ITSEC Newsletter 2025-12-31 - New Year Special!

The research unveils a new attack surface in Windows by exploiting Best-Fit, an internal charset conversion feature. Through our work, we successfully transformed this feature into several practical attacks, including Path Traversal, Argument Injection, and even RCE, affecting numerous well-known applications! Given that the root cause spans compiler behavior, C/C++ runtime and developer’s mistakes, we also discussed the challenges of pushing fixes within the open-source ecosystem.

Beacons are being used by various threat actors, including state actors and criminal groups, and many of these cases stay undetected. Our analysis demonstrates how patterns of randomness, often employed for evasion, can be leveraged to uncover the presence of such traffic. By focusing on these identifiable patterns, security professionals can enhance their detection capabilities and bolster their defenses against advanced threats. Continue reading to explore how defenders can use the Jitter-Trap technique to identify even the stealthiest beacons by analyzing behavioral signatures and network anomalies.

We believe that our story should start with the basics. Therefore, the first (and, spoiler, the second) parts will pay a lot of attention to the basics of RPC, rather than directly programming. However, I will actively show examples of C++ code for ease of understanding. In addition, the text of the article contains many references to research and material from other authors. This way, you will get a full and detailed understanding of RPC before moving on to the issues of developing tools using Impacket. We’ll learn Impacket from scratch to the point where you can write a custom tool for Lateral Movement!

IXs are a little bit strange, as they are at their core practically identical to a simple ethernet switch you may find in your home or office (except your home switch is unlikely to be doing terabits per second of traffic). As IXs depend on the ethernet switches interest in only being the MAC addresses of traffic and not the Layer 3 IP addresses. However home and small and medium business (SMB) routers often come with defaults that make life a lot easier for networks way of desktop computers and common office equipment on them, these same defaults are at the very least annoying and at the very worst actively exploitable if put on a IX LAN with many untrusted participants.

My typical engagements are mostly Red Teams, so I do not often get a chance to play with terminal server application breakouts - but on a recent engagement, I did. For me, it was a great refresher on typical things to do after you have escaped the intended application and want to get more code execution.

Have you ever wondered what the "/public" command-line option in MSTSC actually does? It enables "public mode" in the RDP client, a feature somewhat similar to "incognito mode" in web browsers. This is a feature meant to be used on a "public" or "shared" computer, where users might want to prevent credentials, session details, and cached images from being stored locally.

This article marks the beginning of a four-part playbook designed to guide readers through the process of reverse engineering and exploiting Windows drivers. Starting with static analysis, we will identify vulnerabilities, develop a working exploit, and ultimately demonstrate how such drivers can be weaponized.

Wi-Fi Forge is a tool designed by Joe Boyd and me. It was created with the goal of emulating wireless networks, offering a virtual environment where you can practice Wi-Fi security techniques without needing any physical wireless hardware. With Wi-Fi Forge, you can create real-world Wi-Fi networks that your host machine can see. These networks are real to the host machine, which creates an ability for you as a tester to interact with wireless networks as if they were real. This means that the ability to test wireless networks without hardware is no longer beyond grasp.

In this post, we’ll explore how minor code modifications can significantly boost evasion and help sliver bypass EDR, highlighting both the benefits and pitfalls of standing on open source shoulders versus forging your own.

Although fundamental to Windows, COM remains an obscure and enigmatic technology for many. Deeply embedded in Windows and seamlessly integrated into the system, it regularly plays a role in common operations. When I began this research, my knowledge of COM and DCOM was fairly minimal. While Microsoft does provide documentation, crucial details - such as the internal workings of object activation - remained unclear or incomplete. This article aims to provide a solid foundation on COM and DCOM before delving into the subtleties of the activation process. Our goal is to demystify the mechanisms that enable method calls across remote machines.