Security person who likes writing code
Joined August 2020
- Tweets490
- Following211
- Followers935
- Likes1.5K
Matt Ehrnschwender retweeted
So the private-key for the eMudhra (revoked) intermediate was apparently 4.
How is the root still trusted? How broken are your processes if this can happen?
And honestly: How have we (as an industry) not noticed earlier :(
Matt Ehrnschwender retweeted
Open sourced my implementation of the Cobalt Strike UDC2 spec so more open source C2s can benefit from existing CS tooling
Adaptix PoC included with drop in support for existing UDC2s :D
github.com/CodeXTF2/OpenUDC2
Matt Ehrnschwender retweeted
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
praetorian.com/blog/wasmforg…
#wasm #malware #sliver
Matt Ehrnschwender retweeted
Some interesting new "Agent account model" APIs/structures in the current Canary build (28020).
Not exported anywhere yet - looks like the new "IsoEnvBroker.dll" calls 4 of them via NdrClientCall3 (RPC) to LSARPC:
- 146 (LsarCreateAgentAccount)
- 147 (LsarRetrieveAgentLogonCredential)
- 148 (LsarEnumerateAgentAccounts)
- 149 (LsarDeleteAgentAccount)
Matt Ehrnschwender retweeted
Had some fun making this credential dumper BOF implementing the Silent Harvest mechanism from @haider_kabibo . Thanks to him as well as @R0h1rr1m for his SilentNimvest implementation of the research!
github.com/Octoberfest7/Sile…
Matt Ehrnschwender retweeted
wiretap-rs is a Rust port of Wiretap, a transparent, VPN-like proxy server that tunnels traffic via WireGuard and requires no special privileges to run.
github.com/0xTriboulet/wiret…
Matt Ehrnschwender retweeted
I'm really proud of what Shane and I did here. I'm biased, but from the results I've seen, this is a hugely scalable way to improve offsec models.
It took a ton of engineering work to get it working, but the results speak for itself.
We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories.
See how @shncldwll and @0xdab0 did it: dreadnode.io/blog/worlds-a-s…
Matt Ehrnschwender retweeted
May I present to you; a full copy of doom, running inside of a Rollercoaster Tycoon 1 save game exploit ✨
Thanks for everyone that came to check out our @DistrictCon Junkyard talk! We had a lot of fun putting it together. (check the thread for slides / exploit)
Matt Ehrnschwender retweeted
AI-slopped a functional C2 for an app's Lua plugin (no stdlib Lua) in about 24hrs~
had to use the app-specific network libs provided to accomplish a transport.
Functions: change sleep, run more Lua in mem, module output, exit/uninstall - most of what u need on a longhaul persist
Matt Ehrnschwender retweeted
if anyone is too lazy to learn to use @M_alphaaa 's boflink and doesnt want to fight MSVC to stop using funny sections in your bofs, heres a drop in replacement for the TrustedSec BOF template that uses boflink (standalone) in the makefile
github.com/CodeXTF2/bof_temp…
Matt Ehrnschwender retweeted
stop using ubuntu 24.04 to host your kernel pwn challenges lmao
kqx.io/post/qemu-nday/
Matt Ehrnschwender retweeted
HEY EVERYONE. THE BLOG POST IS OUT.
I put an LLM in an AMSI provider and some cool stuff came out. Really excited to finally have this released.
"Offense and defense aren't peers. Defense is offense's child." - @JohnLaTwC
We built an LLM-powered AMSI provider and paired it against a red team agent. Then, @0xdab0 wrote a blog about it: dreadnode.io/blog/llm-powere…
A few observations from the experiment:
>>> To advance, we must generate unique, ground-truth datasets.
>>> Defenses will need to live at the edge.
>>> The real potential lies in the interaction between red and blue.
>>> This is a blueprint for generative adversarial reinforcement learning.
Matt Ehrnschwender retweeted
OffensiveLua is a collection of 20+ offensive security scripts written in Lua that perform red team operations through direct Windows API calls. The repo includes OffensiveLuaEmbedded.exe that embeds LuaJIT with advanced debugging capabilities. deepwiki.com/hackerhouse-ope…
Matt Ehrnschwender retweeted
Fork is now in a state where people can test and find all the edge cases in my shitty code.
./mythic-cli install git github.com/Flangvik/Apollo
Hit me with some issues so we can get this bad boy merged 😇
Matt Ehrnschwender retweeted
A few months ago I flew to New York to film in the Good Morning America studio, for a segment on the "grandparent scams" where bad actors use AI to impersonate family members and steal money. Last night it aired on @Nightline! 🥳 Incredible opportunity, thank you for having me!💙
Matt Ehrnschwender retweeted
If you couldn't make it to BH Aresenal 2025, this blog summarizes my work, and what the final POC looks like from the CS client 😎
New Blog: Based on his talk at Black Hat, @0xTriboulet discusses integrating Windows AI/ML APIs into Cobalt Strike’s workflows and presents proof-of-concept implementations for AI-augmented post-exploitation capabilities in Cobalt Strike.
ow.ly/8hSO50WWTSW
Matt Ehrnschwender retweeted
Lua: Watching Since the Beginning. 🌙👁️
2024–2025 reminded us that Lua isn’t just nostalgia:
Redis - CVE-2024-46981 & CVE-2024-31449 let authenticated users abuse the embedded Lua VM for RCE.
📎 redis.io/blog/security-advis…
OpenWrt LuCI - CVE-2024-51240 turned a Lua-driven web UI into an admin -> root escalator.
📎 openwall.com/lists/oss-secur…
Lua was the quiet conductor inside the stack: routers, firewalls, switches, caches.
It’s light, scriptable, everywhere — and adversaries know it.
Matt Ehrnschwender retweeted
It's worth noting, and maybe we understated this in the blog, but the only reason this was drawn to our attention (and the source of most of these artifacts) was due to the presence of numerous Defender alerts related to malware/attacker tooling either historically or currently executing on the host.
We have an obligation to triage and respond appropriately to tangible security threats. Collected artifacts were related to pertinent and tangible security threats on the endpoint.
Matt Ehrnschwender retweeted
Cookie theft has evolved. 🍪
Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities. ghst.ly/45S1ZgW
