Security Review #322

Process Parameter Poisoning (P3) is an attack technique we developed that is used to inject code in foreign processes, without triggering typical detection mechanisms. Its ability to fly under the radar has been tested against four market leading Endpoint Detection and Response (EDR) solutions. Code injection succeeded in all cases and no alerts were created, even though the EDRs were configured to detect, block and remediate.

To build a defensible chain for malicious use of an unauthorized drive, you typically correlate multiple layers: identify the device in the Registry, bound connection time using per-device timestamps and event logs, associate storage identity using a stable pivot, and then demonstrate interaction using file system artifacts. This correlation reduces ambiguity and produces a timeline that is less likely to be disputed than any single artifact in isolation.

Bring Your Own Trusted Caller (BYOTC) is a technique that obtains code execution inside the user-mode program a driver already trusts, then make it invoke the privileged interface. The authorization check succeeds, but its security meaning has been lost. BYOTC is therefore a confused-deputy problem at the user/kernel boundary.

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

We discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools, data, and connected apps available to that session.

Threat actors can abuse the Windows Security Center (WSC) API to disable Windows Defender protections by faking the registration of an antivirus product. The technique enables threat actors to degrade the security on endpoints without generating the usual tampering indicators or introduce a driver.

Using proven techniques and practices and based on real experiences, this article will help to identify, exploit, detect and remediate SCOM vulnerabilities in the environments you assess and protect, while demonstrating attack paths, tools and techniques that you'll need to defend against.

A practical guide to securing JSON Web Tokens for developers who use a JWT library. Covers the six things you still have to get right yourself: pinning the algorithm to stop the none and algorithm confusion attacks, using a strong secret, always setting and verifying an expiry, supporting secret and key rotation, logging verification failures, and running a canary to catch silently broken signature checks.

In this first post of the series, we discuss how AWS plain text access keys enable an attacker to map the target account's infrastructure, access potentially sensitive data, and perform actions that are logged by CloudTrail but may go unnoticed if not monitored.

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in telemetry.

An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user. You never get the permission prompt.

We investigate how Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.

Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution.

A technical walkthrough of a new offensive technique that activates the Chrome Debugging Protocol directly in memory, bypassing Google's -remote-debugging-port mitigations. Covers chrome.dll signature scanning, DevToolsSocketFactory vtable reconstruction, PartitionAlloc constraints, and Special APC-based shellcode injection into the Chrome parent process.

Deep dive on chaining three FreeRDP bugs to achieve RCE with Gnome Remote Desktop by popping a remote shell with some old school memory corruption shenanigans.

We turned turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.

Remix routing discrepancies allow bypassing authentication checks by requesting the .data endpoint, which returns loader data - including sensitive account information such as email and API key - even when the parent route or Express middleware returns 401/403.

We discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. It works by injecting malicious code into Magento's template system. By using the styles properties, it can evade existing safeguards. It works in two stages: inject PHP code - for example by generating a failure report, let Magento execute the poisoned code via a failed payment email.

In this post, I introduce a novel technique to finally break free from SQLite’s magic bytes and almost the entirety of its database header. It relies on writing ELF shared objects and leads to code execution in Python, Ruby, and Node.js using the sqlite_dbpage virtual table.

We found that SentinelOne Agent easily stores its key assets using only a static 11-byte XOR key, an embedded RC4 key, and a simple XOR-0xFF transform, enabling offline decryption with minimal effort. This exposes the full detection policy, trust allow-lists, and a behavioral model that bases its verdict on a single feature, compromising the confidentiality of the EDR's detection logic.

We delve into Continuous Access Evaluation (CAE), an event-driven mechanism in Microsoft Entra ID that enables near-real-time revocation of self-contained JWT access tokens, which otherwise remain usable for their full lifetime even after account disable or refresh-token revocation.

This is the story of how a seemingly minor parsing flaw exposed a deeper lesson in secure system architecture, trust boundaries, and the danger of components disagreeing about what a request actually means.

We introduce a prompt-crafting technique for bypassing quick LLM-based policy checks - using plain English (no emojis, base64, invisible formatting, etc.) This technique is itself not a jailbreak, but it can be combined with one by using a jailbreak prompt as the payload.

This blog aims to dig into the fundamentals of Azure RBAC and privilege escalation, Attribute Based Access Control (ABAC), and how focusing on individual permissions can uncover privileged attack paths. That's how we discovered a built-in role that could have allowed arbitrary privilege escalation to Owner through unconstrained role assignment.

Technical detail of a heap buffer overflow vulnerability in a DCOM service that can be leveraged to achieve LPE from a Medium IL standard user to System IL.

Active Directory Rights Management Services still ships in Windows Server 2025, and it remains fully supported on-premises. In this first part pf the series, we map the AD RMS trust model and show how to discover an RMS deployment, fingerprint an AD RMS-protected file, and trace the path to that certificate's private key.

We discovered an unauthenticated arbitrary code execution vulnerability in ArgoCD's repo-server component, potentially allowing full cluster compromise. This article explains how the vulnerability was identified using CodeQL, details the exploitation process to gain control over the underlying Kubernetes cluster, and introduces a tool for automating the attack.

In this walkthrough, I analyze a Windows x64 executable named SystemOptimizer.exe. What initially appears to be a relatively small Windows executable turns out to contain an interesting multi-stage defense-evasion mechanism involving PowerShell, a UAC bypass, an embedded kernel driver, and a large list of security products targeted for termination.

An out-of-bounds heap write bug in the Goja JavaScript engine, which is embedded in applications such as Grafana k6, PocketBase, Nuclei and Zendesk's action-flows feature, allows arbitrary read/write and remote code execution on the affected products.

API hacking in 2026 focuses on exploiting expanded attack surfaces such as ubiquitous GraphQL endpoints, increasingly complex OAuth/OIDC flows, and AI-backed APIs. The impact ranges from unauthorized data access and account takeover to internal network pivoting, credential leakage, unbounded resource consumption, and financial loss.

NetNTLMv1 cracking is a problem I've kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool.

The Deep Orange 3G/4G/LTE Router, is a white-labeled ZBT-WE826-T2. We exploited a vulnerability in the telnet interface and rooted the device. With root access, we found the router's firmware was built in 2019, and provided with 2 implants.

Twenty router models sold on Amazon, AliExpress, and Alibaba ship with a remote-control implant enabled by default. It runs as root, it uses no encryption, and it authenticates nobody. Whoever answers the phone owns the device.

We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.

This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.

A deep dive into AdaptixC2, an open-source post-exploitation C2 framework whose default configuration ships branded HTTP headers (Server: AdaptixC2, Adaptix-Version: v1.2) on every unauthenticated request, making deployed servers trivially identifiable from passive scanning.

We present a technique that leverages the auto-approved COM class CMSTPLUA and its ICMLuaUtil interface to call the ShellExec method and execute arbitrary commands with elevated privileges, bypassing UAC. By injecting a crafted DLL into explorer.exe, an elevated COM moniker is created and ShellExec is used to launch cmd.exe as Administrator.

We detail manual Active Directory querying using dsquery (Windows) and ldapsearch (Linux/macOS) to enumerate AD objects such as users, groups, computers, and attributes. These operations provide situational awareness for offensive assessments by allowing targeted searches with compound filters, wildcards, and attribute queries across domain controllers.