Mike Alfaro (@_mmpte_software) and Tyler Booth (@tyler_dru1d)
An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges due to an improper DACL being applied to the device the driver creates.
Incorrect Acess Control
| # To use the function, call it like this: | |
| # iex(new-object net.webclient).downloadstring("https://gist.githubusercontent.com/LuemmelSec/208b8ba52b645ec189031d2b5200f76e/raw/c6c1008da1b5670d3fb549578968c2a2f086a00b/Get-SPVersionInfo.ps1") | |
| # Get-SPVersionInfo -ServerUrl "https://my-sharepointserver" | |
| function Get-SPVersionInfo { | |
| param ( | |
| [string]$ServerUrl, | |
| [switch]$SkipCertificateCheck, # Flag to skip certificate checks | |
| [switch]$SkipHttpErrorCheck # Flag to skip HTTP error handling | |
| ) |
| import requests | |
| import sys | |
| API_KEY = 'API-KEY-GOES-HERE' | |
| # ANSI color codes | |
| BLUE = '\033[94m' | |
| RED = '\033[91m' | |
| PURPLE = '\033[95m' | |
| GREEN = '\033[92m' |
| #!/usr/bin/env python3 | |
| """ | |
| M365 OSINT Reconnaissance Tool | |
| Based on techniques from: https://dstreefkerk.github.io/2025-07-m365-email-osint-after-lockdown/ | |
| This script performs modern M365/Azure AD reconnaissance after Microsoft's lockdown of traditional | |
| enumeration methods. It uses multiple validation techniques to discover organizational information | |
| and attempts to infer MOERA domains. | |
| """ |
