Kallisti

Digital being trapped in an analog body.

Some Machine Spirits seem to like me better than they like the people running them.

Profile picture by LEIXV (https://vgen.co/LEIXV)

Profile banner by wolisa (https://vgen.co/wolisa)

Website: https://ti-kallisti.com
Code: https://codeberg.org/Ti-Kallisti
Free Wisdom: https://souporsandwich.org/

Public Key

npub1vwekyz6963j3z9tzhxkq2yrlf5ksl5qzksxzl3vtpeg74vzj62wspel865

NIP-05 Address

kallisti_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsx8vmzpdzageg3z43tntq9zpl56tg06qptgrp0ck9su502kpfd98gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsreq805

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1vwekyz6963j3z9tzhxkq2yrlf5ksl5qzksxzl3vtpeg74vzj62wspel865

Show more details

Last Notes

2026-07-16 18:30:04 UTC

- reply

In the spirit of not being subconsciously influenced when consuming content, I will also not watch Odyssey.

2026-07-15 15:10:18 UTC

- reply

The funny thing is, there is a second, non-vulnerable fallback already in place when the first fallback fails (could be for any number of reasons: the file doesn't exist, the file is locked, the file is not a valid hive...).
So for a fix they could just skip the first fallback. Or check ownership. Or do any number of things that are not the current behavior ^^

2026-07-15 15:01:22 UTC

Maybe a bit of an explanation why it does this:
When a new user is logging on, Windows needs to load the users class hive. Since the user isn't logged on before logging on (tautology, I know), it can't be loaded in the context of the user. So it is loaded in the context of NT AUTHORITY\SYSTEM.
LegacyHive abuses this.
It messes with the Windows Object Manager and instead of the actual UsrClass.dat hive points at C:\randomGUID\UsrClass.dat. then it places an oplock on that file and starts an (interactive) logon for the user whose Object Manager path has been manipulated.
This leads Windows to try to open the file, but it can't, because of the Oplock. So the process looks at the Object Manager namespace again, finds a symlink (also manipulated by LegacyHive) and loads that instead, attaching it as the class hive for the user it is trying to create an interactive session for.
The load succeeds because, as I mentioned earlier, Windows falls back to NT AUTHORITY\SYSTEM when it doesn't have a user context yet.
Hope this makes at least some sense :blobcatgoogly2:
https://infosec.exchange/@kallisti/116924531318272148
#LegacyHive #NightmareEclipse

2026-07-15 13:51:26 UTC

- reply

Findings so far:
It's rather trivial to point LegacyHive at other hives, e.g. using symlinks.
The process that loads UsrClass.dat doesn't bypass Kernel locks, however (this is very much expected and would be a brand new vulnerability if it weren't the case), and so direct access to SAM/SECURITY/SYSTEM is not possible.
I was thinking maybe some WillNotFix stuff from M$ could come in handy, but no such luck so far. Currently out of ideas, gonna sleep on it.

2026-07-14 19:43:31 UTC

- reply

It doesn't require the target/victim user's creds.
Just any user's creds are fine
At least that's what I get from currently sifting through the code, trying to make sense of it

2026-07-14 18:19:23 UTC

- reply

Is this pressure or motivation?
Anyway, time for caffeine!

2026-07-14 18:17:45 UTC

- reply

(No promises, though)

2026-07-14 18:17:31 UTC

- reply

Of course!
If I do get it to work, I'll dump the code on codeberg

2026-07-14 18:14:57 UTC

- reply

Shiny!
When I find the time, I want to check if it can access the SAM Hive with some modification and how EDRs react to that.

2026-07-14 18:09:49 UTC

- reply

Be gay, do crime includes cybercrime

2026-07-14 18:06:53 UTC

- reply

It's here, yay!
Though, once again, defanged.
Which I guess is a good middle-ground between responsible disclosure and sending a message.

2026-07-14 12:46:52 UTC

- reply

Too many feds

2026-07-14 12:41:00 UTC

Too many sweats

2026-07-10 16:19:56 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/896/582/997/224/698/original/0d710342828e361d.jpg

2026-07-02 09:45:15 UTC

- reply

Where do eBooks fall in the PHONEBADBOOKGOOD scale?

2026-07-01 15:13:30 UTC

- reply

New blog post!
The title should be self-explanatory, it's an appreciation post for Nightmare Eclipse.
You might notice that the tone is a bit more emotional/angry than my usual style of writing.
This one's personal.
https://ti-kallisti.com/general/ms/nightmare-eclipse.html
#NightmareEclipse #Microsoft #Hackers #InfoSec #SecurityResearch #ChainsawMan #Reze

2026-06-22 20:51:49 UTC

- reply

New blog post!
I recently completed the OffSec Expert Penetration Tester (OSEP) certificate.
Here are my thoughts on it:
https://ti-kallisti.com/certs/osep.html
#InfoSec #RedTeam #RedTeaming #EDR #Offsec #Metasploit

2026-06-17 22:01:14 UTC

- reply

This is about (DF)IR, isn't it?

2026-06-16 07:42:51 UTC

- reply

I wonder if the people pretending not to know what a glowie is are glowies, if they're new to the Internet or if they just never learned basic OPSEC.
Fascinating.

