Antonio Cocomazzi

@splinter_code

offensive security - windows internals | BlueSky: bsky.app/profile/splint… | Mastodon: infosec.exchange/@splinter_code

Italy

splintercod3.blogspot.com

Replies Reposts Media

Pinned
Antonio Cocomazzi
@splinter_code
Nov 3, 2023
The slides of our joint research talk “10 Years of Windows Privilege Escalation with Potatoes” at #POC2023 are out! 👉 github.com/antonioCoco/in… cc @decoder_it
4
Antonio Cocomazzi
@splinter_code
Sep 10, 2025
I’m hiring Staff Windows Security Researchers to join my XAT (eXploits and Anti-Tampering) team at @SentinelOne! 🔥 👉 sentinelone.com/jobs/?gh_jid=6… More details 👇
1
Antonio Cocomazzi
@splinter_code
Jan 29, 2025
Very interesting post by Microsoft about the internals of the new Admin Protection feature It seems they have patched my SSPI UAC bypass based on NTLM as well as the Kerberos UAC bypass in which both were able to bypass AP as well More details here 👇
Evolving the Windows User Model – Introducing Administrator Protection | Microsoft Community Hub
From techcommunity.microsoft.com
2
Antonio Cocomazzi
@splinter_code
Dec 20, 2024
Nice catch 👇 A good bypass for abusing the SeLoadDriverPrivilege from a non-admin user (in case of a misconfig)
sixtyvividtails
@sixtyvividtails
Dec 19, 2024
Looks like this mitigation was added in 1803, build 17134. It would be sad 😸 if someone would seamlessly 𝐛𝐫𝐞𝐚𝐤 𝐢𝐭 via user-writeable subkeys under the "\Registry\Machine". Like, you know, HKLM\System\CurrentControlSet\Control\Nsi\{eb004a1c-9b1a-11d4-9123-0050047759bc}\0.
Antonio Cocomazzi
@splinter_code
Nov 28, 2024
Then ask about the difference between Sysinternals vs impacket psexec
Justin Elze
@HackingLZ
Nov 28, 2024
“Know your tools” Pick 10 random infosec people and ask psexec works under the hood