corpus.blog
56,966 blogs · [ { "id": "01a0876a-9d9e-73a2-9929-fda09639f3f8", "title": "Oh MyAudi!", "url": "https://decoder.cloud/2026/05/08/oh-myaudi/", "published_at": "2026-05-08T08:38:25+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda096d8edd0", "title": "LmCompatibilityLevel and the PDC Trap", "url": "https://decoder.cloud/2026/04/15/lmcompatibilitylevel-and-the-pdc-trap/", "published_at": "2026-04-15T14:42:15+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda097cd70e6", "title": "What Windows Server 2025 Quietly Did to Your NTLM Relay", "url": "https://decoder.cloud/2026/02/25/what-windows-server-2025-quietly-did-to-your-ntlm-relay/", "published_at": "2026-02-25T18:23:57+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda0983e7aae", "title": "Reflecting Your Authentication: When Windows Ends Up Talking to Itself", "url": "https://decoder.cloud/2025/11/24/reflecting-your-authentication-when-windows-ends-up-talking-to-itself/", "published_at": "2025-11-24T16:15:47+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda099243d42", "title": "From NTLM relay to Kerberos relay: Everything you need to know", "url": "https://decoder.cloud/2025/04/24/from-ntlm-relay-to-kerberos-relay-everything-you-need-to-know/", "published_at": "2025-04-24T09:07:07+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda099e69ae8", "title": "Changing Windows Passwords in the Most Complex Way", "url": "https://decoder.cloud/2025/02/11/changing-windows-passwords-in-the-most-complex-way/", "published_at": "2025-02-11T17:35:36+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda09a3ba527", "title": "The (Almost) Forgotten Vulnerable Driver", "url": "https://decoder.cloud/2025/01/09/the-almost-forgotten-vulnerable-driver/", "published_at": "2025-01-09T11:31:57+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda09a5332c3", "title": "Group Policy Security Nightmares pt2", "url": "https://decoder.cloud/2024/11/26/group-policy-nightmares-pt2/", "published_at": "2024-11-26T08:54:26+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda09b19e556", "title": "Group Policy Security Nightmares pt 1", "url": "https://decoder.cloud/2024/11/08/group-policy-security-nightmares-pt-1/", "published_at": "2024-11-08T11:21:28+00:00" }, { "id": "01a0876a-9d9e-73a2-9929-fda09b1fe0e3", "title": "The “Fake” Potato", "url": "https://decoder.cloud/2024/08/02/the-fake-potato/", "published_at": "2024-08-02T14:39:45+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf87574f86a", "title": "Abusing the SeRelabelPrivilege", "url": "https://decoder.cloud/2024/05/30/abusing-the-serelabelprivilege/", "published_at": "2024-05-30T20:30:30+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf8758c8a54", "title": "Hello: I’m your Domain Admin and I want to authenticate against you", "url": "https://decoder.cloud/2024/04/24/hello-im-your-domain-admin-and-i-want-to-authenticate-against-you/", "published_at": "2024-04-24T14:00:57+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf8762fe1e4", "title": "Hello: I’m your ADCS server and I want to authenticate against you", "url": "https://decoder.cloud/2024/02/26/hello-im-your-adcs-server-and-i-want-to-authenticate-against-you/", "published_at": "2024-02-26T15:50:13+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf876a02572", "title": "Do not trust this Group Policy!", "url": "https://decoder.cloud/2024/01/23/do-not-trust-this-group-policy/", "published_at": "2024-01-23T08:03:17+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf87781fd45", "title": "A “deep dive” in Cert Publishers Group", "url": "https://decoder.cloud/2023/11/20/a-deep-dive-in-cert-publishers-group/", "published_at": "2023-11-20T17:03:10+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf878061b2e", "title": "LocalPotato HTTP edition", "url": "https://decoder.cloud/2023/11/03/localpotato-http-edition/", "published_at": "2023-11-03T16:54:15+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf87838f759", "title": "From NTAuthCertificates to “Silver” Certificate", "url": "https://decoder.cloud/2023/09/05/from-ntauthcertificates-to-silver-certificate/", "published_at": "2023-09-05T16:22:39+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf8783d7c00", "title": "EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955", "url": "https://decoder.cloud/2023/02/16/eop-via-arbitrary-file-write-overwite-in-group-policy-client-gpsvc-cve-2022-37955/", "published_at": "2023-02-16T14:11:47+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf879057cf6", "title": "LocalPotato – When Swapping The Context Leads You To SYSTEM", "url": "https://decoder.cloud/2023/02/13/localpotato-when-swapping-the-context-leads-you-to-system/", "published_at": "2023-02-13T10:23:41+00:00" }, { "id": "01a0c507-0ad2-7359-a6b0-abf87944a4d5", "title": "Giving JuicyPotato a second chance: JuicyPotatoNG", "url": "https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/", "published_at": "2022-09-21T17:07:14+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df3311013", "title": "Group Policy Folder Redirection CVE-2021-26887", "url": "https://decoder.cloud/2022/04/27/group-policy-folder-redirection-cve-2021-26887/", "published_at": "2022-04-27T17:30:51+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df41093ed", "title": "A not-so-common and stupid privilege escalation", "url": "https://decoder.cloud/2022/04/25/a-not-so-common-and-stupid-privilege-escalation/", "published_at": "2022-04-25T15:26:51+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df41c8cea", "title": "Hands off my (MS) cloud services!", "url": "https://decoder.cloud/2021/04/06/hands-off-my-ms-cloud-services/", "published_at": "2021-04-06T15:08:48+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df43b030a", "title": "Hands