WriteAccountRestrictions fun (@unsigned_sh0rt), RCE in Dell UnityVSA (@SinSinology), Unity Runtime exploit (@ryotkak), Lenovo DCC LPE (@0x4d5aC), remote control over generators (@XeEaton), and more! blog.badsectorlabs.com/last-week-in...

FreeBPX RCE (@chudyPB), badpie (@dtmsecurity), macOS auditd malloc woes (@jfmeee), Spotlight TCC leak (@patrickwardle), WSUS relaying (@Coontzy1), pyLDAPGui (@ZephrFish), and more! blog.badsectorlabs.com/last-week-in...

Sure, a bunch of NPM packages got backdoor'd (again), but don't miss the great research and tools released last week! blog.badsectorlabs.com/last-week-in...

Lots of tooling around the new Bloodhound "OpenGraph" standard this week including vCenterHound from @m0rd4vid and the bhopengraph library from @podalirius_. blog.badsectorlabs.com/last-week-in...

DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat themed loader (@vxunderground), fine-tune LLMs for offsec (@kyleavery_), juicing NTDS.DIT (@MGrafnetter), and more! blog.badsectorlabs.com/last-week-in...

Come see a preview of the new Web UI for 🏟️Ludus at the Embedded Systems Village. Our mini-workshop walks you through deploying a range and then hacking an emulated IP camera.

In Vegas for hacker summer camp and trying to get food without breaking the bank? I vibed a simple map site: defconfood.badsectorlabs.com Come see Ludus at the embedded Systems Village - hack an IP camera, see the new UI, and get a sticker!

Last LWIS before DEF CON. Come see us in the Embedded Systems Village where we have a mini-workshop hosting an emulated camera on Ludus for you to hack! blog.badsectorlabs.com/last-week-in...

VMware Tools LPE (@justbronzebee), Adaptix C2 0.7 (@hacker_ralf), Ludus MCP (@__Mastadon), SOAP(y) (@_logangoins), and more! blog.badsectorlabs.com/last-week-in...

PIC agents (@_RastaMouse), ToolShell, Async BOFs (@Cneelis), SCCM MP relays (@unsigned_sh0rt), RAITrigger (@ShitSecure), and more! blog.badsectorlabs.com/last-week-in...

LudusHound (@bagelByt3s), SpeechRuntimeMove (@ShitSecure), Havoc Pro (@C5pider), FortiWeb RCE (@SinSinology), SailPoint IQService RCE (@NetSPI), Altiris RCE (@lefterispan), WAF bypass (@nyxgeek), and more! blog.badsectorlabs.com/last-week-in...

Ludushound shows the power of community driven innovation in cybersecurity. @bagelByt3s created an awesome tool to convert bloodhound data into a working lab in 🏟️ Ludus. Replicate complex live environments with automation - and get back to the fun stuff! specterops.io/blog/2025/07...

Lots of good write ups (like Citrix Bleed 2) but my favorite was seeing how 🏟️ Ludus.cloud helped Cameron Stish of Guidepoint Security find "LoopyTicket" (CVE-2025-33073). blog.badsectorlabs.com/last-week-in...

Tons of great content released over the past few weeks. Get caught up with Last Week in Security! blog.badsectorlabs.com/last-week-in...

This week's edition is packed full of great techniques and tools! One of the longest posts we've done; there's so much cool stuff being released. blog.badsectorlabs.com/last-week-in...

@raphaelmudge.bsky.social summed up why we built and released Ludus open source: "Develop technologies that give individual operators and researchers LEVERAGE acting on hypothesis and make it fast to try things, adapt, and modify." When spinning up ADCS or SCCM is 3 commands, it gives you leverage.

Want to learn pivoting this weekend? The 🏟️Ludus community created a Pivot Lab with 11 different pivoting tools! Check it out: docs.ludus.cloud/docs/environ...

