Nostr notes by Ivan Ožić Bebek

Defeating enforced SMB signing ...

2026-10-23T08:38:52Z

Defeating enforced SMB signing https://blackfield.ch/blog/defeating-enforced-smb-signing/

PoC for FortiClient Endpoint Management Server authentication ...

2026-10-14T07:42:49Z

PoC for FortiClient Endpoint Management Server authentication bypass https://github.com/Alaatk/CVE-2026-35616

Next.js unauthenticated RCE PoC ...

2026-10-01T10:12:28Z

Next.js unauthenticated RCE PoC https://github.com/EQSTLab/CVE-2026-94545

SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE ...

2026-09-23T08:53:09Z

SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass https://blog.viettelcybersecurity.com/sharepoint_cve-2026-65660/

Veeam Agent LPE PoC https://github.com/suce0155/CVE-2026-32996

2026-09-22T11:20:45Z

Veeam Agent LPE PoC https://github.com/suce0155/CVE-2026-32996

Windows Defender Update DoS Vulnerability ...

2026-09-20T10:15:46Z

Windows Defender Update DoS Vulnerability https://github.com/MSNightmare/BigDiskBuster

PoC for CUPS LPE on Linux ...

2026-09-18T18:42:15Z

PoC for CUPS LPE on Linux https://github.com/v12-security/pocs/tree/main/cups/cups2root

PSNativeCmdDevKit Constrained Language Mode Bypass ...

2026-09-18T16:52:40Z

PSNativeCmdDevKit Constrained Language Mode Bypass https://gist.github.com/enigma0x3/22d6fc84956f154faf338966cd6d9bb0

CVE-2026-83991: Windows Cloud Files access-check bypass ...

2026-09-09T12:33:32Z

CVE-2026-83991: Windows Cloud Files access-check bypass https://github.com/karollooool/CVE-2026-83991-writeup-and-poc

Redis RCE PoC (CVE-2026-81934) ...

2026-09-03T12:46:08Z

Redis RCE PoC (CVE-2026-81934) https://github.com/v12-security/pocs/tree/main/redis/server_ssl

An App Domain Manager Injection DLL PoC on steroids ...

2026-09-03T12:42:49Z

An App Domain Manager Injection DLL PoC on steroids https://github.com/ipSlav/DirtyCLR

NightmareEclipse versus CrowdStrike Falcon ...

2026-09-03T06:59:57Z

NightmareEclipse versus CrowdStrike Falcon https://github.com/MSNightmare/FalconFlank

Kaspersky AV 0day LPE https://github.com/MSNightmare/HardBreacher

2026-08-29T10:03:27Z

Kaspersky AV 0day LPE https://github.com/MSNightmare/HardBreacher

Next.js Windows RCE PoC ...

2026-08-27T10:16:34Z

Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc

Log4j2 RCE PoC https://github.com/dinosn/log4j-4255

2026-08-26T13:51:33Z

Log4j2 RCE PoC https://github.com/dinosn/log4j-4255

Rogue vSphere server that captures credentials from Veeam Backup ...

2026-08-11T15:25:31Z

Rogue vSphere server that captures credentials from Veeam Backup & Replication https://github.com/mattmillen15/VeeamThief

CVE-2025-7771 — ThrottleStop.sys Arbitrary Physical Memory R/W ...

2026-08-11T15:13:19Z

CVE-2025-7771 — ThrottleStop.sys Arbitrary Physical Memory R/W https://github.com/enessakircolak/CVE-2025-7771

PoC for Windows PnP LPE https://plugandpwn.com/

2026-08-08T19:36:23Z

PoC for Windows PnP LPE https://plugandpwn.com/

Authenticated RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0 ...

2026-07-24T09:35:57Z

Authenticated RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0 https://github.com/berabuddies/redis-poc

CVE-2026-42980: Reversing and Exploiting the Windows Kernel WMI ...

2026-07-14T08:08:06Z

CVE-2026-42980: Reversing and Exploiting the Windows Kernel WMI Underflow https://blog.grunt.ar/bin-exploitation/binary-gecko-academy/cve-2026-42980-wmi-underflow-en/

CVE-2025-45422: Proximus b-box UPnP Persistence & Access ...

2026-07-10T13:32:39Z

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass https://github.com/Cedrico03/CVE-2025-45422---Bbox

klist.exe Revisited: Internals and Further Use Cases ...

2026-07-02T07:23:19Z

klist.exe Revisited: Internals and Further Use Cases https://jakeotte.com/posts/klist-revisited.html

AI guardrails will always fail. NIST just proved it ...

2026-06-29T09:16:54Z

AI guardrails will always fail. NIST just proved it mathematically https://www.covertswarm.com/post/ai-guardrails-will-fail-nist-mathematical-proof

When EPA isn't EPA'ing: What Tools Like Certify, Certipy ...

2026-06-24T12:08:32Z

When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss https://www.abdulmhsblog.com/posts/pitfallswithepa/

WinNotify/signeddrv.sys — Full Local Privilege Escalation via ...

