Proxy Bar

Reverse Engineering the Tapo C260 and Tapo Discovery Protocol v2

Original text by Spaceraccoon

The article describes the reverse-engineering process of the TP-Link Tapo C260 smart camera and the analysis of its proprietary Tapo Discovery Protocol v2 (TDPv2). The research was conducted during the SPIRITCYBER IoT hardware hacking contest and focused on understanding the device firmware and network attack surface. The author begins with a…

https://core-jmp.org/2026/03/reverse-engineering-the-tapo-c260-and-tapo-discovery-protocol-v2/

Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR

Original text by Manuel

Summary

The Windows Cortex XDR agent uses CLIPS rules for behavioral detections. These rules are shipped encrypted in content updates. We decrypted these rules and discovered numerous hardcoded exceptions including global whitelists that can be abused to bypass those rules. For example, if a process’s command-line arguments contain :Windowsccmcache, it is…

https://core-jmp.org/2026/03/decrypting-and-abusing-predefined-biocs-in-palo-alto-cortex-xdr/

Ghost in the PPL – LSASS Memory Dump

Original text by Clément Labro

The article explores techniques for extracting memory from the LSASS (Local Security Authority Subsystem Service) process when it runs as a Protected Process Light (PPL). Modern versions of Windows use PPL to protect sensitive processes such as LSASS from tampering or credential dumping by user-mode tools.

The research initially aimed…

https://core-jmp.org/2026/03/ghost-in-the-ppl-lsass-memory-dump/

В в ЖЭК


#telega

Занятный проект! vm-filesystem
*
Название так себе - читай ФАЙЛОВЫЙ МАНАГЕР
В общем и целом это альтернативный backend для файловых операций в Havoc/Kaine через Firebeam VM.
Крутой архитектурный прием - можно подменить стандартный путь взаимодействия клиента с агентом и прогонять файловые операции через другой execution backend, при этом сохранив привычный UX, а знаааачит потенциально это даёт меньше телеметрии, чем BOF/dynamic execution
До нового боевого stealth file manager еще как до луны, но как PoC демка того, как через Firebeam VM и monkey-patching клиента можно заменить стандартный filesystem backend будет очень занятно.
*
Для любителей C2-плагинов:
repository
&
Video


#CC #C2

RCE in RubitMQ Job Processor
*
read

Crimes against NTDLL – Implementing Early Cascade Injection

Original text by fluxsec

Early Cascade Injection is an advanced process injection technique designed to execute payloads at the earliest stage of Windows process initialization. The method abuses internal components of the Windows loader located in ntdll.dll, specifically the Application Compatibility Shim Engine. By modifying undocumented global variables such as g_ShimsEnabled and the callback pointer…

https://core-jmp.org/2026/03/crimes-against-ntdll-implementing-early-cascade-injection/

How Kernel Anti-Cheats Work: A Deep Dive into Modern Game Protection

Original text by s4dbrd

The article explains how modern kernel-level anti-cheat systems operate and why game developers increasingly rely on kernel drivers to combat advanced cheating techniques. It describes how anti-cheat software loads privileged drivers that run at the same level as the Windows kernel, allowing them to monitor processes, detect unauthorized memory manipulation, and…

https://core-jmp.org/2026/03/how-kernel-anti-cheats-work-a-deep-dive-into-modern-game-protection/

Active Directory Security Assessment: Password Spraying, Privilege Escalation, and Kerberoasting

Active Directory remains the backbone of identity and access management in most enterprise environments. Because of its central role in authentication, authorization, and service delegation, compromising Active Directory often means compromising the entire organization. Modern attackers understand this well and frequently target domain infrastructure as the primary objective during intrusion campaigns.

Unlike traditional exploitation techniques…

https://core-jmp.org/2026/03/active-directory-security-assessment-password-spraying-privilege-escalation-and-kerberoasting/

Reverse engineering undocumented Windows Kernel features to work with the EDR

Original text by 0xflux/

[Reverse engineering Windows internals: because sometimes the best way to fix a problem is to take the operating system apart.]

Intro

The information contained in this blog post is valid for the Windows 11 Kernel 24H2, and is not guaranteed to be accurate on other kernel versions.

The code for this…

https://core-jmp.org/2026/03/reverse-engineering-undocumented-windows-kernel-features-to-work-with-the-edr/

Silent Harvest: Extracting Windows Secrets Under the Radar

Original text by Sud0Ru

What the article is about

The article explains how attackers can quietly harvest sensitive Windows credentials and secrets after gaining initial access to a system, while avoiding detection by modern EDR solutions. The goal is to collect credentials for lateral movement without triggering typical security alerts.

The author first describes how…

https://core-jmp.org/2026/03/silent-harvest-extracting-windows-secrets-under-the-radar/

CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root
*
crack-armor.txt

RIP RegPwn: The Rise and Fall of a Windows Registry Exploitation Technique

Original text by Filip Dragovic.

As part of MDSec’s R&D work, we often discover vulnerabilities and develop exploits to support our red team engagements. When researching widely used software, it is often only a matter of time before the same vulnerability is discovered by other researchers and reported to the vendor. Two weeks ago we…

https://core-jmp.org/2026/03/rip-regpwn-the-rise-and-fall-of-a-windows-registry-exploitation-technique/

Hello, here!

ibWebAdmin Unauthenticated RCE
*
writeUP
*
PoC

УУУУ жир
Mastercard запускает новую блокчейн-инициативу для мгновенных международных переводов, к которой подключились Binance, PayPal и Ripple и тд.
Идея простая: объединить ликвидность криптобирж, огромную аудиторию PayPal и технологию трансграничных расчётов Ripple, чтобы отправлять бабки почти мгновенно ииии за свой <1% (ну разумеется).
*
А чьто для черных шляп ?
Появление более жирной и дорогой поверхности атаки !
Ведь в крипто партнерке 85 + компаний и у каждой свои рельсы, API, SDK, провайдеры ликвидности, compliance-подрядчиков и интеграционных сценариев, бизнес логики ичтотамеще. Supply-chain во все поля.
А чем больше интеграций, тем больше ошибок в логике, правах доступа, webhook/API-цепочках и обработке исключений.
Технические взломы отваливают на второй план - а гибридный fraud-abuse впереди.
Все потому что у Mastercard Crypto Credential упор на верифицированные идентификаторы\проверку поддерживаемых активов, governance framework и вот это вот все.
Поэтому и становятся ценными - обход KYC/KYB, захват аккаунтов, подмена бенефициара, соц engineering вокруг “алиасов”, abuse возвратов/чарджбеков и попытки проскочить без мыла между булок разных юрисдикций.
А еще будет санкционный/географический арбитраж !

Белые шапки конечно тоже заработают, только меньше.

И сам блокчейн тут не главная история.Кулл стори тут это конвертация криптоИнфры в массовый платёжный контур.

CVE-2025-69219 — Apache Airflow Providers HTTP RCE
*
PoC

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure
*
POC