Bad Sector Labs

🏟️ Ludus launched 2 years ago and the community embraced and extended it with write-ups, roles, configs, and environments. We're excited to see what you build with Ludus 2! (1/4)

After you finish patching your PHP, don't forget about the CA compromise from yesterday! Here is a role you can demo it in your lab: github.com/badsectorlab... Mint an EV cert for any domain, and code sign any binary! Keep windows offline - update is aggressive!

At DEF CON and want to customize your badge? Use our web based image transfer (Chrome/Edge only for web serial support) and rock the 🏟️ Ludus logo or upload your own! badge.ludus.cloud We're in the Red Team Village if you want to say hi!

Come learn new "tactics" at the Red Team Village! These are hosted on an offline 🏟️Ludus cluster (3x MS-A2) but if the table is full you can access a cloud hosted version as well (from the conference only for now). Look for the guys w/ village badges to chat Ludus. See you there!

Ludus Feature Friday! The new 2.2.0 release brings "sources" which allow you to easily add blueprints, templates, and roles to your Ludus host. We even converted GOAD to a fully Ludus-native blueprint! Check out the full change log and video here: ludus.cloud/changelog/2....

Relax and unwind in the Tradecraft Garden aff-wg.org/2026/06/01/r... Celebrating one year of Tradecraft Garden. 40 blog posts. ~30 POCs/projects. A lot of thank you's inside. The release itself: stack unwinding data generation, reference relaxation in the linker, and COFF mixing (+disco baby!)

CopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency. github.com/badsectorlab...

🏟️❤️🤖 Ludus MCP/Skills (@badsectorlabs), Grapefruit 📱 security suite (@CodeColorist), 2 Citrix NetScaler posts (@AlizTheHax0r + @_mccaulay), 🔒 BIOS bypass (@craigsblackie), and more! blog.badsectorlabs.com/last-week-in...

The FCC bans all new foreign routers, Delve was a compliance as a service scam, ForceHound, VMKatz, and more! blog.badsectorlabs.com/last-week-in...

Ludus 2 (@badsectorlabs), new GOAD lab (@M4yFly), 🍪 hack (@XeEaton), DPAPI + Nemesis (@harmj0y + @tifkin_), iOS exploit kit found (@Mandiant), and more! blog.badsectorlabs.com/last-week-in...

We try hard to do this with Ludus. We've gotten huge value from the Ludus Discord and watching what people struggle with or have to fight to get to work and that makes us try to solve that issue in Ludus itself. It's a balance of not adding every little feature though, so there is art to it.

A Scalpel, A Hammer, and a Foot Gun aff-wg.org/2026/03/03/a...

SolarWinds RCE (@chudyPB), Windows 11 Recall-based LPE (@filip_dragovic), Robot RCEs (@olivier_boschko + @ruikai), EDR as a RAT (@p0w1_), and more! blog.badsectorlabs.com/last-week-in...

Firefox RCE (@kqx_io), Havoc Professional (@C5pider + @0xC4RN4GE + @avx128), afd.sys UAF (@Dark_Puzzle + @Bad_Jubies), macOS JIT abuse (@kyleavery), AEMonitor (@__pberba__), and more! blog.badsectorlabs.com/last-week-in...

SharePoint enumeration (@matthiasdeeg), LNK "0days" (@Wietze), AMD driver LPE (@Bad_Jubies), POSTing to superadmin (@XeEaton), and more! blog.badsectorlabs.com/last-week-in...

"Negative-day" discovery (@spaceraccoonsec), Exploit gen with LLMs (@seanhn), Harmony LPE (@johnnyspandex + @buffaloverflow), NetSupport Manager RCE (@0xor_solo), Azure blob C2 (@KingOfTheNOPs + @senderend) and more! blog.badsectorlabs.com/last-week-in...

SmarterMail Pre-auth RCE (@chudyPB + @SinSinology), Claude Code code execution (@ryotkak), VSS create (@RicardoJoseRF ), EDRStartupHinder (@TwoSevenOneT), and more! blog.badsectorlabs.com/last-week-in...

Start your 2026 off with 3 weeks of news, techniques, write-ups, and exploits! blog.badsectorlabs.com/last-week-in...

