bof2pico: Simple helper utility for converting BOFs into PICOs (with hardcoded arguments) that celebi knows how to understand. github.com/ofasgard/cel... Thanks to @rastamouse.me for the suggestion to include a format specifier with the arguments!

New post about a CET compatible stack spoofing technique and a loader integrating it :) bigbingus.com/posts/bingus... github.com/Sizeable-Bin...

BingusLdr: CET Compatible Stack Spoofing | bigbingus.com

BingusLdr: CET Compatible Stack Spoofing

bigbingus.com

Got a little bof2pico tool working (based on @raphaelmudge.bsky.social's "Simple BOF Runner") to convert BOFs into PICOs that celebi knows how to execute :) parsing arbitrary argument datatypes into the BOF argument format is a little more challenging, though.

I've published CrystalForge, a Crystal Palace-based project that brings custom Crystal Palace loaders into AdaptixC2. Provide a .spec file, and the agent plugin handles the intermediate DLL linking and shellcode generation. github.com/k1ng0fn0th1n...

Taking a break from other projects, so just a small one for now: I made a little proof-of-concept HTML smuggling implementation using Rust's web assembly support: github.com/ofasgard/smu...

I did some garden tending: Updated the TCG community pavilion. Added some projects and posts. Re-organized the projects section. I also added a note about ground truth curation vs. provenance for red team use. Something I wrestled with/put some thought into. tradecraftgarden.org/references.h...

Every shell and terminal emulator ever with 100% confidence that they're doing the right thing for the user: ^[[A^[[A^[[A^[[A^[[A^[[A^[[A

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

If you're a C2 engineer, I encourage you to watch @rastamouse.me 's expanding Crystal C2 docs. It's a World-of-tomorrow exhibit for what C2 architecture could be. Use-time capability composition, radical instrumentation opportunity, & reducing agent's burden rasta-mouse.gitbook.io/crystalc2/do...

Welcome | Documentation | CrystalC2

rasta-mouse.gitbook.io

Bypassing EDR in a Crystal Clear Way by x.com/LorenzoMeacci Blog: lorenzomeacci.com/bypassing-ed... Project: github.com/kapla0011/Ka...

Bypassing EDR in a Crystal Clear Way | Lorenzo Meacci

Most operators spend days engineering the perfect shellcode loader and ship the payload naked. This blog takes you from how C2 payloads actually work under the hood all the way to building a fully eva...

lorenzomeacci.com

Got dynamic PICO upload and execution working on Celebi :) both agent and uploaded capability are all written in pure Crystal Palace C, which means this is now starting to vaguely resemble a usable (though opsec-unsafe) implant!

Hello prospective employer, I have various useful skills such as: - write malware - eat hot chip - lie Wait, where are you going?

Are one-way trusts really one way? @lowercasedrm.bsky.social sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets. offsec.almond.consulting/trust-no-one...

Still very much an early WIP, but the Crystal Palace-based Mythic agent I'm working on can be found here: github.com/ofasgard/cel...

Hiya! Anyone in the SF Bay Area/Remote need a cool programmer for your team? I've been messing with computers for over 30 years now, I can program anything with bits, and I've got a lot of experience with all sorts of different systems, environments, and languages. wiki.averlong.com/My_Resume

Started working on a Mythic agent that uses Crystal Palace to generate its shellcode. So far I've just got it to emit some generic shellcode - it doesn't talk to Mythic yet. I'm hoping to make a fully modular agent that you can patch your tradecraft into when you generate a payload :)

If your lab environment doesn't have a dumb theme, what's even the point?

If Minnesota soccer moms in signal chats can figure out compartmentalization and redundancy so can fucking IoT vendors

The Islands of Invariance More than I ever thought I'd write about Yara signatures. Oh also, Crystal Palace has a Yara rule generator too. aff-wg.org/2026/02/02/t...

The Islands of Invariance

Crystal Palace now has a Yara rule generator. In this blog post, I’ll walk you through the design and evaluation of this feature. rule PageStream_rDLL_03495de1 { meta: description = “PageStre…

aff-wg.org

This pretty much nails what underlies all the hype about sentient AIs.

Pavel@spavel.bsky.social · 6mo ago

Cobalt Strike blog ppost by x.com/joehowwolf on using Crystal Palace to mash-up Page Streaming and Draugr Call Stack Spoofing into a Cobalt Strike UDRL. (Again, I really love the comics. They are perfect).

Cobalt Strike@cobaltstrike.bsky.social · 6mo ago

Playing in the (Tradecraft) Garden of Beacon and finding Eden. In our latest blog, learn how to utilize Crystal Palace, an open source project from Cobalt Strike creator Raphael Mudge, to rapidly combine different capabilities to create novel loaders/PIC tradecraft. https://ow.ly/zxMP50Y1NQ5

low erth orbit perfec t size for put datacenter in to n\ap! outside very Soft and Comfort datacenter hum soundly in Low Earth Orbit. Put Datacenter in Low Earth Orbit. no problems ever in low earth orbbt because good Temperature and Sun exposure for datacenter hot of radiation.

Is it cursed to pass arguments to the assembly in execute-assembly-pico using the linker variables introduced in the new Crystal Palace?

My PICOs and unit testing library have been updated for the newest version of Crystal Palace and LibTCG :)

Nothing like a two-week holiday to completely kill your momentum on all of your projects! Not that I'm complaining... but how do I write assembly again? 🤔

LibCPLTest: A shared library for Crystal Palace that allows you to unit test your PICOs. It's nothing too fancy, just a few helper functions and a macro, but it's helped me to create a consistent framework for testing my PIC capabilities. github.com/ofasgard/Lib...

There are two wolves inside of me. One is a grotty little hacker that wants to make stuff that barely works, and the other is a software dev who wants to do ✨Test Driven Development✨

I don't think the ecosystem is quite there yet, but I feel like we're so close to being able to perform fully automated fuzzing of modular tradecraft vs. EDR detections using Crystal Palace...