A practical NTLM relay attack using the MS-EVEN RPC protocol and antivirus-assisted coercion https://github.com/Thunter-HackTeam/EvilentCoerce

FYI if you’re willing to link with ntdll or dynamically resolve it there’s a ton of APIs that return TEB/PEB or leave them in one of the registers.
(Don’t believe official return values. MSDN is a liar!)

https://bird.makeup/@vxunderground/1920208595808821334

Today 80 years ago Nazi Germany declared its unconditional surrender, ending the World War II.

#VictoryDay

How I ruined my vacation by reverse engineering [Windows Security Center]

https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/

Defender disabler tool:

https://github.com/es3n1n/defendnot

Recon training prices go up beginning of May! If Linux binary analysis and malware are down your alley, check out my 4-day training on the topic 🤓
https://recon.cx/2025/trainingLinuxMalwareReverseEngineering.html

[RSS] CVE-2024-11477- 7-Zip ZSTD Buffer Overflow Vulnerability - Crowdfense

https://www.crowdfense.com/cve-2024-11477-7zip-zstd-buffer-overflow

[RSS] exploits.club Weekly Newsletter 71 - Lots Of Linux, MacOS OOB Writes, Enterprise Pre-Auth RCEs, and More

https://blog.exploits.club/exploits-club-weekly-newsletter-71-lots-of-linux-macos-oob-writes-enterprise-pre-auth-rces-and-more/

New Project Zero issue:

XNU VM_BEHAVIOR_ZERO_WIRED_PAGES behavior allows writing to read-only pages

https://project-zero.issues.chromium.org/issues/391518636

CVE-2025-24203

It makes me super uncomfortable that globbing in Bash can turn into code execution. The fact that the name of a file can change the behavior of ls is scary. This also works for other commands that you tend to glob with, such as rm.

Overview of Map Exploitation in v8 by @nyaaaaa_ovo

https://xia0.sh/blog/visit-the-map/visit-the-map

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓

https://sam4k.com/page-table-kernel-exploitation/

#shitpost

While we wait, here's a quick look at the web traffic currently hitting Wikimedia projects — can you perhaps guess when the reports of white smoke from the Vatican first started?

Tariffs just got real: our first $36K bill with 125% + 20% + 25% markup hits hard 💸. These are upfront costs - due before selling a single unit - causing serious cash flow strain, price increases, read more! 📦 http://adafruit.com/tariffbill

#tariffs

Wikipedia @wikimediauk are going to court over the UK Online Safety Act!

Saddling platforms with hefty duties and penalties under the new regime will cause many safe sites to fold.

We can't lose the best of the web due to laws that were meant to tackle the worst of it.

#SaveOurSites

https://www.bbc.co.uk/news/articles/c62j2gr8866o

#OnlineSafetyAct #OSA #NetPlurality #ukpol #ukpolitics #wikipedia #freedomofexpression

This post by @algernon is a surprising confirmation of one of my theories about why many of "us" aren't really impressed by #LLM's:

https://chronicles.mad-scientist.club/tales/conversations-with-an-artificial-intelligence/

Thing is, we've seen this before, played with it, found its limits and got bored. Of course LLM's provide much better results, but I still don't think the underlying principle is that much different.

Same with shitcoins: we designed a proof-of-work system as teenagers for password cracking, so the principle is not magical to us and this goes against the marketing.

Microsoft Copilot for SharePoint just made recon a whole lot easier. 🚨
 
One of our Red Teamers came across a massive SharePoint, too much to explore manually. So, with some careful prompting, they asked Copilot to do the heavy lifting...
 
It opened the door to credentials, internal docs, and more.
 
All without triggering access logs or alerts.
 
Copilot is being rolled out across Microsoft 365 environments, often without teams realising Default Agents are already active.
 
That’s a problem.
 
Jack, our Head of Red Team, breaks it down in our latest blog post, including what you can do to prevent it from happening in your environment.
 
📌Read it here: https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/

#RedTeam #OffSec #AIsecurity #Microsoft365 #SharePoint #MicrosoftCopilot #InfoSec #CloudSecurity

CVE-2025-21756: Attack of the Vsock

Michael Hoefler published an article about exploiting an incorrect reference counter decrement causing a UAF in the vsock subsystem.

With advice from h0mbre, the researcher used brute force to bypass KASLR and hijacked the control flow for LPE.

https://hoefler.dev/articles/vsock.html

Really hoping that the title of the W3C's position paper "Third-Party Cookies Must Be Removed":

https://w3c.social/@w3c/114432468864338537

... is a deliberate echo of "Carthage must be destroyed":

https://en.wikipedia.org/wiki/Carthago_delenda_est

The AWS team published a key-committing variant (https://eprint.iacr.org/2025/758.pdf) of XAES (https://words.filippo.io/xaes-256-gcm/)!

Still FIPS-compliant, and with a proof.

Key commitment ensures the ciphertext can only be decrypted with one key, to avoid issues in higher-level protocols.