splinter_code's profile picture. offensive security - windows internals | BlueSky: http://bsky.app/profile/splintercode.bsky.social | Mastodon: http://infosec.exchange/@splinter_code

Antonio Cocomazzi

@splinter_code

offensive security - windows internals | BlueSky: http://bsky.app/profile/splintercode.bsky.social | Mastodon: http://infosec.exchange/@splinter_code

ปักหมุด

The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out! 👉 github.com/antonioCoco/in… cc @decoder_it

splinter_code's tweet image. The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out! 

👉 github.com/antonioCoco/in…

cc @decoder_it

Antonio Cocomazzi รีโพสต์แล้ว

Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in NTLM local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅

decoder_it's tweet image. Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in  NTLM  local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅
decoder_it's tweet image. Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in  NTLM  local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅

Antonio Cocomazzi รีโพสต์แล้ว

Antonio Cocomazzi รีโพสต์แล้ว

Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used. Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.

decoder_it's tweet image. Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used.
Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.
decoder_it's tweet image. Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used.
Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.

Antonio Cocomazzi รีโพสต์แล้ว

Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

diversenok_zero's tweet image. Better socket handle visibility coming soon to @SystemInformer 🔥

When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩

Antonio Cocomazzi รีโพสต์แล้ว

In my long history of submissions, I think this is the first time one has been marked as critical😅

decoder_it's tweet image. In my long history of submissions, I think this is the first time one has been marked as critical😅

Antonio Cocomazzi รีโพสต์แล้ว

Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer… #infosec #securityconference

cybersaiyanIT's tweet image. Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you!

Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer…

#infosec #securityconference

Antonio Cocomazzi รีโพสต์แล้ว

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…


Antonio Cocomazzi รีโพสต์แล้ว

Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9


Antonio Cocomazzi รีโพสต์แล้ว

NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs. Read my detailed post - the most comprehensive guide on NTLM relay & the new edges: ghst.ly/4lv3E31


Antonio Cocomazzi รีโพสต์แล้ว

We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-foru…


Antonio Cocomazzi รีโพสต์แล้ว

Check out our new blog post!

🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 📄 This new research from SentinelOne exposes how these new variants are…

SentinelOne's tweet image. 🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 

📄 This new research from SentinelOne exposes how these new variants are…


Antonio Cocomazzi รีโพสต์แล้ว

new #elastic defend rules out : - PPL bypass via ComDotNetExploit - Execution via Windows-Run (trending delivery method ITW) github.com/elastic/protec…

SBousseaden's tweet image. new #elastic defend rules out :
- PPL bypass via ComDotNetExploit
- Execution via Windows-Run (trending delivery method ITW)
github.com/elastic/protec…
SBousseaden's tweet image. new #elastic defend rules out :
- PPL bypass via ComDotNetExploit
- Execution via Windows-Run (trending delivery method ITW)
github.com/elastic/protec…

Antonio Cocomazzi รีโพสต์แล้ว

Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure @splinter_code 😂🤣

decoder_it's tweet image. Hey, we should really switch from NTLM to something like Kerberos, yet another good reason, right? cc @ShitSecure  @splinter_code 

 😂🤣

Antonio Cocomazzi รีโพสต์แล้ว

KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/Krb…

decoder_it's tweet image. KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) 
github.com/decoder-it/Krb…

Antonio Cocomazzi รีโพสต์แล้ว

Great work! few detection points: - registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\" - WaaSMedicSvc loading CLR (result of .NET execution in the context) - Impersonation as Trusted Installer.

SBousseaden's tweet image. Great work! few detection points: 

- registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\"
- WaaSMedicSvc loading CLR (result of .NET execution in the context)
- Impersonation as Trusted Installer.
SBousseaden's tweet image. Great work! few detection points: 

- registry change "HKLM\\SOFTWARE\\Classes\\CLSID\\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\\TreatAs\\"
- WaaSMedicSvc loading CLR (result of .NET execution in the context)
- Impersonation as Trusted Installer.

🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research! 🔍 Blog: mohamed-fakroud.gitbook.io/red-teamings-d… 💻 Code: github.com/T3nb3w/ComDotN…



Antonio Cocomazzi รีโพสต์แล้ว

Another simple standalone tool for creating machine accounts with custom password in Windows AD github.com/decoder-it/New…


Loading...

Something went wrong.


Something went wrong.