Active Directory759 Domain Credential Dumping via File Handle Redirection
S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
oxfemale·
Sep 14·
15 min
·759
// September 2026
31 postsActive Directory759 
Machine Learning405 From P-Code to GNN: Extracting Binary Code Semantics
Quarkslab’s pcode_graph lifts functions to Ghidra P-Code CDGs and a GINE embedding that matches GMN (AUC 0.87 XM) on Cisco-Talos, across ISA,…
oxfemale·
Sep 14·
15 min
·405
Android684 Bypassing Android Hardware Attestation from the Analyst’s Chair
Quarkslab shows Android hardware attestation end to end, then a Frida relay: a clean phone signs the backend nonce, the rooted analysis…
oxfemale·
Sep 11·
25 min
·684
Cisco596 CVE-2026-20093: Unauthenticated Admin Reset on Cisco IMC
CVE-2026-20093 is a CVSS 9.8 pre-auth password change on Cisco IMC via configConfMo/aaaUser. Lab notes unpack HUU 4.3.2.250063 vs 4.3.2.260007: nginx /nuova,…
oxfemale·
Sep 11·
13 min
·596
kernel424 Process ID Mutation via BYOVD: Making Sysmon Blame Notepad
Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad. PspCidTable still…
oxfemale·
Sep 11·
29 min
·424
Bluetooth480 Caeruleus: BLE Security Testing Without the Scavenger Hunt
Praetorian's Caeruleus is one Go binary on Linux/BlueZ that replaces hcitool, gatttool, bettercap BLE, and throwaway Bleak scripts: scan, enumerate, assess unpaired…
oxfemale·
Sep 11·
19 min
·480
kernel1.1k From Job Offer to Ring 0: Lazarus, CVE-2026-68820 and FudModule 3.1
Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
oxfemale·
Sep 11·
28 min
·1.1k
Exploit Development705 KERAT: Static Detection of Kernel TOCTOU Bugs Caused by Races
USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real…
oxfemale·
Sep 10·
34 min
·705
Active Directory405 Manual LDAP Querying, Part 2: Nested Groups, UAC Bits, Trusts, and Foreign SIDs
Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema…
oxfemale·
Sep 10·
22 min
·405
Active Directory337 Manual Active Directory Querying with dsquery and ldapsearch
When BloodHound and PowerView will not load, Active Directory is still a phone book. Hope Walker's SpecterOps lab shows how to query…
oxfemale·
Sep 10·
31 min
·337
Cisco441 CVE-2024-20356: Jailbreaking a Cisco Email Appliance to Run DOOM
Aaron Thacker jailbroke a Cisco C195 ESA by splicing a newer BIOS so CIMC came online, exploiting command injection in expRemoteFwUpdate (CVE-2024-20356)…
oxfemale·
Sep 9·
24 min
·441
iOS Security428 How Can You Not Be Romantic About UNIX Domain Sockets: A 40-Year Kernel Bug From the DEF CON Stage
Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the…
oxfemale·
Sep 9·
18 min
·428