Tiziano Marra (@_MrTiz) profile picture

Tiziano Marra

@_MrTiz

Penetration tester

app.hackthebox.com/profile/193753
Joined August 2018
  • Tweets21
  • Following232
  • Followers96
6Media
Photo by Tiziano Marra (@_MrTiz)Photo by Tiziano Marra (@_MrTiz)Photo by Tiziano Marra (@_MrTiz)Photo by Tiziano Marra (@_MrTiz)Photo by Tiziano Marra (@_MrTiz)
Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway. New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks. Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇 mrtiz.github.io/cet-callstac…
Image from Tiziano Marra (@_MrTiz)
1
27
1
88
5,352
Great work by @_MrTiz and a very long read! CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining mrtiz.github.io/cet-callstac…
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

A CET-compliant callstack spoofing technique that uses Windows thread-pool enum callbacks as syscall trampolines, defeating EDR stack telemetry without breaking Intel shadow-stack invariants.

mrtiz.github.io
1
15
48
3,404
Bypassed fully hardened #MicrosoftDefender on fully updated #Windows11 using only free tools: trojanized a legit MS exe with #Shellter, staged an HTTPS reverse shell with #Hoaxshell, then evaded #AMSI & #UAC, in-memory, no zero-days. Read more: mrtiz.github.io/defender-eva…

Bypassing Windows Defender on Windows 11 using Shellter and HoaxShell

Chaining Shellter Pro’s AV/EDR evasion with HoaxShell’s HTTP-based C2 to land a fully undetected reverse shell on a Windows 11 target.

mrtiz.github.io
1
139
CVE-2023-35671: #Android App Pin security issue exposes payment cards in #Google Wallet to unauthorized payments Full PoC video using @flipper_net: youtu.be/reNinRDiBkM Details: github.com/MrTiz/CVE-2023-35… nvd.nist.gov/vuln/detail/CVE… source.android.com/docs/secu… source.android.com/docs/secu…
2
8
3
38
9,751
Some blogs and online users claim that through this vulnerability it is not possible to make unauthorized payments. This is not true; in fact, if you use a real P.o.S., instead of a #FlipperZero-like device, Google Wallet makes a physical payment. Try it to believe.
239
#fakenews are free, real news are behind a paywall. :-/
4
4
3
27
Replying to @Frecciarossa_IT
@LeFrecce salvate ancora le #pwd in chiaro nei DB? La mia pwd contiene caratteri minuscoli che diventano maiuscoli nella richiesta #POST e il #login avviene correttamente, cosa impossibile se le pwd fossero "#hashate". Link bit.ly/33N6Or7 @disinformatico @evaristegal0is
Image from Tiziano Marra (@_MrTiz)
Image from Tiziano Marra (@_MrTiz)
1
2
more replies
Image from Tiziano Marra (@_MrTiz)
Image from Tiziano Marra (@_MrTiz)
Image from Tiziano Marra (@_MrTiz)
1
In passato #TrenItalia era solita inviare la password in chiaro via mail (anch'esse tuttora non criptate) nel momento in cui un utente cercava di resettarla: reddit.com/r/italy/comments/… medium.com/@silvanocerza/tre… facebook.com/Spottedtrenord/… books.google.it/books?id=G3p…

From the italy community on Reddit

Explore this post and more from the italy community

reddit.com
Dear recruiters, if you are looking for: - Java, Python, PHP - React, Angular - PostgreSQL, Redis, MongoDB - AWS, S3, EC2, ECS, EKS - *nix system administration - Git and CI with TDD - Docker, Kubernetes That's not a Full Stack Developer That’s an entire IT department
110
2,665
259
8,069
Load more