@Vinc3_V

Yuu

@sumaka0322

C

@C010101111

Hidaro

@HidaroTrue

Sh2ch2r

@Sh2ch2r

Shreygami

@shreygami

S A

@flafee_fluff

duskxy

@duskxy

TelWha.

@TelWha

S.Gobi

@SGobi19955500

Axta

@Asta_nine

weeri

@weeri161546

er wang

@QiwuSec

Irklaxui

@Irklaxui473

ScriptJester

@Script_J3st3r

Lenard

@Lenard___

@Cravaterouge.bsky.social

@rouge_cravate

sdsf fd

@fd_sdsf17088

Muhammad Farid

@Mu7ammadfared

cfpdirectory

@cfpdirectory

Chromos2me

@chnxuny42099292

Brown Jack

@BrownJack596114

Sebadtian Kalsberger

@_sebuba

Gt'/cosπ

@cos_pgt

Aspen Mayer

@aspenmayer

Matthew

@Matthew1_mur

D

@dsquare360

Hani afira

@ReginaAndrew205

Vrierarq

@Vrierarq29193

David Legate

@david_legate

$soahcerup's profile picture. 01000110 01010101 01000011 01001011 01011001 01001111 01010101 00100001 \u0067\u0065\u0074\u0020\u0061\u0020\u006c\u0069\u0066\u0065\u0020 %26%2398%3b%26%2311$