CCob🏴
@_EthicalChaos_
Followers
9K
Following
9K
Media
365
Statuses
3K
Ceri Coburn: Hacker | R̷u̷n̷n̷e̷r̷ DIYer| Vizsla Fanboy and a Little Welsh Bull apparently 🏴 Author of poorly coded tools: https://t.co/P6tT2qQksC
In a field somewhere
Joined February 2015
A little while ago I tweeted about a potential BOF-PE design. So here it is, a new design that includes a fully linked PE, C++ exceptions and use of the STL template library.
Beacon Object Files (BOFs) in C2 platforms limit developers. https://t.co/XEp7NMfnfQ Read NetSPI's blog post to explore a reference design for a new BOF portable executable (PE) concept that bridges the gap between modern C++ development and memory-executable C2 integration.
4
58
195
@_dirkjan found one of the most severe vulnerabilities ever discovered in Microsoft Entra ID. One that could have compromised every tenant in the cloud. In this episode, we unpack the story, the stress, and the mindset behind responsible disclosure. 🔥 We dive deep into his
4
43
157
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ⤵️
specterops.io
Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.
5
308
650
Ah well, no BlackHat talk for me this year. Another time maybe...
6
2
36
I made a website that lets you generate VBA macro docs in your browser (using rust+wasm!): https://t.co/mAsZU22IJZ ^just for fun, inb4 "motw kills macros" etc. 😅
3
27
145
Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM. https://t.co/GC5wA2y3EO
github.com
Windows protocol library, including SMB and RPC implementations, among others. - trustedsec/Titanis
14
188
556
I'm SO hyped to finally make MSSQLHound public! It's a new BloodHound collector that adds 37 new edges and 7 new nodes for MSSQL attack paths using the new OpenGraph feature for 8.0!. Let me know what you find with it! - https://t.co/Hh089SaVOS - https://t.co/geO0HXTykf
6
215
628
Finishing off the week with a writeup of CVE-2025-0309 - Netskope Windows Client LPE This was one of the bugs we demo’d in our DEF CON #ZeroTrustTotalBust talk. Also releasing a NachoVPN plugin and our 🆙skope PoC. Details on the @AmberWolfSec blog: https://t.co/HJQCVbBpbk
1
55
157
Am I missing something with the Greenshot CVE-2025-59050 vulnerability? An 8.4 for something that is essentially self injection. Execution would have already need to have been achieved to exploit. I get it's unintended design, but an 8.4 CVSS?
1
1
9
3
7
43
After a break, I’ll be back to Black Hat EU 2025 to share new developments in call stack spoofing techniques and tradecraft. Likely my final public contribution to technique. Hope it'll inspire brilliant minds to build something great! See you there! #BHEU #offsec #SpecterOps
8
22
119
Lots of cool new Nemesis features merging in soon from @tifkin_ and I! Development definitely didn't stop with the 2.0 release :)
github.com
An offensive data enrichment pipeline. Contribute to SpecterOps/Nemesis development by creating an account on GitHub.
0
7
45
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog:
dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise...
143
906
3K
Are there any tailscale experts out there that can help debug why advertise-routes is failing on Fedora? IP forwarding is enabled and I have a valid route prior to bringing tailscale up, but it just won't publish the route. Routes are auto approved on headscale control plane 😕
0
0
0
Hey @Veeam, help a friend out here. A security@ email that only accepts emails from https://t.co/JallpKcK3j makes it difficult to report concerns.
veeam.com
Veeam ensures data portability with secure backup, rapid recovery, and freedom to move and manage data across cloud, virtual, and physical platforms.
0
1
6
Recovering Metadata from .NET Native AOT Binaries - Washi @washi_dev
https://t.co/MhFyey3KYs
blog.washi.dev
Ever seen a binary that looks like a .NET binary based on its strings, but .NET decompilers are not able to open them?
0
1
14
If you didn't find my Black Hat / Def Con slides yet, they are available on https://t.co/nTDAepwUXR . Also includes the demo videos where I use actor tokens from on-prem to access SharePoint online and get Global Admin.
dirkjanm.io
2
68
194
Extending AD CS attack surface to the cloud with Intune certificates, by @_dirkjan
https://t.co/iQ1lyiYg5E
dirkjanm.io
Active Directory Certificate Services (AD CS) attack surface is pretty well explored in Active Directory itself, with *checks notes* already 16 “ESC” attacks being publicly described. Hybrid certif...
0
29
117
Thanks to everyone who joined my DEFCON33 talk!🎉 For those of you who missed it and are interested in seeing how we can extract cleartext credentials and bypass MFA directly from the official Microsoft login page, I just uploaded the recording to YouTube: https://t.co/MoPQiKgesd
17
146
537
gpoParser, which I presented at #leHACK2025 and #DEFCON, is available here: https://t.co/sHgmiOrPCV It is a specialized utility designed to enumerate Group Policy Objects (GPOs) and identify potential security misconfigurations.
github.com
gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment. - synacktiv/gpoParser
4
167
498
The ADSyncCertDump tool is now part of the adconnectdump tools and can be used to extract SP credentials from Entra ID connect hosts. I will cover that during my BH/DC talks today and Friday! Tool is heavily based on Shwmae by @_EthicalChaos_
Since we now can use Entra ID connect sync with a service principal, I thought I'd look into the new security measures. On hosts without a TPM, we can dump the cert+key. On hosts with TPM (second picture) we can use the key to create an auth assertion for roadtx to req tokens.
2
99
269