Stealth syscalls (@darkrelaylabs), VM introspection (@memn0ps), Marebackup LPE (@itm4n.bsky.social), Azure Arc C2 (@zephrfish.yxz.red), Obfusk8 (@x86byte), and more! blog.badsectorlabs.com/last-week-in...

BadSuccessor (@YuG0rd), o3 finds SMB 0day (@seanhn), crashing defender (@InfoGuard_Labs), MDT looting (@Oddvarmoe), and more! blog.badsectorlabs.com/last-week-in...

MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name If this query hits, you're DA: www.akamai.com/blog/securit...

Certipy 5 (@ly4k_), MobileIron pwnage (@chudyPB), new CRTO pricing (@_ZeroPointSec), Volatility 3 parity (@volatility), and more! blog.badsectorlabs.com/last-week-in...

Cobalt Strike for free!? Adaptix C2 (@hacker_ralf) is the best open source C2 I've used since Havoc (@C5pider). Adaptix has SOCKS5, remote and local port forwards, and BOF support! Now it's easy to install the server and client, especially on 🏟️Ludus with our new role: github.com/badsectorlab...

SysAid RCE (@SinSinology + @watchtowrcyber), defendnot (@es3n1n), iOS widget hacks (@brycebostwick.bsky.social), Sword of Secrets (@GiliYankovitch), and more! blog.badsectorlabs.com/last-week-in...

The Ludus range config can get complex - lots of features == lots of options, but VSCode (and Cursor/Windsurf) can help if you add: # yaml-language-server: $schema=https://docs.ludus.cloud/schemas/range-config.json to the top of a yaml, the editor will highlight and explain errors! 🤯

ProxyBlobing (@_atsika), SonicWall n-days (@SinSinology), Drag and Pwnd (@d4d89704243), Loki C2 2.0 (@0xBoku), GraphSpy 1.5.0 (@RedByte1337), and more! blog.badsectorlabs.com/last-week-in...

Got my hands on an unreleased Google DeepMind AI workstation! 🧠💻 jk, but the new 🏟️Ludus 🚫🏖️Anti-Sandbox update allows for full customization of machine values. Make your machines look like whatever you (or your APTs) expect. docs.ludus.cloud/docs/enterpr...

Survive the RSA noise by focusing on the technical, with Last Week in Security! blog.badsectorlabs.com/last-week-in...

Go beyond the CVE drama; lots of good technical content from last week: blog.badsectorlabs.com/last-week-in...

WinRMS relay (@Defte_), plaintext Zip attacks (@pfiatde), SQL Server Crypto deep dive (@_xpn_), FindUnusualSessions (@podalirius_), and more! blog.badsectorlabs.com/last-week-in...

2️⃣ While honing offensive techniques in the lab, plan to transition from the pay-to-play #PEN200 network to a self-hosted cyber range. Explore options to reduce upfront costs, streamline deployment w/ Ludus, & integrate SIEM solutions to enhance your learning experience. 🧵: 3/4

[Blog] This ended up being a great applied research project with my co-worker Dylan Tran on weaponizing a technique for fileless DCOM lateral movement based on the original work of James Forshaw. Defensive recommendations provided. - Blog: ibm.com/think/news/f... - PoC: github.com/xforcered/Fo...

Next.js auth bypass (@zhero___ + @inzo____), ServiceNow for red teamers (@__invictus_), Veeam RCE - again! (@chudyPB), ArgFuscator (@Wietze), and more! blog.badsectorlabs.com/last-week-in...

📢 🏟️ Ludus 1.9.2 is now available! New features include: ✅ Install Linux packages easily from range config ✅ Control Wireguard subnet traffic with custom network rules ✅ Fixed domain joining for non-English Windows and more! Full changelog: gitlab.com/badsectorlab...

Evilginx Pro (@mrgretzky.breakdev.org ), Pre-auth RCE in a CMS (@chudypb.bsky.social), GOAD ADCS, YouTube email disclosure (@brutecat.com), SAML parser bug (ulldma.bsky.social), and more! blog.badsectorlabs.com/last-week-in...

