BOF, to run in-memory PE files, not just DotNet assemblies.

BOF, to run in-memory PE files, not just DotNet assemblies.

That's cool! The research discusses new methods for recovering NTLM hashes from encrypted credentials protected by CredGuard in Windows.

This tool was presented at Source Zero Com 2022. In short: you throw a compiled binary, tulza removes known Ios strings from the binary, signs with a certificate from another binary, well, and helps to bypass EDR (by increasing the file size)
![]()
Quite an interesting analysis on the example of Avast

Next week, BlackHat Europe, and now new tulzas have already gone (or rather, a coolly redesigned old ones).

Many channels have already published ProxyNotShell PoC

New surprises in AD CS... Let's add the ESC11 technique?
![]()
Report: Cobalt Strike. Tactics of modern threats

What is TTL?
• TTL (Time To Live) is a special indicator in the header of an IP packet that determines the lifetime of the packet. It is needed to prevent loops in the network (So that the packet does not run in a circle, from one router to another).

Human Benchmark - a test of our performance
Performance test, benchmark is a control task necessary to determine the comparative performance characteristics of a computer system. And HumanBenchmark is a human benchmark that includes checking the reaction speed and your memory.

Asteroids
Asteroids is a free operating system for smartwatches from various manufacturers, based on OpenEmbedded, libhybris and Qt5.
