Antonio Cocomazzi

splintercode.bsky.social

13 December 2024 16:23

@decoder-it.bsky.social and i noticed that it's no more possible to call NtLoadDriver pointing to an unprivileged regkey such as \REGISTRY\USER Even if you have the SeLoadPrivilege you would still require the Admin group to write the required regkey. Some more technical details below 👇

Antonio Cocomazzi

splintercode.bsky.social

25 November 2024 18:34

Insane work 🔥

nodauf.bsky.social

20 November 2024 15:15

Interesting blog post from Synacktiv on relaying kerberos over smb (based on the work of @decoder-it.bsky.social and @tiraniddo.bsky.social ) www.synacktiv.com/publications...

Antonio Cocomazzi

splintercode.bsky.social

15 November 2024 09:42

This MemProcFS has a lot of potentials. I have seen it also abused by some ransomware operator to dump lsass. If you see the loading of such drivers and aren’t commonly used in your environment then you should set some alerts based on that.

Clément Labro

itm4n.bsky.social

14 November 2024 08:11

🆕 New blog post! "Exploiting KsecDD through Server Silos" In my latest mini research project, I've been working with my teammate @PMa1n (X) on extending the work of @floesen_ (X) on the KsecDD driver. I'm thrilled to finally share the results. 👉 blog.scrt.ch/2024/11/11/e...