Security Engineer | Gamer
Nairobi, Kenya
Joined April 2013
- Tweets3.3K
- Following403
- Followers1.3K
- Likes10K
Gabriel retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Gabriel retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Gabriel retweeted
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
Gabriel retweeted
Hello
Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
Gabriel retweeted
‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub.
The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream.
But the fix was never labelled a security fix, so nobody treated it as urgent.
Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com.
Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them.
And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub.
To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code.
OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty.
The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit.
Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.
Gabriel retweeted
In offsec, we all have our favorite attack paths. For me, I commonly abused the highlighted items below in addition to netNTLMv2 authn downgrade, ACL attacks, harvesting hashes to crack offline, and relaying.
We all have different experiences. With kerberoasting, I was never able to crack the passwords because orgs already made them strong. I never saw ASREP roasting once and tested for it every single time. I never had to exploit unconstrained delegation although I've seen it several times - there were always easier ways.
The things that would have stopped me most:
1. SMB signing enforcement,
2. unprotected credential cleanup,
3. certificate authority configs and template configs,
4. machineaccountquota set to zero,
5. 15+ character passwords
6. most importantly, TIERING.
Gabriel retweeted
For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how…
Jerry Devore’s awesome series on Active Directory hardening.
Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege
Links for each one👇
techcommunity.microsoft.com/…
Gabriel retweeted
Great article summarizing some of the attacks I've been avising on for a few years now.
Attack: AITM
Defense: Managed device and/or phishing resistant authentication with no fallback. The former is "easier".
Attack: Device Code Phishing
Defense: Entra CAP. Named locations for required exceptions.
Attack: Illicit Consent
Defense: Require admin consent and train admins well
Attack: Authorization Code Flow Phishing
Defense: Managed device, Entra CAP for Azure Resource Management API, SASE URL filtering with UEBA
Attack: Consent Fix family or attacks (ClickFix, FileFix, DownloadFix, TerminalFix)
Defense: Managed device with custom EDR blocks/containment and playbooks for dropped infostealer cleanup. SASE URL filtering with UEBA
I'll add:
Attack: Teams based phishing
Defense: Managed device with custom EDR blocks/containment and playbooks for dropped infostealers, RMM, post-exploitation tools, C2 agents. Teams ZAP. B2B. Block incoming messages from unmanaged clients.
Nothing in the post is about post-incident response and containment.
These basic controls will take you a very long way. Are they perfect? No. No control ever is. But they will mitigate a lot of threat surface and risk.
Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques, by @Insinuator
insinuator.net/2026/08/token…
Gabriel retweeted
ItsNotAlwaysSMB: DPAPI in other protocols🔥
SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑
ALT Dumping DPAPI secrets via WinRM, MSSQL and WMI
ALT Dump various credentials using DPLoot
Gabriel retweeted
The cybersecurity section of this report is wild. APT operators used Claude for nearly everything: coding tools, testing against security products, building capture platforms, and processing victim data. Its like Anthropic was looking over their shoulder!
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Gabriel retweeted
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Gabriel retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
Gabriel retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
Gabriel retweeted
If you're new to exploit development, reverse engineering or vulnerability research, bookmark this before buying another course.
Blackstorm Security has published 1,600+ pages of research for FREE.
Windows kernel exploitation.
Driver reversing.
Patch diffing.
Chrome / V8 / WebAssembly.
Hyper-V.
macOS / iOS internals.
Modern mitigation bypasses.
Real CVEs taken from root cause to working exploitation.
Their CVE-2024-30085 series alone spans hundreds of pages and multiple exploitation strategies.
This is the kind of material that teaches you how vulnerability researchers actually think, not just how to run tools.
19 research papers. 1,657 pages. Free.
Start here:
blackstormsecurity.com/resea…
Author: @ale_sp_brazil
Focus on the techniques not the tools (X64DBG, GHIDRA/IDA, WINDBG, GDB GEF)
#ExploitDevelopment #ReverseEngineering #VulnerabilityResearch
Gabriel retweeted
GPOHound - Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data
github.com/cogiceo/GPOHound
Gabriel retweeted
From an analyst perspective, ransomware late-stage intrusions gets f-ing boring fast. I’ve analyzed a billion of those.
Same pattern for years now.
ADFind → BloodHound → Impacket/RDP → find data → Rclone → done.
Don’t get me wrong, boring ≠ ineffective. It clearly works.
But if you want to learn new execution and evasion tradecraft, spend more time investigating initial access malware and infostealers.
Gabriel retweeted
Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.
Now you can. Enjoy!
netspi.com/blog/technical-bl…
Gabriel retweeted
Your browser is a C2 agent waiting to happen.
@KingOfTheNOPs shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access.
Read more 👇 ghst.ly/4g8AZif
Gabriel retweeted
Babe, wake up. Someone finally dropped a sick macOS/Linux implant.
minorimpact.dev/posts/dark-a…