Red Team Operator @BHinfoSecurity #HackThePlanet APT-C-40 #Father - Married to @N1N4011 #Fishing #WeightLifting #CombatVeteran
Joined June 2017
- Tweets7K
- Following3.8K
- Followers2.4K
- Likes28.1K
C💥🖥💥 retweeted
keyeroo - Relay a coerced victim's NTLM authentication to LDAP and run an operation as that victim, even when the domain controller requires LDAP signing and is fully patched. github.com/grayhatkiller/key…
C💥🖥💥 retweeted
🔥 Want to learn AI Red Teaming for FREE?
AI Red Team Academy offers 60+ hours of learning across 8 modules, with hands-on Docker labs.
Explore prompt injection, RAG attacks, AI supply chains, multi-agent exploitation and more.
🔗 0x4d31.github.io/airt/
C💥🖥💥 retweeted
Bypassing SMB and LDAP signing with ntlmrelayx 🔥
I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀
LDAP can also start anonymously where accepted.
Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
C💥🖥💥 retweeted
Bypassing SMB signing enforcement🔥
@aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀
1/3🧵
ALT The SMB re-authentication bug and the corresponding NetExec module for enumerating the vulnerability
C💥🖥💥 retweeted
Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2, and Redirectors. github.com/pho5nix/Red-Team-…
C💥🖥💥 retweeted
notRDP - A Havoc C2 plugin that creates an invisible alternate Windows desktop, streams it to a browser-based viewer, and supports full mouse/keyboard interaction like RDP, but invisible to the target user github.com/dagowda/notRDP
C💥🖥💥 retweeted
After a remote assistance session, a VPN client sits in your user's AppData. 14 of its 19 files are genuine and signed.
Hash sweep returns the fleet. Allowlist says trusted. Then read this. activesoc.blackhillsinfosec.…
C💥🖥💥 retweeted
Iraq 2003. I'd rather show pictures of turtles, whales, and sloths these days but, this is a good reminder of the evil out there. Try not to be evil.
C💥🖥💥 retweeted
No BloodHound? No PowerView? Query AD yourself.
SpecterOps posts break down manual LDAP enumeration with dsquery/ldapsearch, covering filters, group nesting, SPNs, UAC bitmasks, trusts, and cross-domain relationships. Know LDAP, know AD.
- specterops.io/blog/2021/06/0…
- specterops.io/blog/2024/05/0…
C💥🖥💥 retweeted
Releasing passthecert-rs v1.0.0 🦀 🔥
Pass-the-Certificate in pure Rust. 🔐
The initial goal is to bring certificate-based LDAPS auth (PFX or CRT+KEY) to RustHound-CE for the collection phase. It then grew into a full PassTheCert-style toolkit.
Link: github.com/g0h4n/PassTheCert…
C💥🖥💥 retweeted
ntlmrain - Recover NT hashes from NetNTLMv1 responses using local WebGPU computation and local/remote table lookup github.com/outflanknl/ntlmra…
C💥🖥💥 retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
C💥🖥💥 retweeted
Building a Detection Foundation, by @Carlos_Perez
Part 1 The Single-Source Problem trustedsec.com/blog/building…
Part 2 Windows Security Events trustedsec.com/blog/building…
Part 3 PowerShell and Script Logging trustedsec.com/blog/building…
Part 4 Sysmon trustedsec.com/blog/building…
C💥🖥💥 retweeted
Attacking SAM and Extracting Hashes With 7z
7z can be used to copy system hives bypassing EDR. We extracted NTLM hashes from the SAM hive.
Together with DeadMatter you can extract all user credentials
hackers-arise.com/digital-fo…
C💥🖥💥 retweeted
Updated PoC to get SYSTEM privileges with named pipe impersonation.
I add a new method using scheduled tasks for named pipe client connection
github.com/daem0nc0re/PrivFu…
C💥🖥💥 retweeted
Pirate from @hackthebox_eu is an AD assume-breach box: pre-Windows 2000, gMSA password, NTLMv1 coerce-and-relay for RBCD, and SPN-jacking to impersonate the domain admin. Unintended path using RemotePotato0 to cross-session relay.
0xdf.gitlab.io/2026/09/05/ht…
C💥🖥💥 retweeted
VMkatz. Extract Windows credentials directly from VM memory snapshots and virtual disks, by @Nikaiw
github.com/nikaiw/VMkatz
C💥🖥💥 retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
C💥🖥💥 retweeted
🚨 another potato just dropped
CouchPotato: SeImpersonate → SYSTEM
ETW + AMSI patched. indirect syscalls.
service account or admin → NT AUTHORITY\SYSTEM
github.com/aaron-kidwell/Cou…
#ADSecurity #ExploitDev #InfoSec
C💥🖥💥 retweeted
Blending malicious actions into legitimate .NET application with DirtyCLR.
Maintaining a completely clean thread call stack and execution flow.
A post by Petar Jr. Pranic (@ipSlav )
Source: github.com/ipSlav/DirtyCLR
#redteam #blueteam
