Recently added an async ticket auto-renewal BOF to my tgt-monitor repo (github.com/jakobfriedl/tgt-m…). When the remaining ticket lifetime undershoots the specified threshold, a new TGT is requested and imported into the logon session.
I will be speaking about Async BOFs and Conquest at #BSidesVienna on June 27th.
cfp.bsidesvienna.at/bsidesvi…
There is another free ticket drop next week, so grab one if you're in the area and let's have a chat there!
Jakob retweeted
As promised, the final batch of #BSidesVienna tickets will be released on Wednesday, 17 June 2026 at 6 pm! Set your alarms, keep your browser open, and be ready to grab yours before they run out. tickets.bsidesvienna.at/7ea/ And we have our first schedule: cfp.bsidesvienna.at/bsidesvi…
ALT Meme image of an excited orange kitten with its mouth wide open. White text at the top says: “THE FACE I MAKE WHEN #BSIDESVIENNA TICKETS ARE AVAILABLE.”
Jakob retweeted
After “The Art of Evasion” @x33fcon I’m publishing NimSyscallPacker to the public. This is the most advanced public Packer/Loader I’m aware of:
github.com/S3cur3Th1sSh1t/Ni…
Created a variation of an async user logon monitor BOF. Supports monitoring logons to remote servers, as well as immediately saving access tokens in the token vault using an Conquest output handler. github.com/jakobfriedl/logon…
Implemented my own version of a port scanner as an Async BOF for Conquest, which scans for open ports in the background without blocking the agent. It also supports ranges and CIDR notation for targets and ports. github.com/jakobfriedl/async…
Currently looking for new ideas and use-cases for async BOFs with long-running/monitor-like functionality. Feel free to drop suggestions for me here in the comments!
Async BOF that monitors USB device connect/disconnect events, reports device information and performs actions on connected USB storage volumes. github.com/jakobfriedl/usb-m…
Jakob retweeted
It's official: #BSidesVienna 0x7EA will take place on 27 June 2026. The call for papers/workshops will be open soon. Thank you to all the sponsors who have offered their support to make this event possible at such short notice!
ALT Meme: Squirrel stands on its hind legs with front paws raised; text reads, "When you can finally share a secret #BSidesVienna."
Another day, another async BOF. With KeeLog, you can monitor KeePass instances and capture the master password as soon as its entered. github.com/jakobfriedl/keelo…
Jakob retweeted
Gone are the days of risking a Rubeus monitor run (even via the amazing BOF[.]NET by @_EthicalChaos_ ) in your conquest beacon. @virtualloc is crushing it!
github.com/jakobfriedl/tgt-m…
Been very interested in Async BOFs lately and implemented a few for use with Conquest. The first implements Rubeus monitor as a BOF and notifies when TGTs are collected. The second monitors for clipboard changes and returns them. github.com/jakobfriedl/tgt-m… github.com/jakobfriedl/clipb…
New Conquest Release! 👑
v0.2.0 features the following additions:
- SMB Listeners & Agents
- Powerful Python module system (examples: github.com/jakobfriedl/conqu…)
- New payload types: .dll, .svc.exe
- File and Process Browser
- Multi-client support
- ...
github.com/jakobfriedl/conqu…
I decided to open-source Conquest, the C2 framework i have been working on for the last couple months. It is fully written in Nim and has several features built-in, including:
- GUI client
- Custom communication protocol
- Malleable C2 profiles
- …
github.com/jakobfriedl/conqu…
Would you be able to provide a rough estimation on when the first wave of tickets will be available?
I've implemented a new project, which performs NTDLL unhooking from a suspended process by using indirect syscalls with the HellsHall technique. #maldev github.com/jakobfriedl/Indir…
After completing the beginner and intermediary modules on Maldev Academy, I created my first evasive shellcode loader. It executes a payload using mapping injection via direct syscalls with Hell's Gate and includes several anti-analysis features. github.com/jakobfriedl/Benev… #maldev