2026-06-12 10:35:22 UTC

https://bumsrake.de/
> The CVSS people, very sad people, sometimes the worst people, capped severity at 10.0. We had to invent a new scale because this bug demanded it. Tremendous demand. 13/10. Nobody knew kernel bugs could be this big. Many such cases.
#FreeBSD #Bumsrakete

2026-06-11 14:00:04 UTC

- reply

Okay, yeah, that's really bad.
The design philosophy of "making customers dependent on you" is way too pervasive in tech

2026-06-11 13:50:53 UTC

- reply

I think all of them overpromise.
But BitDefender is what I'm currently testing my Evasion techniques against, and it's a tough nut crack.
And if something works against it, it usually translates well to other EDRs as well.
But take it with a grain of salt, this coming from an attacker... :ablobcatneon:

2026-06-08 21:16:14 UTC

- reply

Enriched IPv6?
Sounds dangerous.
Is that what Low-Orbit Ion Cannons are powered by?

2026-06-01 22:36:03 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/677/235/665/492/774/original/ff813f58298039e4.jpg

2026-06-01 15:01:21 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/675/445/697/064/985/original/4a16358ab6862d8e.jpg

2026-06-01 13:34:29 UTC

- reply

Snake Oil for the Snake Oil Good!

2026-05-27 21:45:02 UTC

- reply

Why stop at 4?

2026-05-20 17:03:02 UTC

- reply

That's very fair.
Good to know, thanks/

2026-05-20 16:57:09 UTC

- reply

Are there some vague guidelines for what wouldn't be accepted?

2026-05-20 16:55:58 UTC

- reply

Fair, but consider:
Cost of travel
(both time and money)

2026-05-20 16:51:24 UTC

- reply

Hot take, but...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/607/934/827/094/953/original/c24bccd96d34557a.jpg

2026-05-20 14:21:46 UTC

- reply

I'd think that putting a backdoor in encryption software would violate some security best practices

2026-05-19 14:59:08 UTC

- reply

Big mistake.
But I can imagine that it's not too uncommon.

2026-05-19 14:56:51 UTC

- reply

And while one might belittle AI slop - and rightfully so - that doesn't absolve from being able to defend against it.
If that is the case, I think these positions are not necessarily contradictory

2026-05-19 14:54:44 UTC

- reply

"Ha, they 0wned us with a ten year old metasploit module. Such script kiddies!"
- someone, somewhere, presumably

2026-05-18 22:49:50 UTC

- reply

I read this as
"cR0w is automatic, you have to opt out"
:blobcatgiggle:

2026-05-17 18:54:11 UTC

- reply

Can't imagine this going wrong in any way
"I'm sorry, Ma'am, but we don't sell large pepperoni pizzas..."

2026-05-14 21:06:57 UTC

- reply

iptables -A INPUT -p tcp --dport 3389 -j ACCEPT
It's just more convenient this way, y'know? :ablobcatwink:

2026-05-13 18:47:43 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/568/752/790/693/824/original/e2216212422b028d.jpg

2026-05-12 16:21:16 UTC

- reply

Boil 'em, mash 'em, put 'em in a stew?

2026-05-12 16:17:04 UTC

Someone should invent a (plant-based) food that's only protein and fibre.
And then we should abolish all other food.
I think that would improve things a lot.

2026-05-04 16:54:54 UTC

- reply

Neat
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/517/348/890/987/418/original/affdec4e5d7c0732.jpg

2026-05-02 17:04:00 UTC

- reply

What getting marginalized as a midwit does to a mf

2026-04-30 19:45:24 UTC

New blog post!
This time I talk about my new favorite evasive shellcode loader, Charon. I give a brief overview about what it does, how it works and which techniques it uses.
Also a brief addendum for enjoyers of bloated Implants such as Sliver.
https://ti-kallisti.com/general/ms/descending-into-hades.html
#InfoSec #Malware #Shellcode #RedTeam #RedTeaming #Pentesting #Charon #Sliver #Merlin #Mythic

2026-04-29 17:09:11 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/088/777/784/747/original/6986dfd0b8cacc21.jpg

2026-04-29 14:00:48 UTC

Should I get myself a Blåhaj?

2026-04-22 22:55:56 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/450/821/371/669/437/original/39a591e1a3badd5b.mp4

2026-04-17 20:20:22 UTC

- reply

Just to suffer?

2026-04-14 13:34:57 UTC

- reply

Jokes aside, you're obviously right.
I just don't know what can be done about it

2026-04-14 13:34:30 UTC

- reply

So you're saying that we need an InfoSec Alex Jones, selling us water purifiers? :abloblamp:

2026-04-14 13:28:28 UTC

InfoSec is mostly a snake oil industry, sure.
But a lot of these manager types seem to be craving snake oil.
So... Let them drink snake oil, I guess?

2026-03-23 19:28:20 UTC

- reply

Either this was bureaucratic overkill, or they noticed something dangerous that they're not willing to disclose yet?

2026-03-19 18:07:56 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/257/166/252/600/403/original/eef1aba1d8f66ea2.jpg

2026-03-16 17:15:35 UTC

- reply

I think an important step that can already be taken now to maximize the upsides of the inevitable crash is to ask representatives to prevent "too big to fail" measures.
The crash needs to be fatal and absolute. Sure, that might cause temporary pains, but the alternative would be - and pardon the analogy - corpses of corporations being kept in a semi-alive state at the costs of thousands of souls every day.
Another important preventive measure is already taking place in a lot of communities: Building and maintaining infrastructure and software free of nondeterministic bullshit generators.

2026-01-31 14:13:18 UTC

- reply

Why is this phrased like a LinkedIn post?

2026-01-27 16:27:16 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/967/998/885/635/428/original/9475bc12bd3695ed.png

2026-01-20 20:31:36 UTC

- reply

Can't remember seeing Cirno smile before.
That's nice.

2025-11-10 12:27:45 UTC

- reply

HR was a mistake
We need to go back