Excited to announce 🏟️Ludus 1.9.0 now with arbitrary snapshot support! See the docs: docs.ludus.cloud/docs/snapshots We've added documentation for deploy tags as well. 1.9.0 also includes: - Disable Windows Defender via GPO - Better VM validation - Chrome/Edge FRE disabled - Much more!

🚨 Evilginx Pro is finally here! 🚨🎣🐟 This is it! After over two years of development, countless delays, and hundreds of manual company verifications, Evilginx Pro is finally live! Thank you all for your invaluable support 💗 breakdev.org/evilginx-pro...

The Mythic family continues to grow! Another cool Windows agent written in C that already has COFF execution! Be sure to check it out and their blog series on it c0rnbread.com/creating-myt... x.com/0xC0rnbread/...

Ligolo-MP (@ttpreport), Bybit hack via CI (@adnanthekhan), FindGPPPasswords (@podalirius_), ComDotNetExploit (@T3nb3w), and more! blog.badsectorlabs.com/last-week-in...

ADIDNS Parser (@the_bit_diddler), Parallels LPE (@patch1t), PowerChell (@itm4n), SACL Scanner (Alexander DeMine of @SpecterOps), and more! blog.badsectorlabs.com/last-week-in...

PAN-OS auth bypass (@hash_kitten), Outlook drafts as C2 (@elasticseclabs), Ludus powered SocGholish analysis (@russianpanda.bsky.social), kernel UAF (@h0mbre_), and more! blog.badsectorlabs.com/last-week-in...

🎉 One year ago, Ludus launched as a free & open source project! Now v1.8.1 brings even more features: - built-in config editor - force_ip for non-qemu machines - Windows autologon customization + major enterprise/anti-sandbox updates! Check it out: ludus.cloud

Mythic C#/BOF support (@its-a-feature.bsky.social , Ludus guide (@sherif_ninja), Window shadow stacks (@33y0re), Orbit scanner (@bhinfosecurity.bsky.social), and more! blog.badsectorlabs.com/last-week-in...

0-click deanonymization, Subaru hacks (@shubs.io), 🍪 sandwitch (@d4d89704243.bsky.social), Entra Connect attacks (@hotnops.bsky.social , Kerberos relaying via HTTP, another Fortinet vulnerability, great iOS debugging (@brycebostwick.bsky.social), and more! blog.badsectorlabs.com/last-week-in...

Windows LPE (@MrAle_98), CLR OPSEC (@passthehashbrown), WinRM BOFs (@falconforceteam.bsky.social), Bitlocker bypass (@neodyme.io), BloodHound CLI (@cmaddalena), and more! blog.badsectorlabs.com/last-week-in...

🔎 Search is here! Find the tool, exploit or technique you need from our 217 issues of Last Week in Security! blog.badsectorlabs.com

A Windows Rootkit (Cole Hudson), unholy PDFs (Thomas Rinsma), more Ivanti RCE (@sinsinology.bsky.social ), macOS exploits (@patch1t.bsky.social + MsftSecIntel + @wh1te4ever.bsky.social), and more! blog.badsectorlabs.com/last-week-in...

Every week we put together a comprehensive blog of all the relevant news, techniques, tools, and exploits released the last week. No AI-assisted anything. How? See allenpike.com/2024/an-unre... All sources are available if you want to try yourself blog.badsectorlabs.com/files/blogs....

Kick off 2025 with, fresh news, new exploits, techniques, tools, and more! blog.badsectorlabs.com/last-week-in...

🏟️ Ludus is quickly becoming the free and open source standard for cybersecurity labs and we couldn't be more exited. Easy to extend, easy to share complex labs - stop configuring and start hacking, with 🏟️ Ludus!

LDAP RCE 😵, worst.fit (@orange_8361 + @_splitline_) Grok AI vulns (@wunderwuzzi23), automating exploits (@fuzzysec.bsky.social + @chompie.rip), and more! blog.badsectorlabs.com/last-week-in...