James Forshaw

The Entrypoint 2027 CFP review is complete! Huge thanks to our review board for their hard work. Many thanks to all participants for your great submissions, now please keep an eye on your inbox! Full lineup and ticket sales coming soon. entrypoint.fr

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? projectzero.google/2026/09/wind...

I've put up the slides from my Zer0Con 2026 presentation on Administrator Protection. github.com/tyranid/info...

In the final part of his blog series, @tiraniddo.dev tells the story of how a bug was introduced into a Windows API. Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process. projectzero.google/2026/02/gphf...

Part 2 of @tiraniddo.dev’s Windows Administrator Protection journey is here! projectzero.google/2026/02/wind...

No security feature is perfect. @tiraniddo.dev reviewed Windows’ new Administrator Protection and found several bypasses. projectzero.google/2026/26/wind...

Good Monday morning tech nerds. One of my devs wrote *another* blog post about kerberos (I'm creating an army of crazy bloggers). This one you might consider bookmarking.

🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live: 🪞The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos: blog.redteam-pentesting.de/2025/reflect...

We are removing default admin in Windows 11, get your apps ready now blogs.windows.com/windowsdevel...

@tiraniddo.dev and Eugene Lim—authors of Windows Security Internals and From Day Zero to Zero Day—are at Off-By-One doing what they do best: giving keynotes and running a smart device hacking village, respectively. offbyone.sg

Maybe I’ll pop down to sf for rsa tomorrow. I’ve fortunately never gone before but this is my last chance and I really need a new ai security product.

I took a look at the changes to Microsoft Recall, which is rolling out to compatible Windows devices soon. Photographic memory that stores all your deleted messages, keystrokes etc 😅 doublepulsar.com/microsoft-re...

KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;) github.com/decoder-it/K...

I can now see why my email offering to give the NSA exclusive access to an ultra rare uber 1337 EoP in Windows NT 3.1 bounced 😭 Truly the dumbest timeline.

hey quick question does Goliath win in that story

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

My RDP IO Lab presentation on "Decrypting and Inspecting RDP traffic in Wireshark" was just *cancelled* - apparently Microsoft decided they would only do internal presentations, with no guest speakers 😠 What's the point of even trying when you get treated like this?

It's good to see some of the "authentication" vectors being patched in Admin Protection. I might look at it again once it's actually considered complete, don't want MS on my back again :D

In our latest article, @croco_byte proposes an implementation of a trick discovered by James Forshaw in his research regarding Kerberos relaying. Discover how to perform pre-authenticated Kerberos relay over HTTP with our Responder and krbrelayx pull requests! www.synacktiv.com/publications...

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...

Azure Trusted Signing is now available for individuals techcommunity.microsoft.com/blog/microso...

You know you travel too much when you get top tier status on the three main airline alliances at the same time. Fortunately moving back to the UK will probably mean I’ll slow it down as I doubt I’ll travel much to the USA anymore.

It took me about a month, but I've got my win32-appcontainer-tools ready to share. - Launch Win32 apps in AppContainer - Set ACL permissions per-container - ETW tracing for Permissive Learning Mode Special thanks to Fredrik Orderud, @tiraniddo.dev and Helge Klein.

Either Keir Starmer is the biggest mark to ever live or he's still hoping for a few 'freebies' from his corpo mates. I cannot understate how atrocious this is.

Project Zero is hiring 🎉 Please share with anyone you think would be great for the team www.google.com/about/career...

Just unrestricted an issue that shows a fun new attack surface. Android RCS locally transcribes incoming media, making vulnerabilities audio codecs now fully-remote. This bug in an obscure Samsung S24 codec is 0-click project-zero.issues.chromium.org/issues/36869...

I've been dealing with mysterious high CPU utilization from WmiPrvSE.exe for MONTHS. I finally did some digging using github.com/luctalpe/WMI... (run wmimon from an elevated cmd prompt). Guess what the culprit was?

I added a true 14-bit MIDI mode to my controller and it's very smooth indeed. Ableton Live maps it with no issues and while I had to make a slight compromise on speed, the high resolution accuracy over a 100mm fader feels great. Boring details to follow. #gameaudio #gamedev #screenshotsaturday

Anyone who says UK food is terrible clearly doesn’t know about the greatest culinary invention yet conceived.

Ever wanted to know what data #PowerShell or other programs send to AMSI. I wrote a C# COM server implementation that logs this data as a JSON string. Had some fun learning more about COM and .NET AOT with this little project github.com/jborean93/Am...

A companion blog to my Bluehat 2024 presentation on OleView.NET is up now. googleprojectzero.blogspot.com/2024/12/wind...

PSA, if you’re doing slides for a conference presentation always assume the bottom quarter of the slide can’t be seen so don’t put anything important there. This isn’t a criticism of this specific talk it’s a common issue. Some blame can be levied at the conference as well for the setup.

I'm going to be at Blackhat Europe 2024 this Wednesday and Thursday. I should also be at BSides London. Just in case anyone wants to find me to sign a book or complain about something Windows related :D

Lol, found a new PPL injection technique which works on Win11 24H2 (admittedly needs admin, but not that bothered about that). I'll try and blog about it at some point :)

for anyone out there who wants to download vmware "now that its free", but doesnt want to go through the fucking cirque de soleil trapeze act of auth and redirects and entitlements, someone on masto linked me to this - where you can just fetch ... everything, without need for their bullshit!

@remkoweijnen.bsky.social I've stopped interacting with the bad site now, but I did notice you asked about a signed copy of my book. I might be able to get you one, depending on logistics :)

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

First draft is out Fiddler - Mistakes and Happy Accidents textslashplain.com/2024/11/24/f...

Awesome that MS are supported and documenting VBS enclaves properly. learn.microsoft.com/en-us/window.... Also awesome that in the example exported entry point they provide they don't seem to mention how careful you need to be with the input pointer that you don't just read/write enclave memory :)

#pico8 ?"\^!5f101😐<😐1🐱2🅾️◆?7♥웃8☉2" ::_::u=rnd(128)v=rnd(128)g=u-99h=v-64d=max(20,sqrt(g*g+h*h))c=9+d/20+rnd() if(v>65)p=v-64z=120/(v-64)x=(u-64)/p d=sqrt(x*x+z*z)s=z/d+x/d/4w=(z+sin(x/3+t()/8)+rnd())%4c=w+(c-w)*min(z/40+s^14/4,1) pset(u,v,c)goto _

Following my prev tweet, my Kerberos MITM relay/forwarder is almost finished! It targets for example insecure DNS updates in AD, allowing DNS name forgery. It intercepts, relays, and forwards traffic, with the client unaware. Currently supporting smb->smb and smb->http (adcs)

Interesting blog post from Synacktiv on relaying kerberos over smb (based on the work of @decoder-it.bsky.social and @tiraniddo.bsky.social ) www.synacktiv.com/publications...

Paged Out! Issue #5 is out now! pagedout.institute?page=issues.... Happy reading!

The past really is a different country.

Thanks LinkedIn, maybe you’re another service I don’t need.

My latest OleView.NET calls proxy methods by generating a NDR marshaling class and calling the underlying IRpcChannelBuffer. This doesn't work if the interface is in process as there's no RPC channel. I _just_ realized I have the stub instance so I can join to two to call in-process methods 🤦‍♂️

🍻