Efrain Torres retweeted
keyeroo - Relay a coerced victim's NTLM authentication to LDAP and run an operation as that victim, even when the domain controller requires LDAP signing and is fully patched. github.com/grayhatkiller/key…
Efrain Torres retweeted
Hidden desktop a separate window station, it's own explorer shell, full GDI capture with optimization at 40-50fps. Keyboard/mouse input injected directly into the hidden session. App launching through COM shell automation. The real desktop never flickers. We are building and sharing with our students so they have a strong utility belt.🦇🟨🛠️
Efrain Torres retweeted
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Efrain Torres retweeted
卧槽,Linux有一个核弹级漏洞,只要VPS对公网开放就有可能被入侵
建议大家都检查一下自己的服务器有没有CVE-2026-98432,我检查了一下我的Dmit也存在这个问题,攻击者入侵成本极低。
可以让Codex登上服务器帮忙检查是否被CVE-2026-98432影响,并排查有没有入侵痕迹。
今天身边朋友有中招的,密钥也泄露了😅
Efrain Torres retweeted
1/ CVE-2026-98432, the remote Linux TCP bug: I reproduced it after just a few hours with a local LLM 🤯.
Here's the plain-English version of the bug & how it works ⬇️
(Obv. not sharing the exact exploit, but it's trivial to make)
Efrain Torres retweeted
Coercion BOF via IPP printers 🖨️ Useful for relaying HTTP —> AD CS, LDAP, etc.
GitHub Link: github.com/sudonoodle/BOF-co…
Efrain Torres retweeted
What if RustHound-CE v2.5.40 could collect Active Directory data over Active Directory Web Services (ADWS/SOAP)?
Just with -t adws?
#BloodHound #Rust #Pentest #ADWS
Efrain Torres retweeted
You can now coerce HTTP authentication from Windows targets that are running MS-RPRN, using impacket with PR #2361!
The PR added a new opnum from the MS-RPRN spec, OPNUM 88 and an example script to make the process straight forward. Letting you now coerce and relay HTTP authentication from remote machine targets
Shoutout to sudonoodle for the BOF that inspired this and for the technique(at least I think it was them who found it) :3
Efrain Torres retweeted
𝗕𝗹𝗼𝗼𝗱𝗛𝗼𝘂𝗻𝗱-𝘀𝘁𝘆𝗹𝗲 𝗮𝘁𝘁𝗮𝗰𝗸 𝗽𝗮𝘁𝗵𝘀 𝗳𝗼𝗿 𝗘𝗻𝘁𝗿𝗮 𝗜𝗗, in one read-only HTML file.
EntraHound: exposure score, 19 attack-path analyses, plain-English queries. Graph read-only, no Global Admin needed.
buff.ly/VhtH3VG
#EntraID
Efrain Torres retweeted
Active Directory - Timeroasting Users
While timeroasting usually applies to machines, domain admins can modify attributes of user accounts and temporarily convert a user account into a domain machine account. Then the DC returns hash for it.
The idea here is that DCSync and other noisy attacks are well known are often monitored, while this isn't
hackers-arise.com/powershell…
Bypassing SMB and LDAP signing with ntlmrelayx 🔥
I added both reauthentication bypasses to Impacket, now merged! Use –reauth-bypass on unpatched systems 🚀
LDAP can also start anonymously where accepted.
Research: blackfield.ch/blog/defeating… and specterops.io/blog/2026/10/2…
Efrain Torres retweeted
ADStrike
Using ADStrike to Compromise Active Directory
We used ADStrike with Qwen 2.5-Coder to orchestrate an attack on our Active Directory. It has all the common AD attacks and different levels of OPSEC modes with 52 attack modules integrated
hackers-arise.com/artificial…
@three_cube @_aircorridor
Efrain Torres retweeted
Karpathy 开炮了(前 OpenAI、前特斯拉 AI 负责人):
"Agent 不是魔法,是大规模蒸馏。你模型 99.99% 的容量,都浪费在它根本不需要的数据上。"
16 分钟对谈,他给出了真正有效的技术栈:小模型、正确的工具、一个闭环。
大模型 → 小模型 → 正确工具 → 闭环 → 自我改进的 Agent
别再为更大的模型交税了,让小模型变危险的,是闭环。
这 16 分钟,比今年任何 500 美元的 AI 课都值。看完再读"Harness, Loops, Graphs"——闭环就是那副马具 ↓
Microsoft Edge Full Chain with Logic Bugs Only (Pwn2Own Berlin 2026, @orange_8361)
blog.orange.tw/posts/2026-10…
#infosec
Efrain Torres retweeted
Alex Karp explains how to make yourself valuable when LLMs make general knowledge cheap:
He starts from the premise that AI has already changed what knowledge is worth.
