Exploiting the Synology TC500

Covers a format-string exploit developed for a smart camera, enabling RCE in a LAN micro­service, though it wasn’t deployed.

https://blog.infosectcbr.com.au/2025/08/01/exploiting-the-synology-tc500-at-pwn2own-ireland-2024/?ref=blog.exploits.club

#formatstring #RCE

Qualcomm DSP Kernel Internals

Explains core architecture and components of Qualcomm’s FastRPC-based DSP kernel driver.

https://streypaws.github.io/posts/DSP-Kernel-Internals/

#Qualcomm #DSP

Attacking GenAI applications and LLMs

LLM prompt attacks leak data, abuse tools

https://security.humanativaspa.it/attacking-genai-applications-and-llms-sometimes-all-it-takes-is-to-ask-nicely/

#AI #promptInjection

Doublespeak Chat LLM Escape Game

Web-based text adventure challenges users to jailbreak LLM prompts across levels, showing prompt injection risks and evaluating countermeasures.

https://doublespeak.chat/

#AI #promptInjection #llm

Implementing Channel Binding in mssqlclient.py

Walkthrough adding Channel Binding support to Impacket's mssqlclient.py, detailing CBT basics, implementation hurdles, and testing against NTLM relay.

https://sensepost.com/blog/2025/a-journey-implementing-channel-binding-on-mssqlclient.py/

#Database #NTLM

Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5

Firmware downgrade exploit enables persistent code on Thermomix TM5

https://www.synacktiv.com/en/publications/let-me-cook-you-a-vulnerability-exploiting-the-thermomix-tm5.html

#IoT #embedded

Hands-On OT Cyber Range

Interactive OT/ICS lab delivers real environments for hands-on training, pentesting, IDS tuning, and SIEM validation, deployable in minutes.

https://labshock.github.io/

#OT #ICS #lab

PiCCANTE – Vehicle CAN‑Bus Tool on Raspberry Pi Pico

A toolkit enabling exploration and manipulation of vehicle CAN bus networks via a Raspberry Pi Pico platform, offering multiple CAN interfaces, USB/SLCAN support, Wi‑Fi, web UI, Bluetooth, MITM and logging.

https://github.com/Alia5/PiCCANTE

#canbus

remoteKrbRelayx – Kerberos Auth Relay via DCOM/RPC

A Python tool enabling coercion and relaying of Kerberos authentication over DCOM and RPC, using remote coercion and RPC-based relay techniques to target Active Directory environments

https://github.com/OleFredrik1/remoteKrbRelayx

#Kerberos #relay

RAITrigger – Local SYSTEM Authentication Trigger for Relaying

A low‑privileged domain user can call the RPC function RAiForceElevationPromptForCOM in appinfo.dll to trigger SYSTEM‑level authentication to an arbitrary UNC path, enabling NTLM relay or ADCS attacks in domain environments.

https://github.com/rtecCyberSec/RAITrigger/

#LPE #RelayAttack