@Crypt0s

Application security guy who dabbles in radios, networking, protocols…pretty much anything anyone puts in front of me to hack!

 Maryland, USA
github.com/Crypt0s
Joined July 2009
  • Tweets9K
  • Following896
  • Followers2.1K
424Media
Confused about DMR? Fustrated you can't get your hotspot configured? Need some help? Here is a quick tutorial: medium.com/@Crypt0s/how-to-u… #DMR #hamradio #brandmeister #mmdvm

How to Use DMR With MMDVM and the BTech DMR Handset

What Is DMR?

medium.com
1
1
3
1/12 It has been confirmed that the #Taurus interception was done via “a non-secure line”. Below is my opinion of one way in which it *might* have been done, taking into account the situation and #Russia's previous history. Essentially it involves using #SS7 interception. 🧵
10
100
20
325
120,086
Lenovo X1 Carbon Bitlocker Key Sniffing any% Speedrun (42.9 seconds)
59
788
90
4,147
555,020
Crypt0s retweeted
an0n@an0n_r029 Dec 2023
OST cannot be stopped. Here is a technique we tested internally 9 months ago: blocking EDR telemetry by leveraging the Windows Filtering Platform. Considered it so evil that we didn't publish it that time. It was pointless, now here it is by @netero_1010: github.com/netero1010/EDRSil…

GitHub - netero1010/EDRSilencer: A tool uses Windows Filtering Platform (WFP) to block Endpoint...

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server. - netero1010/EDRSilencer

github.com
11
263
7
860
125,762
Crypt0s retweeted
s1zz
@s1zzzz2 Feb 2024
Discovered and exploited an arbitrary file delete vulnerability that lead to SYSTEM level privileges. Thanks to the goat @filip_dragovic.
7
28
3
153
21,066
1
98
interesting recent UAC bypass method zcgonvh.com/post/Advanced_Wi…
2
68
211
41,406
The best thing about generative AI is that I hear far far less about Web3 bullshit
2
145
Are we really not supposed to double space after a period anymore???????
3
1
205
Crypt0s retweeted
dragosr
@dragosr7 Jul 2023
Red, Blue, and Purple LDAP Queries. Quite useful. politoinc.com/post/ldap-quer…

LDAP Queries for Offensive and Defensive Operations

The intention of this post is to provide basic queries for targeted AD DS information gathering used in penetration testing. The reader can

politoinc.com
4
9
1,644
Very cool explanation of CANbus theft technique
This Post is from an account that no longer exists. Learn more
176
New blog: Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust I teased this a bit during my Windows Hello talks, now found some time to write about this interesting technique. Also contains defenses and detection opportunities. dirkjanm.io/obtaining-domain…

Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust

Many modern enterprises operate in a hybrid environment, where Active Directory is used together with Azure Active Directory. In most cases, identities will be synchronized from the on-premises...

dirkjanm.io
8
328
5
770
90,698
A certificate reseller bypassed the HTTP verification of the ACME cert protocol by using a remote code injection in ACME.sh to write their own When called out they are surprised Pikachu and say they didn’t know what an RCE was before this. 😬
Ryan Castellucci@ryancdotorg14 Jun 2023
🍿🍿🍿 CA dId NoThInG wRoNg (they built a product around an 0day in a certificate management tool, got caught, and I'm hoping this results in a root CA being incinerated because that would be funny) groups.google.com/a/mozilla.…
109
27
838
62
7,140
538,470
Replying to @cybergibbons
I'd be pretty interested see how it fares with my new SDR Bluetooth sniffer and a bladeRF. Can it perform all-channel sniffing in real time? Benchmark with ice9-bluetooth -s -f /dev/urandom github.com/mikeryan/ice9-blu…

GitHub - mikeryan/ice9-bluetooth-sniffer: Wireshark-compatible all-channel BLE sniffer for bladeRF,...

Wireshark-compatible all-channel BLE sniffer for bladeRF, with wideband Bluetooth sniffing for HackRF and USRP - mikeryan/ice9-bluetooth-sniffer

github.com
1
1
3
168
It’s like nobody has ever tried to execute a docker container inside of an existing network namespace before
89
Clean Windows using Linux 😛
34
115
13
997
60,400
Great thread on the 300+ drones lost a day figure being generated as an approximation from UKR staff. They buried another lede here though! “Russian EW is…achieving real time interception and decryption of Ukr Motorola 256-bit encrypted…comms” RU stole and dumped radios!
Jack Watling@Jack_Watling19 May 2023
Replying to @Jack_Watling
Today my colleague Nick Reynolds and I published ‘Meatgrinder: Russian Tactics in the Second Year of Its Invasion of Ukraine rusi.org/explore-our-researc… In which we report that the AFU are losing 10,000 UAVs a month. 2/17

Meatgrinder: Russian Tactics in the Second Year of Its Invasion of Ukraine

Russian tactics are changing as lessons are learned from military failures in the war in Ukraine.

rusi.org
1
140
It isn’t likely that they have some sort of Uber-leet exploit in the radio or the encryption itself - these radios aren’t likely hardened against an attacker dumping the radio contents, including any encryption keys. Reprogramming radios in the field is hard, so stolen keys last
59
Crypt0s retweeted
KF
@d0tslash5 May 2023
"Espressif ESP32: Bypassing Encrypted Secure Boot (CVE-2020-13629)" raelize.com/blog/espressif-e…

Espressif ESP32: Bypassing Encrypted Secure Boot (CVE-2020-13629)

Bypassing the ESP32's encrypted Secure Boot and Flash Encryption with a single EM glitch to extract plain-text flash, abusing SRAM persistence (CVE-2020-13629).

raelize.com
2
3
6
858
Not for a hot minute tho right? Like part of fuzzing could be the AI can generate the test harness but that’s a far cry from current “coding ability” of AI I’ve seen so far. And web is such a hot mess of different stuff… Maybe in 2-3 years?
JS0N Haddix
@Jhaddix25 Apr 2023
Replying to @Jhaddix
Generative AI aided fuzzing will lead to more binary and web exploits. Both defense and offense will benefit from this.
99
Load more