off my IIS accounts!", "url": "https://decoder.cloud/2020/12/14/hands-off-my-iis-accounts/", "published_at": "2020-12-14T16:03:06+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df4fa3d36", "title": "Hands off my service account!", "url": "https://decoder.cloud/2020/11/05/hands-off-my-service-account/", "published_at": "2020-11-05T20:45:01+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df5082f6d", "title": "When a stupid oplock leads you to SYSTEM", "url": "https://decoder.cloud/2020/10/27/when-a-stupid-oplock-leads-you-to-system/", "published_at": "2020-10-27T17:26:46+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df5ab9ff6", "title": "When ntuser.pol leads you to SYSTEM", "url": "https://decoder.cloud/2020/10/24/when-ntuser-pol-leads-you-to-system/", "published_at": "2020-10-24T16:32:15+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df6057129", "title": "Abusing Group Policy Caching", "url": "https://decoder.cloud/2020/09/23/abusing-group-policy-caching/", "published_at": "2020-09-23T20:20:10+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df69a6877", "title": "The impersonation game", "url": "https://decoder.cloud/2020/05/30/the-impersonation-game/", "published_at": "2020-05-30T15:23:12+00:00" }, { "id": "01a0c518-13a8-71f1-b8d6-aa7df6aa60d7", "title": "No more JuicyPotato? Old story, welcome RoguePotato!", "url": "https://decoder.cloud/2020/05/11/no-more-juicypotato-old-story-welcome-roguepotato/", "published_at": "2020-05-11T14:55:17+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602f977a174", "title": "From NETWORK SERVICE to SYSTEM", "url": "https://decoder.cloud/2020/05/04/from-network-service-to-system/", "published_at": "2020-05-04T15:58:30+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fa5a9fb4", "title": "Exploiting Feedback Hub in Windows 10", "url": "https://decoder.cloud/2020/04/28/exploiting-feedback-hub-in-windows-10/", "published_at": "2020-04-28T15:36:13+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fb095525", "title": "The strange case of “open-ssh” in Windows Server 2019", "url": "https://decoder.cloud/2020/03/19/the-strange-case-of-open-ssh-in-windows-server-2019/", "published_at": "2020-03-19T16:46:21+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fb9d02d8", "title": "The strange RPC interface (MS, are you trolling me?)", "url": "https://decoder.cloud/2020/02/05/the-strange-rpc-interface-ms-are-you-trolling-me/", "published_at": "2020-02-05T18:07:46+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fc0d4686", "title": "From Hyper-V Admin to SYSTEM", "url": "https://decoder.cloud/2020/01/20/from-hyper-v-admin-to-system/", "published_at": "2020-01-20T15:28:59+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fce85bea", "title": "From dropbox(updater) to NT AUTHORITY\\SYSTEM", "url": "https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem/", "published_at": "2019-12-18T17:28:41+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fd28e060", "title": "From iPhone to NT AUTHORITY\\SYSTEM", "url": "https://decoder.cloud/2019/12/12/from-iphone-to-nt-authoritysystem/", "published_at": "2019-12-12T16:05:12+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fd70f2db", "title": "We thought they were potatoes but they were beans (from Service Account to SYSTEM again)", "url": "https://decoder.cloud/2019/12/06/we-thought-they-were-potatoes-but-they-were-beans/", "published_at": "2019-12-06T20:01:40+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fd7bb062", "title": "From arbitrary file overwrite to SYSTEM", "url": "https://decoder.cloud/2019/11/13/from-arbitrary-file-overwrite-to-system/", "published_at": "2019-11-13T20:45:04+00:00" }, { "id": "01a0c523-1d81-704a-abd7-0602fdde2d00", "title": "Creating Windows Access Tokens", "url": "https://decoder.cloud/2019/07/04/creating-windows-access-tokens/", "published_at": "2019-07-04T08:07:27+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c71689f36473", "title": "Combinig LUAFV PostLuafvPostReadWrite Race Condition PE with DiagHub collector exploit -> from standard user to SYSTEM", "url": "https://decoder.cloud/2019/04/29/combinig-luafv-postluafvpostreadwrite-race-condition-pe-with-diaghub-collector-exploit-from-standard-user-to-system/", "published_at": "2019-04-29T20:44:29+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168a021e15", "title": "Resource Based Constrained Delegation abuse explained", "url": "https://decoder.cloud/2019/03/20/donkeys-guide-to-resource-based-constrained-delegation-from-standard-user-to-da/", "published_at": "2019-03-20T10:31:30+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168a97540b", "title": "Windows Named Pipes & Impersonation", "url": "https://decoder.cloud/2019/03/06/windows-named-pipes-impersonation/", "published_at": "2019-03-06T14:16:21+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168b368b09", "title": "Demystifying Windows Service “permissions” configuration", "url": "https://decoder.cloud/2019/02/07/demystifying-windows-service-permissions-configuration/", "published_at": "2019-02-06T23:02:27+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168c1f88db", "title": "Creating Symbolic Links in Windows 10", "url": "https://decoder.cloud/2019/01/04/creating-symbolic-links-in-windows-10/", "published_at": "2019-01-04T14:42:35+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168c8db0c0", "title": "No more rotten/juicy potato?", "url": "https://decoder.cloud/2018/10/29/no-more-rotten-juicy-potato/", "published_at": "2018-10-29T18:42:23+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168d1e6912", "title": "Fear