Cr0Eax retweeted
eMudhra key leaks impact Android's Factory Reset Protection (FRP), thanks to the generous GMS sign-in interface.
TL;DR: Inject mm.setContentFilters('{"user_setup_complete":1, "device_provisioned":1}'); on server JS responses with `mitmproxy --emudhra` and reboot, bypassing SUW. Then, flip system_server's mFrpActive with any N-day to leak the secret and wipe FRP.
Demo below. Full chain private for obvious reasons.
Cr0Eax retweeted
We’ve published our analysis of CVE-2026-97798, a Windows Faultrep TTD option-injection vulnerability discovered and reported by Diffract. It allowed a standard user to execute native code as SYSTEM through a trusted broker.
Technical details and demo:
diffract-ai.com/research/cve…
Cr0Eax retweeted
It's the largest release ever from #Microsoft. Again. And a big update from Adobe, too. Join @dustin_childs as he breaks down over 1,400 (that's not a typo) CVEs from Msft. He reads them all so you don't have to. zerodayinitiative.com/blog/2…
Cr0Eax retweeted
Interesting
beaksec.github.io/posts/tele…
Cr0Eax retweeted
I made this small application for the Steam Frame that lets you easily switch between RGB and monochrome passthrough, or between fully translucent and opaque passthrough, straight from your controllers!
No more digging through menus or unplugging cameras!
vrdev.net/projects/frame-pas…
Cr0Eax retweeted
Sliver supports BOF/COFF execution on macOS, Linux, and Windows on 386/amd64/arm64
Added cross-platform support to some of @TrustedSec's excellent CS-SA BOFs:
github.com/sliverarmory/CS-S…
Updated docs
sliver.sh/docs/?name=Cross-p…
Supported in current release v1.7.7 just "armory update"
Cr0Eax retweeted
notRDP - A Havoc C2 plugin that creates an invisible alternate Windows desktop, streams it to a browser-based viewer, and supports full mouse/keyboard interaction like RDP, but invisible to the target user github.com/dagowda/notRDP
Cr0Eax retweeted
I went ahead and put up the Hall of Fame for this year, even though the contest just started. flare-on.com/hof.html #flareon13
Cr0Eax retweeted
22 Windows LPE reported by one of my colleagues at @Seasecresponse .
This data should not be in any public dataset so if you plan to do any fine-tuning it would be helpful we hope.
All credit goes to him.
drive.google.com/drive/folde…
Cr0Eax retweeted
I have literally two CVEs over the last decade with the same bug, in the same place, again, and again (and ten other researchers have ten more). It’s insane. When I still taught seminars I used to tell my classes “just scan memory for kernel pointers each build”.
Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC.
github.com/karollooool/CVE-2…
Cr0Eax retweeted
📢 IDA 9.4 is here!
Huge thanks to our beta testers for spending the last several weeks refining this release.
• The Apple Dyld Shared Cache workflow has been rebuilt from the ground up.
• The decompiler now speaks Swift, with proper ABI modelling for self, async context, and error paths.
• Two new processor modules land — Qualcomm Hexagon and MCore.
• Navigation gets a major upgrade with Pathfinder and a redesigned Jump Anywhere.
• The Teams add-on now runs on Git.
• And idalib, previously Pro-only, now ships with IDA Home.
👉 Read the blog for the full breakdown and/or jump ahead to the release notes, then grab your update in the Download Center.
hex-rays.com/blog/ida-9.4-re…
Cr0Eax retweeted
First post in the series: a quick explanation of the PreviousMode mitigation added in 23H2: windows-internals.com/random…
Cr0Eax retweeted
It was a great opportunity to give a talk with @kai6u at #SOCON2026 !
Thank you all we had the chance to talk with, and @SpecterOps for having us.
The slides from our session have been uploaded here for anyone interested.
github.com/temp43487580/temp…
Cr0Eax retweeted
RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.
Hope you enjoy the blog & tool drop 🤟
ibm.com/think/x-force/remote…
Cr0Eax retweeted
Wow, we can't believe you remembered the 2-weekiversary of the 4.11 release! Let's cut the cake and celebrate the novel Sleepmask, a novel process injection technique, new prepend reflective loader with new evasive options, asynchronous BOFs, and more!
cobaltstrike.com/blog/cobalt…
Cr0Eax retweeted
As promised... this is Loki Command & Control! 🧙♂️🔮🪄
Thanks to @d_tranman for his work done on the project and everyone else on the team for making this release happen!
github.com/boku7/Loki
Cr0Eax retweeted
🚀 New Blog & PoC: Abusing IDispatch for COM Object Access & PPL Injection
Leveraging STDFONT via IDispatch to inject into PPL processes & access LSASS. Inspired by James Forshaw's research!
🔍 Blog: mohamed-fakroud.gitbook.io/r…
💻 Code: github.com/T3nb3w/ComDotNetE…
Cr0Eax retweeted
RedEDR: Collect Windows telemetry for Malware Development github.com/dobin/RedEdr #redteam