2026-06-08T06:34:06Z

WinNotify/signeddrv.sys — Full Local Privilege Escalation via Arbitrary Kernel Read/Write https://medium.com/@haider303mustafa/winnotify-signeddrv-sys-full-local-privilege-escalation-via-arbitrary-kernel-read-write-09e0c1ababf3

When Your VPN Opens Your Private Network to the Public ...

2026-05-21T14:43:12Z

When Your VPN Opens Your Private Network to the Public https://www.hacktron.ai/blog/cve-2026-0265-panos-globalprotect-cas-auth-bypass

Impacket 0.13.1 is out, with a lot of improvements and some new ...

2026-05-21T07:31:09Z

Impacket 0.13.1 is out, with a lot of improvements and some new relay options. https://www.coresecurity.com/blog/whats-new-impacket-0131

A 0-click exploit chain for the Pixel 10: When a Door Closes, a ...

2026-05-14T06:54:26Z

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens https://projectzero.google/2026/05/pixel-10-exploit.html

A fork of Mimikatz that works on Windows 11 24H2/25H2 ...

2026-04-16T12:58:16Z

A fork of Mimikatz that works on Windows 11 24H2/25H2 https://medium.com/@tanrikuluatahan/fixing-mimikatz-sekurlsa-logonpasswords-on-windows-11-24h2-25h2-253e82866197

It's also worth noting that this guy works for Anthropic. ...

2026-04-10T06:58:25Z

In reply to nevent1q…yhrt
_________________________

It's also worth noting that this guy works for Anthropic. There are several publications that replicated what Mythos did, with far less resources.

The Gap Between “Thousands of Vulnerabilities” and Reality:
https://medium.com/@manikndn369/the-gap-between-thousands-of-vulnerabilities-and-reality-ccf2ff5d7f8f

The Jagged Frontier:
https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier

What You Need to Know: Windows Admin Center Remote Privilege ...

2026-03-23T14:47:17Z

What You Need to Know: Windows Admin Center Remote Privilege Escalation (CVE-2026-26119) https://www.semperis.com/blog/what-you-need-to-know-windows-admin-center-remote-privilege-escalation-cve-2026-26119/

Why I Left Kali for Exegol https://bltsec.com/posts/exegol/

2026-03-19T20:56:11Z

Why I Left Kali for Exegol https://bltsec.com/posts/exegol/

Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass ...

2026-03-19T20:28:07Z

Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found https://trustedsec.com/blog/full-disclosure-a-third-and-fourth-azure-sign-in-log-bypass-found

CVE-2026-26117: Hijacking Azure Arc on Windows for Local ...

2026-03-11T07:02:21Z

CVE-2026-26117: Hijacking Azure Arc on Windows for Local Privilege Escalation & Cloud Identity Takeover https://cymulate.com/blog/cve-2026-26117-azure-arc-windows-lpe-cloud-identity-takeover/

right, I don't see how this is different from any other ...

2026-03-06T10:57:46Z

In reply to nevent1q…q3n2
_________________________

right, I don't see how this is different from any other privacy focused company. What else is there, gift card payment suport?

well crypto is also supported, here is their response from LI: ...

2026-03-06T10:36:16Z

In reply to nevent1q…56g7
_________________________

well crypto is also supported, here is their response from LI:

What Windows Server 2025 Quietly Did to Your NTLM Relay ...

2026-02-26T10:21:48Z

What Windows Server 2025 Quietly Did to Your NTLM Relay https://decoder.cloud/2026/02/25/what-windows-server-2025-quietly-did-to-your-ntlm-relay/

Hands-Free Lockpicking: Critical Vulnerabilities in dormakaba’s ...

2026-01-26T11:42:31Z

Hands-Free Lockpicking: Critical Vulnerabilities in dormakaba’s Physical Access Control System https://sec-consult.com/blog/detail/hands-free-lockpicking-critical-vulnerabilities-in-dormakabas-physical-access-control-system/

Well, Well, Well. It’s Another Day. (Oracle E-Business Suite ...

2025-10-06T18:11:28Z

Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882) https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/

Hashcat v7.0.0 released ...

2025-08-03T10:58:40Z

Hashcat v7.0.0 released https://hashcat.net/forum/thread-13330-post-63567.html#pid63567

Laravel: APP_KEY leakage analysis ...

2025-07-11T07:38:44Z

Laravel: APP_KEY leakage analysis https://www.synacktiv.com/en/publications/laravel-appkey-leakage-analysis

Reproducing a million-dollar bug: 3WhatsApp CVE-2019-11932 ...

2025-07-03T09:30:01Z

Reproducing a million-dollar bug: 3WhatsApp CVE-2019-11932 https://www.ibm.com/think/x-force/reproducing-million-dollar-bug-whatsapp-cve-2019-11932-afl-frida

We’re going the wrong way! How to abuse symlinks and get LPE in ...

2025-06-28T18:25:48Z

We’re going the wrong way! How to abuse symlinks and get LPE in Windows https://cicada-8.medium.com/were-going-the-wrong-way-how-to-abuse-symlinks-and-get-lpe-in-windows-0c598b99125b

“Localhost tracking” explained. It could cost Meta 32 ...