the Rotten/Juicy potato attack?", "url": "https://decoder.cloud/2018/10/01/fear-the-rotten-juicy-potato-attack/", "published_at": "2018-10-01T18:53:00+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168d555bd8", "title": "Juicy Potato (abusing the golden privileges)", "url": "https://decoder.cloud/2018/08/10/juicy-potato/", "published_at": "2018-08-10T08:48:58+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168e271c8e", "title": "“Unexpected” Windows Privilege Escalations", "url": "https://decoder.cloud/2018/03/18/unexpected-windows-privilege-escalations/", "published_at": "2018-03-18T12:51:00+00:00" }, { "id": "01a0c52e-8a5a-7029-b262-c7168e7e7dae", "title": "The power of backup operators", "url": "https://decoder.cloud/2018/02/12/the-power-of-backup-operatos/", "published_at": "2018-02-12T10:12:04+00:00" }, { "id": "01a0c539-17dd-7113-9813-a27c87107b0e", "title": "Getting SYSTEM", "url": "https://decoder.cloud/2018/02/02/getting-system/", "published_at": "2018-02-02T14:41:43+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fd169b3e", "title": "Potatoes and tokens", "url": "https://decoder.cloud/2018/01/13/potato-and-tokens/", "published_at": "2018-01-13T22:07:26+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fd5ad307", "title": "The lonely potato – part 2 –", "url": "https://decoder.cloud/2018/01/04/the-lonely-potato-part-2/", "published_at": "2018-01-04T22:09:43+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fd9f6c33", "title": "The lonely potato", "url": "https://decoder.cloud/2017/12/23/the-lonely-potato/", "published_at": "2017-12-23T15:07:40+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fe0ba7d7", "title": "We don’t need powershell.exe – 4 –", "url": "https://decoder.cloud/2017/12/13/we-dont-need-powershell-exe-4/", "published_at": "2017-12-13T16:47:11+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fe25d324", "title": "“Poor man’s process migration”", "url": "https://decoder.cloud/2017/12/11/poor-mans-process-migration/", "published_at": "2017-12-11T15:31:37+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fe8770a1", "title": "We don’t need powershell.exe -part 3-", "url": "https://decoder.cloud/2017/11/17/we-dont-need-powershell-exe-part-3/", "published_at": "2017-11-17T21:16:52+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5fea597b7", "title": "We don’t need powershell.exe – part 2 –", "url": "https://decoder.cloud/2017/11/08/we-dont-need-powershell-exe-part-2/", "published_at": "2017-11-08T18:21:47+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b5ff6ce294", "title": "We don’t need powershell.exe", "url": "https://decoder.cloud/2017/11/02/we-dont-need-powershell-exe/", "published_at": "2017-11-02T11:51:43+00:00" }, { "id": "01a0c539-17de-7047-a6fc-57b6000209c7", "title": "From Pass-the-Hash to Pass-the-Ticket with no pain", "url": "https://decoder.cloud/2017/06/30/from-pass-the-hash-to-pass-the-ticket-with-no-pain/", "published_at": "2017-06-30T20:49:13+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba60a78c0", "title": "Simple ASLR/NX bypass on a Linux 32 bit binary", "url": "https://decoder.cloud/2017/06/15/simple-aslrnx-bypass-on-a-linux-32-bit-binary/", "published_at": "2017-06-15T18:50:57+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba6dac12c", "title": "From APK to Golden ticket", "url": "https://decoder.cloud/2017/03/31/from-apk-to-golden-ticket/", "published_at": "2017-03-31T13:30:48+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba6e6e293", "title": "The road to “silver”", "url": "https://decoder.cloud/2017/03/09/the-road-to-silver/", "published_at": "2017-03-09T22:48:44+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba6ffbcc7", "title": "The “SYSTEM” challenge", "url": "https://decoder.cloud/2017/02/21/the-system-challenge/", "published_at": "2017-02-21T17:58:00+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba76ffde1", "title": "The “Golden Ticket” solution", "url": "https://decoder.cloud/2017/02/12/the-golden-solution/", "published_at": "2017-02-12T18:07:25+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba7b06bfc", "title": "Grab the Windows secrets!", "url": "https://decoder.cloud/2017/02/11/grab-the-windows-secrets/", "published_at": "2017-02-11T13:10:02+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba7ed46eb", "title": "Bypassing UAC from a remote powershell and escalating to “SYSTEM”", "url": "https://decoder.cloud/2017/02/04/bypassing-uac-from-a-remote-powershell-and-escalting-to-system-2/", "published_at": "2017-02-04T13:26:02+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba838893d", "title": "Bypassing UAC from a remote powershell and escalating to “SYSTEM”", "url": "https://decoder.cloud/2017/02/03/bypassing-uac-from-a-remote-powershell-and-escalting-to-system/", "published_at": "2017-02-03T19:45:30+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba8ceb28e", "title": "Dirty tricks with Powershell", "url": "https://decoder.cloud/2017/01/26/dirty-tricks-with-powershell/", "published_at": "2017-01-26T23:34:13+00:00" }, { "id": "01a0c542-7ca9-7252-87c0-377ba9ae9f2a", "title": "Idiot’s quick & dirty guide to buffer overflow on GNU/Linux X64 architecture", "url": "https://decoder.cloud/2017/01/25/idiots-guide-to-buffer-overflow-on-gnulinux-x64-architecture/", "published_at": "2017-01-25T23:37:13+00:00" }, { "id": "01a0c54b-5778-7362-a768-f8be325c908f", "title": "“Speedy” HTTP2 challenge on game.rop.sh", "url": "https://decoder.cloud/2017/01/07/speedy-challenge-on-game-rop-sh/", "published_at": "2017-01-07T20:27:37+00:00" } ] posts Claim your blog
Back to decoder.cloud
Blog · corpus.blog/blogs/decoder.cloud/posts

