ITSEC Newsletter 2025-08-07

In the first blog, we took various MaxiProx builds and attempted to build one for ourselves, dipping our toes into the hardware hacking pond. In the second blog, we had to redesign our initial build to fix some power issues to get the range that we were expecting. In this final blog, we will neatly package up all the components into a mobile MaxiProx, test it out, and make a few more adjustments, if needed.

Fabian Mosch disclosed at Troopers 2025 conference, a new lateral movement technique that involves the remote manipulation of BitLocker registry keys via Windows Management Instrumentation (WMI), to hijack specific COM objects of BitLocker. The purpose of the BitLocker COM Hijacking is to execute code under the context of the interactive user on a target host. In the event that the interactive user has excessive privileges (i.e. domain administrator) this could also lead to domain escalation.

C2 servers use different communication methods, for example HTTP/HTTPS, to camouflage the network traffic and make it look similar to a normal request to a common web page, but we can use other network protocols to communicate with the server. Here I’ll show how to set up a DNS proxy to communicate with a C2 server.