"The thing about the commodity nature of LLM is it commodifies general knowledge."
If a model can hand anyone broad, general information, that information no longer sets you apart.
Karp says this matters most for one kind of person: the classically smart generalist.
He uses Yale as his example, and he says he picks it because it's strong.
"I like to pick on people who are strong. It's a very strong school."
He still recommends the top schools:
"There's a couple schools you should go to if you get into. Yale's one, Stanford's one. There's some schools you maybe should go to otherwise go to the cheapest school and come to [Palantir] or just come here."
His point is that the degree alone doesn't protect you. General intelligence without specific knowledge does not hold up well:
"If you are the kind of person that would have gone to Yale would have ear kind of classically high IQ um and you have generalized knowledge but it's not specific you're effed."
So how do you become valuable? Karp's answer is to build deep, specific domain knowledge, the kind of practical ability that general knowledge can't stand in for. He gives concrete examples:
"How do I actually bend the metal of the hull on a ship?"
"How do I actually write a script that allows me to target terrorists..."
"How do I put the cement in a factory with such precision that you can build a factory like it was built in Taiwan in America?"
He also describes someone with only a high school diploma who can diagnose what's going wrong in a complicated device that would otherwise need a Japanese engineer to fix.
Then he names the category plainly:
"How do I do anything with deep specific particularly voca what's considered vocational training?"
Karp says these are the people who will be rewarded:
"Those people are going to make a a lot more money simply because you can turn it any way you want, but at the end of the day, within a relative rapid amount of time, you will get paid downstream of the value."
安全大厂 TrendAI(趋势科技)顺藤摸瓜,直接扒出了黑客忘关的 3 个后台服务器(Open Directories),把真实的“AI 犯罪现场”底裤都看穿了——既让人后背发凉,又有点黑色幽默:
💥 真相1:真有黑客拿 44 个 AI 当“全自动打工人”
其中一个团伙直接把开源工具(CyberStrikeAI)改成了黑客流水线,一共跑了 44 个 AI Agent 分工干活:有的负责踩点、有的验证漏洞、有的偷数据、有的写总结报告,甚至还能自动生成地道的日文钓鱼网页!一口气扫了 19 家机构,全程几乎不用人管。
💥 真相2:AI 不仅当枪使,自己也成了猎物
另一个团伙是“老手+AI军师”模式,一口气扫了 6000 多个日本 IP。他们不仅偷传统企业数据,还专门盯着企业暴露在公网上的 AI 推理服务和 GPU 算力集群下手——用 AI 去偷别人的 AI,主打一个闭环。
💥 真相3:没有科幻片里的 0-day 神技,全靠“忘锁门”
这才是最扎心的!研究人员翻遍了黑客后台,发现这几波攻击一个 AI 挖出来的新漏洞(0-day)都没有!
那黑客是怎么得手的?全靠企业自己把管理后台裸奔在公网上、用着十年前的老旧 Web 系统、或者把密码明文写在配置文件里(比如日本遍地都是的雅马哈路由器)……
说白了:AI 确实把黑客撬门的速度提升了 100 倍,但被偷的依然是那些连门都不锁的人。
Efrain Torres retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
Efrain Torres retweeted
PHP2Shell update 🚀
13 → 56 perfiles.
5 → 30 con RCE.
Gracias a las aportaciones de la comunidad por ampliar la colección. Nuevos: stage-3 vessel 8.5.0–8.5.10, Debian 13/apxs2 y nginx+PHP-FPM.
github.com/devploit/php2shel…
Closing out #php2shell: a universal black-box PoC for PHP's session upload-progress bug. One pure-HTTP chain - arm the allocator, spray fake refs, leak the heap, beat ASLR, turn a destructor into system(). Verified blind on Debian 13 PHP 8.4.24, x86-64 + arm64: RCE as www-data.


