decoder.cloud

decoder.cloud

2026

Oh MyAudi!original ↗
8 May 2026
LmCompatibilityLevel and the PDC Traporiginal ↗
15 Apr 2026
What Windows Server 2025 Quietly Did to Your NTLM Relayoriginal ↗
25 Feb 2026

2025

Reflecting Your Authentication: When Windows Ends Up Talking to Itselforiginal ↗
24 Nov 2025
From NTLM relay to Kerberos relay: Everything you need to knoworiginal ↗
24 Apr 2025
Changing Windows Passwords in the Most Complex Wayoriginal ↗
11 Feb 2025
The (Almost) Forgotten Vulnerable Driveroriginal ↗
9 Jan 2025

2024

Group Policy Security Nightmares pt2original ↗
26 Nov 2024
Group Policy Security Nightmares pt 1original ↗
8 Nov 2024
The “Fake” Potatooriginal ↗
2 Aug 2024
Abusing the SeRelabelPrivilegeoriginal ↗
30 May 2024
Hello: I’m your Domain Admin and I want to authenticate against youoriginal ↗
24 Apr 2024
Hello: I’m your ADCS server and I want to authenticate against youoriginal ↗
26 Feb 2024
Do not trust this Group Policy!original ↗
23 Jan 2024

2023

A “deep dive” in Cert Publishers Grouporiginal ↗
20 Nov 2023
LocalPotato HTTP editionoriginal ↗
3 Nov 2023
From NTAuthCertificates to “Silver” Certificateoriginal ↗
5 Sept 2023
EoP via Arbitrary File Write/Overwite in Group Policy Client “gpsvc” – CVE-2022-37955original ↗
16 Feb 2023
LocalPotato – When Swapping The Context Leads You To SYSTEMoriginal ↗
13 Feb 2023