2025-06-11T14:53:11Z

“Localhost tracking” explained. It could cost Meta 32 billion. https://www.zeropartydata.es/p/localhost-tracking-explained-it-could

A practical NTLM relay attack using the MS-EVEN RPC protocol and ...

2025-05-09T11:11:10Z

A practical NTLM relay attack using the MS-EVEN RPC protocol and antivirus-assisted coercion https://github.com/Thunter-HackTeam/EvilentCoerce

Weaponizing DCOM for NTLM Authentication Coercions ...

2025-04-08T16:41:00Z

Weaponizing DCOM for NTLM Authentication Coercions https://github.com/xforcered/RemoteMonologue

CVE-2025-27407: Inside the Critical GraphQL-Ruby RCE ...

2025-03-28T07:32:00Z

CVE-2025-27407: Inside the Critical GraphQL-Ruby RCE Vulnerability https://cenobe.com/blog/cve-2025-27407/

Poc exploit for CVE-2025-21333 heap-based buffer overflow ...

2025-02-28T11:44:23Z

Poc exploit for CVE-2025-21333 heap-based buffer overflow https://github.com/MrAle98/CVE-2025-21333-POC

Anydesk LPE Vulnerability ...

2025-02-11T09:14:39Z

Anydesk LPE Vulnerability https://github.com/CICADA8-Research/Penetration/tree/main/POCs/CVE-2024-12754

Top 10 web hacking techniques of 2024 ...

2025-02-04T16:18:43Z

Top 10 web hacking techniques of 2024 https://portswigger.net/research/top-10-web-hacking-techniques-of-2024

Active Directory Domain Services Elevation of Privilege ...

2025-01-29T16:19:54Z

Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2025-21293) https://birkep.github.io/posts/Windows-LPE/

yes, I don't remember where I took the filter from, but ...

2025-01-29T08:35:54Z

In reply to nevent1q…3apn
_________________________

yes, I don't remember where I took the filter from, but it's something like this: https://github.com/gijsdev/ublock-hide-yt-shorts/blob/master/list.txt works on desktop and mobile. keep on rocking 🤘

you can easily block them with Unhook or uBlock extension :)

2025-01-29T08:19:58Z

In reply to nevent1q…dras
_________________________

you can easily block them with Unhook or uBlock extension :)

7-Zip 0day PoC https://pastebin.com/KxQYFqwR

2024-12-30T13:00:29Z

7-Zip 0day PoC https://pastebin.com/KxQYFqwR

Unveiling Hidden Transformers in Windows ANSI! ...

2024-12-19T16:28:40Z

Unveiling Hidden Transformers in Windows ANSI! https://worst.fit/assets/EU-24-Tsai-WorstFit-Unveiling-Hidden-Transformers-in-Windows-ANSI.pdf

thanks for clarification! I tried to replicate this beforehand, ...

2024-12-18T18:06:18Z

In reply to nevent1q…lf3e
_________________________

thanks for clarification! I tried to replicate this beforehand, but in my case it asks for password, phone number, auth or recovery code. If it works without any of these then it's highly disturbing.

"In reality, the thieves caused the alert to appear on his ...

2024-12-18T14:28:47Z

In reply to nevent1q…4xyf
_________________________

"In reality, the thieves caused the alert to appear on his phone merely by stepping through Google’s account recovery process for Griffin’s Gmail address." Does this mean they had his password or auth code? Recovery notification couldn't be sent otherwise.

Malimite is an iOS decompiler designed to help researchers ...

2024-12-08T10:23:53Z

Malimite is an iOS decompiler designed to help researchers analyze and decode IPA files https://github.com/LaurieWired/Malimite

Windows DWM Core Library Elevation of Privilege Vulnerability ...

2024-11-08T15:39:31Z

Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2024-30051) https://www.coresecurity.com/core-labs/articles/windows-dwm-core-library-elevation-privilege-vulnerability-cve-2024-30051

CVE-2024-8260: SMB Force-Authentication Vulnerability in OPA ...

2024-10-24T14:54:51Z

CVE-2024-8260: SMB Force-Authentication Vulnerability in OPA Could Lead to Credential Leakage https://www.tenable.com/blog/cve-2024-8260-smb-force-authentication-vulnerability-in-opa-could-lead-to-credential-leakage

Analysis of CVE-2024-8698 in KeyCloak ...

2024-10-23T18:06:38Z

Analysis of CVE-2024-8698 in KeyCloak https://huydoppa.hashnode.dev/analyst-cve-2024-8698-keycloak-with-zero-knowledge-about-keycloak

PoC for the Untrusted Pointer Dereference in the ks.sys driver ...

2024-10-23T18:03:15Z

PoC for the Untrusted Pointer Dereference in the ks.sys driver https://github.com/varwara/CVE-2024-35250

MS Streaming Service Privilege Escalation PoC ...

2024-10-23T18:01:49Z

MS Streaming Service Privilege Escalation PoC https://github.com/Dor00tkit/CVE-2024-30090