Working on a fun Crystal Palace loader that hooks APIs and pushes them through a call stack spoofing PICO.

I can't really wrap my head around it tbh. I find it totally far-fetched that they didn't know this issue existed, and bitching that "MS didn't tell us about it" is deflecting their own negligence.

I do think that Ascension and others that get roasted like this do need to take some accountability though. I'd be willing to bet Kerberoasting was raised in one if not multiple pentest reports prior to the breach, but they chose not to do anything about it.

Analysis of a Ransomware Breach aff-wg.org/2025/09/26/a... Breach analysis? Breach intelligence? Industry critique? Fee-only ransomware negotiator? 100% efficacy? The story of how Microsoft worked an old problem, fucked it up, we malign the guy who told us, they fixed it, and it wasn't fixed? PtH?

[BLOG] I wrote a short post on using the Crystal Palace API from an external Java program. rastamouse.me/crystal-pala...

I learned some Java @raphaelmudge.bsky.social !! 😅

Quick post on how to use the new make coff and merge commands in @raphaelmudge.bsky.social's Crystal Palace. rastamouse.me/modular-pic-...

Playing with @raphaelmudge.bsky.social's latest CP update (it's very cool). I have mixed feelings about merging COFFs though. It simplifies overall development and gives the loader fewer jobs to do, but on the other hand you lose some flexibility about where each "part" goes in memory.

Very cool!

If you're in London, Will Burgess (x.com/joehowwolf) is speaking at Beacon %25 on "Linkers and Loaders: Experiments with Crystal Palace" this Thursday. www.eventbrite.co.uk/e/beacon-25-... beac0n.org From his X: "If you enjoy filthy PIC tradecraft it may be of interest!"

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

It's been almost a year since my last blog... So, here is a new one: Extending AD CS attack surface to the cloud with Intune certificates. Also includes ESC1 over Intune (in some cases). dirkjanm.io/extending-ad... Oh, and a new tool for SCEP: github.com/dirkjanm/sce...

Published a small collection of PIC loaders for Cobalt Strike, based on my experiments with Crystal Palace. github.com/rasta-mouse/...

[BLOG] Here's the post - I demonstrate my QoL improvements for working with the TCG codebase. This includes vscode with intellisense support, and producing debug builds for use in WinDbg. rastamouse.me/debugging-th...

I think I've got a nice way to produce debug builds for Crystal Palace loaders. It produces an EXE that works with WinDbg so you can debug against the source code, with locals, etc.

I adapted Crystal Palace's hooking loader to hook arbitrary CS BOFs, and obfuscate both Beacon and the BOF when making Win32 API calls. One caveat that I ran into was the need to copy arguments that are passed in as pointers. Other than that, it seemed to work ok.

[BLOG] My thoughts (and code examples) for writing modular PIC C2 agents. rastamouse.me/modular-pic-...

@raphaelmudge.bsky.social I read your entire CrystalPalace src code with the intention of porting it to a C# library (CrystalPalace.NET). Just wanted to tip my hat, as there are certainly some non-trivial things happening under the hood to make all this work :D

Thanks to this excellent video, we now have a new emoji in the ZPS Discord server, the :sadmudge:. Seriously, this is a good video for getting started with PIC dev and cleared up quite a few things for me.

Position Independent Code (PIC) Development Crash Course. My July 2025 overview of PIC writing fundamentals. Don't know why jump tables are bad? Got a __chkstk relocation error? Watch this video. #GoodLuckAndHappyHacking vimeo.com/1100089433/d...

Hooking arbitrary BOFs via @raphaelmudge.bsky.social's Crystal Palace is very cool. I'm going to explore more to see if I can rip out the SleepMask and BeaconGate into their own PICOs, rather than using the official BOF codebases.

Taking them to the SHITTER: an analysis of vendor abuse of security research in-the-wild aff-wg.org/2025/07/13/t... (There is no benefit modulating my voice for anyone's comfort. This is my fair take, but unapologetic truth. This phenomena has gone unchecked for too long)

Tradecraft Garden: Tilling the Soil aff-wg.org/2025/07/09/t... Some updates to... the Tradecraft Garden and Crystal Palace. Info in the 🧵 below:

Happy Friday! @tifkin.bsky.social and I are happy to announce that we have cut the release for Nemesis 2.0.0 - check out the CHANGELOG for a (brief) summary of changes, and dive into our new docs for more detail! We're extremely proud and excited for this release github.com/SpecterOps/N...