2022

Giving JuicyPotato a second chance: JuicyPotatoNGoriginal ↗
21 Sept 2022
Group Policy Folder Redirection CVE-2021-26887original ↗
27 Apr 2022
A not-so-common and stupid privilege escalationoriginal ↗
25 Apr 2022

2021

Hands off my (MS) cloud services!original ↗
6 Apr 2021

2020

Hands off my IIS accounts!original ↗
14 Dec 2020
Hands off my service account!original ↗
5 Nov 2020
When a stupid oplock leads you to SYSTEMoriginal ↗
27 Oct 2020
When ntuser.pol leads you to SYSTEMoriginal ↗
24 Oct 2020
Abusing Group Policy Cachingoriginal ↗
23 Sept 2020
The impersonation gameoriginal ↗
30 May 2020
No more JuicyPotato? Old story, welcome RoguePotato!original ↗
11 May 2020
From NETWORK SERVICE to SYSTEMoriginal ↗
4 May 2020
Exploiting Feedback Hub in Windows 10original ↗
28 Apr 2020
The strange case of “open-ssh” in Windows Server 2019original ↗
19 Mar 2020
The strange RPC interface (MS, are you trolling me?)original ↗
5 Feb 2020
From Hyper-V Admin to SYSTEMoriginal ↗
20 Jan 2020

2019

From dropbox(updater) to NT AUTHORITY\SYSTEMoriginal ↗
18 Dec 2019
From iPhone to NT AUTHORITY\SYSTEMoriginal ↗
12 Dec 2019
We thought they were potatoes but they were beans (from Service Account to SYSTEM again)original ↗
6 Dec 2019
From arbitrary file overwrite to SYSTEMoriginal ↗
13 Nov 2019
Creating Windows Access Tokensoriginal ↗
4 Jul 2019
Combinig LUAFV PostLuafvPostReadWrite Race Condition PE with DiagHub collector exploit -> from standard user to SYSTEMoriginal ↗
29 Apr 2019
Resource Based Constrained Delegation abuse explainedoriginal ↗
20 Mar 2019
Windows Named Pipes & Impersonationoriginal ↗
6 Mar 2019
Demystifying Windows Service “permissions” configurationoriginal ↗
6 Feb 2019
Creating Symbolic Links in Windows 10original ↗
4 Jan 2019

2018

No more rotten/juicy potato?original ↗
29 Oct 2018
Fear the Rotten/Juicy potato attack?original ↗
1 Oct 2018
Juicy Potato (abusing the golden privileges)original ↗
10 Aug 2018
“Unexpected” Windows Privilege Escalationsoriginal ↗
18 Mar 2018
The power of backup operatorsoriginal ↗
12 Feb 2018
Getting SYSTEMoriginal ↗
2 Feb 2018
Potatoes and tokensoriginal ↗
13 Jan 2018
The lonely potato – part 2 –original ↗
4 Jan 2018

2017

The lonely potatooriginal ↗
23 Dec 2017
We don’t need powershell.exe – 4 –original ↗
13 Dec 2017
“Poor man’s process migration”original ↗
11 Dec 2017
We don’t need powershell.exe -part 3-original ↗
17 Nov 2017
We don’t need powershell.exe – part 2 –original ↗
8 Nov 2017
We don’t need powershell.exeoriginal ↗
2 Nov 2017
From Pass-the-Hash to Pass-the-Ticket with no painoriginal ↗
30 Jun 2017
Simple ASLR/NX bypass on a Linux 32 bit binaryoriginal ↗
15 Jun 2017
From APK to Golden ticketoriginal ↗
31 Mar 2017
The road to “silver”original ↗
9 Mar 2017
The “SYSTEM” challengeoriginal ↗
21 Feb 2017
The “Golden Ticket” solutionoriginal ↗
12 Feb 2017
Grab the Windows secrets!original ↗
11 Feb 2017
Bypassing UAC from a remote powershell and escalating to “SYSTEM”original ↗
4 Feb 2017
Bypassing UAC from a remote powershell and escalating to “SYSTEM”original ↗
3 Feb 2017
Dirty tricks with Powershelloriginal ↗
26 Jan 2017
Idiot’s quick & dirty guide to buffer overflow on GNU/Linux X64 architectureoriginal ↗
25 Jan 2017
“Speedy” HTTP2 challenge on game.rop.shoriginal ↗
7 Jan 2017