Quang Vo

PIC Development Crash Course Some helpful content for writing position independent code.

Position Independent Code (PIC) Development Crash Course.

My July 2025 overview of PIC writing fundamentals.

Don't know why jump tables are bad? Got a __chkstk relocation error? Watch this video.

#GoodLuckAndHappyHacking

vimeo.com/1100089433/d...

ي

Potato exploits have been a cornerstone of local priv esc on Windows for years, but how & why do the inner starchy workings of the potatoes function?

Join @atomicchonk.bsky.social next week to understand Windows access tokens & their use in the Windows environment. ghst.ly/june-web-bsky

This is getting some attention today. Cool shellcode trick from:

My First and Last Shellcode Loader by @dobinrutis.bsky.social at HITB 2024.

H/T x.com/Jean_Maes_19...

Yo this is supercool

When James Forshaw post, you read 🫡

God tier resources for Windows Internal

codemachine.com/articles.html

Theodosius - Jit linker, Symbol Mapper, and Obfuscator Existing software protection frameworks typically operate at a small range of compilation levels. The highest level of obfuscation typically operates upon source code directly (source2source), the sec...

Good article about obfuscator
blog.back.engineering/06/05/2022/

Cobalt Strike Postex Kit The CS 4.10 update saw the introduction of the Postex Kit. This was a bit overshadowed by BeaconGate, which was also added in 4.10 (I wrote about this in my last post). The intention of this post is t...

[BLOG]
Today's post is all about Cobalt Strike's Postex Kit.
rastamouse.me/cobalt-strik...

Snowblind: The Invisible Hand of Secret Blizzard

Hack the other group’s c2 infra to use for your own campaign 👌. Interesting
blog.lumen.com/snowblind-th...

EDR Silencers and Beyond: Exploring Methods to Block EDR Communication - Part 1 For red teams and adversary alike it’s important to stay hidden. As many companies nowadays have EDR agents deployed those agents are always in focus and tools like EDRSilencer or EDRSandblast use…

🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent.
📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it.

And if you want even more, checkout part 2 released by @Cyb3rMonk Link in the post

UDRL, SleepMask, and BeaconGate I've been looking into Cobalt Strike's UDRL, SleepMask, and BeaconGate features over the last couple of days. It took me some time to understand the relationship between these capabilities, so the aim...

[BLOG]
This post summarises how to tie Cobalt Strike's UDRL, SleepMask, and BeaconGate together for your syscall and call stack spoofing needs.

rastamouse.me/udrl-sleepma...

Relaying DCOM has always intrigued me, so I decided to dive in. Started with a MiTM attack using a fake DNS entry, targeting certificate requests to an ADCS server and relaying to SMB.

Detailed articles about x64 assembly. Especially about how to unwind the stack and stack layout. Must read if you planning to implement stack spoofing 👌
codemachine.com/articles/x64...

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE.
Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

Dipping sweet potatoes into hummus is kinda goated tbh

GitHub - itm4n/PrivescCheck: Privilege Escalation Enumeration Script for Windows Privilege Escalation Enumeration Script for Windows - itm4n/PrivescCheck

🆕​ New PrivescCheck extended check!

ℹ️​ The script can now enumerate dangerous default file extension associations, such as '.bat' or '.wsh'.

⚠️​ A manual review of the result is always recommended, but for the most part, it should be fine.

github.com/itm4n/Prives...