Beacon Object Files... Five Years On aff-wg.org/2025/06/26/b... I released BOFs with Cobalt Strike 4.1 five years ago. This is some history on the feature and what led to it. My thinking at the time. A few thoughts on current discourse.

Good Monday morning tech nerds. One of my devs wrote *another* blog post about kerberos (I'm creating an army of crazy bloggers). This one you might consider bookmarking.

🆕 New blog post! "Checking for Symantec Account Connectivity Credentials (ACCs) with PrivescCheck" This blog post is not so much about PrivescCheck, but rather brings additional insight to the original article published by MDSec on the subject. 👉 itm4n.github.io/checking-sym... #redteam

[BLOG] Part 2 of Crystal Palace PIC loaders. Here we patch GMH and GPA function pointers into a post-ex reflective loader. rastamouse.me/harvesting-t...

Having another look at Raffi's Crystal Palace PIC loaders today. This time as a post-ex reflective loader with embedded function pointers for GetModuleHandle & GetProcAddress.

[BLOG] Integrating Tradecraft Garden PIC loaders into Cobalt Strike rastamouse.me/harvesting-t...

Used some janky glue to tie into the BEACON_RDLL_GENERATE hook.

Only a few tweaks needed to get this working with Beacon. Very cool.

So, here's a little thread on my new open source project: The Tradecraft Garden. tradecraftgarden.org It's Crystal Palace, an open-source linker and linker script specialized to writing PIC DLL loaders. And, a corpora of DLL loaders demonstrating design patterns building tradecraft with it.

ICYMI it on the heathen platform, I recently launched a new training portal for Zero-Point. Read more here: www.zeropointsecurity.co.uk/blog/new-sit...

Post-ex Weaponization: An Oral History aff-wg.org/2025/04/10/p... A walk-through of some history on post-ex eco-systems used by CS (PowerShell, Reflective DLLs, .NET, and BOFs). Ends with a coffee conversation talking about magician's guilds, security research, and ideas about what's next.

This is one heck of a thread. Everyone should read it.

#MythicTip Want to start automating stuff with Mythic, but not sure where to start? Check out the built-in Jupyter notebooks with Mythic Scripting installed and have fun! Lots of ready to run examples exist already :) Just log in with the Jupyter token from your .env file

[BLOG] I had a series in mind like "Rubeus' Hidden Secrets" or something like that. Basically, highlighting features of the tool that seem less well known. I'm starting off with a basic one for getting crackable hashes from cached service tickets. rastamouse.me/kerberoastin...

We did a thing! DES (not even 3DES) has been a pain in our necks for years, but we couldn't remove it for compat reasons. It required special config to use so it's not dangerous out of the box, but it's still just...ugh, DES. Anyway, we said enough is enough and now the code is getting deleted.

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

Ever wanted to know what data #PowerShell or other programs send to AMSI. I wrote a C# COM server implementation that logs this data as a JSON string. Had some fun learning more about COM and .NET AOT with this little project github.com/jborean93/Am...

A companion blog to my Bluehat 2024 presentation on OleView.NET is up now. googleprojectzero.blogspot.com/2024/12/wind...

Vuln finding with graphs (@two06.bsky.social), review of Postex kit (@rastamouse.me), OpenWRT firmware upgrade vuln (@ryotak.net), iOS decompilation tool (@lauriewired.bsky.social), and more! blog.badsectorlabs.com/last-week-in...

From the team that brought you COFF Loader, CS-Situational-Awareness-BOF, and CS-Remote-OPs-BOF, we are excited to release our first on-demand class: Building BOFs. Read our new blog to find out what else we have loading for 2025! trustedsec.com/blog/on-dema...

I'm going to be at Blackhat Europe 2024 this Wednesday and Thursday. I should also be at BSides London. Just in case anyone wants to find me to sign a book or complain about something Windows related :D

[BLOG] Today's post is all about Cobalt Strike's Postex Kit. rastamouse.me/cobalt-strik...

Windows LPE (@SecuriTeam_SSD), Nighthawk 0.3.3 (@MDSecLabs), Advanced Cobalt Strike Usage (@rastamouse.me), Webcam LED control (@andreyknvl.bsky.social ), and more! blog.badsectorlabs.com/last-week-in...

I've ported Cobalt Strike's Process Inject Kit from C to C++ BOF templates. github.com/rasta-mouse/...