S3cur3Th1sSh1t (@ShitSecure) / X

Pinned

S3cur3Th1sSh1t

@ShitSecure

Jul 14

Check this out if you didn't already, more to follow! 🔥🤠

MSec Operations

@MSecOps

May 2

Our first Blog post is live, Introduction to RustPack 🔥 msecops.de/blog/posts/rus… More to follow in the future for sure!

S3cur3Th1sSh1t

@ShitSecure

Oct 21, 2021

OffensiveVBA is published. Take a look. PR's are very welcome as I'm 100% sure it's missing many things.🍻

GitHub - S3cur3Th1sSh1t/OffensiveVBA: This repo covers some code execution and AV Evasion methods...

Bypass AMSI in 2025, my newest blog post is published 🥳! A review on what changed over the last years and what's still efficient today. en.r-tec.net/r-tec-blog-byp…

S3cur3Th1sSh1t

@ShitSecure

Jul 8, 2023

This looks promising:

GitHub - lem0nSec/ShellGhost: A memory-based evasion technique which makes shellcode invisible from...

This is so much! 🔥🔥😎 Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.

GitHub - warpnet/MS-RPC-Fuzzer: Gain insights into MS-RPC implementations that may be vulnerable...

Searching for DLL Sideloading binaries? A short Powershell Script in combination with Siofra will give you thousands of possible combinations. github.com/Cybereason/sio… Either try to replace any Windows DLL Import with your payload DLL or search for Phantom DLLs.

S3cur3Th1sSh1t

@ShitSecure

Jan 31, 2021

A tale of EDR bypass methods - s3cur3th1ssh1t.github.io/A-tale-of-EDR-… Special thanks to @_EthicalChaos_ and @_RastaMouse for answering all my questions! 🍻

S3cur3Th1sSh1t

@ShitSecure

May 19, 2023

My team mate @m_fielenbach recently created a python script to automate the process of discovering and exploiting ESC1 & ESC8 ADCS vulnerabilities: 🙌 github.com/grimlockx/ADCS… So if you want to save some minutes of time in your next projects feel free to test it out. 🔥

S3cur3Th1sSh1t

@ShitSecure

Nov 20, 2021

Little Potato tool release - credit to @splinter_code for helping me out: github.com/S3cur3Th1sSh1t…

S3cur3Th1sSh1t

@ShitSecure

Jan 11, 2021

Encrypting .NET assemblies and decrypting them at runtime patching AMSI and blocking ETW before execution via Nim works like a charm! 🙂

S3cur3Th1sSh1t

@ShitSecure

Nov 10, 2022

I really like DeepL for translations. But I also like the fact, that when using the Desktop APP is makes use of an signed executable named CreateDump.exe in %APPDATA%, which can dump e.g. LSASS 🧐🤩

S3cur3Th1sSh1t

@ShitSecure

Sep 27, 2025

You got access to vsphere and want to compromise the Windows hosts running on that ESX? 💡 1) Create a clone into a new template of the target VM 2) Download the VMDK file of the template from the storage 3) Parse it with Volumiser, extract SAM/SYSTEM/SECURITY (1/3)