SCOM lab (@synzack21), WatchGuard RCE (@_mccaulay), Clickjacking with SVGs (@rebane2001), macOS LPE (@theevilbit), a new private phone company (@nickcalyx + @phreeli), Proxmox tradecraft (@ZephrFish) and more! blog.badsectorlabs.com/last-week-in...

SCOM is one of the most deployed, but least researched, System Center products. Zach Stein breaks down how it works + how to build a lab to test new tradecraft. ghst.ly/3Ymzfcw

Apple's sourcemaps takedown (@moeruri), Call stack sig bypass (@saerxcit), AD Site pwnage (@croco_byte), sneaky remap (@MagisterQuis), Deceptiq launch (@deceptiq_), and more! blog.badsectorlabs.com/last-week-in...

WriteAccountRestrictions fun (@unsigned_sh0rt), RCE in Dell UnityVSA (@SinSinology), Unity Runtime exploit (@ryotkak), Lenovo DCC LPE (@0x4d5aC), remote control over generators (@XeEaton), and more! blog.badsectorlabs.com/last-week-in...

FreeBPX RCE (@chudyPB), badpie (@dtmsecurity), macOS auditd malloc woes (@jfmeee), Spotlight TCC leak (@patrickwardle), WSUS relaying (@Coontzy1), pyLDAPGui (@ZephrFish), and more! blog.badsectorlabs.com/last-week-in...

Sure, a bunch of NPM packages got backdoor'd (again), but don't miss the great research and tools released last week! blog.badsectorlabs.com/last-week-in...

Lots of tooling around the new Bloodhound "OpenGraph" standard this week including vCenterHound from @m0rd4vid and the bhopengraph library from @podalirius_. blog.badsectorlabs.com/last-week-in...

DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat themed loader (@vxunderground), fine-tune LLMs for offsec (@kyleavery_), juicing NTDS.DIT (@MGrafnetter), and more! blog.badsectorlabs.com/last-week-in...

Come see a preview of the new Web UI for 🏟️Ludus at the Embedded Systems Village. Our mini-workshop walks you through deploying a range and then hacking an emulated IP camera.

In Vegas for hacker summer camp and trying to get food without breaking the bank? I vibed a simple map site: defconfood.badsectorlabs.com Come see Ludus at the embedded Systems Village - hack an IP camera, see the new UI, and get a sticker!

Last LWIS before DEF CON. Come see us in the Embedded Systems Village where we have a mini-workshop hosting an emulated camera on Ludus for you to hack! blog.badsectorlabs.com/last-week-in...

VMware Tools LPE (@justbronzebee), Adaptix C2 0.7 (@hacker_ralf), Ludus MCP (@__Mastadon), SOAP(y) (@_logangoins), and more! blog.badsectorlabs.com/last-week-in...

PIC agents (@_RastaMouse), ToolShell, Async BOFs (@Cneelis), SCCM MP relays (@unsigned_sh0rt), RAITrigger (@ShitSecure), and more! blog.badsectorlabs.com/last-week-in...

LudusHound (@bagelByt3s), SpeechRuntimeMove (@ShitSecure), Havoc Pro (@C5pider), FortiWeb RCE (@SinSinology), SailPoint IQService RCE (@NetSPI), Altiris RCE (@lefterispan), WAF bypass (@nyxgeek), and more! blog.badsectorlabs.com/last-week-in...

Ludushound shows the power of community driven innovation in cybersecurity. @bagelByt3s created an awesome tool to convert bloodhound data into a working lab in 🏟️ Ludus. Replicate complex live environments with automation - and get back to the fun stuff! specterops.io/blog/2025/07...

Lots of good write ups (like Citrix Bleed 2) but my favorite was seeing how 🏟️ Ludus.cloud helped Cameron Stish of Guidepoint Security find "LoopyTicket" (CVE-2025-33073). blog.badsectorlabs.com/last-week-in...

Tons of great content released over the past few weeks. Get caught up with Last Week in Security! blog.badsectorlabs.com/last-week-in...

This week's edition is packed full of great techniques and tools! One of the longest posts we've done; there's so much cool stuff being released. blog.badsectorlabs.com/last-week-in...

@raphaelmudge.bsky.social summed up why we built and released Ludus open source: "Develop technologies that give individual operators and researchers LEVERAGE acting on hypothesis and make it fast to try things, adapt, and modify." When spinning up ADCS or SCCM is 3 commands, it gives you leverage.

Want to learn pivoting this weekend? The 🏟️Ludus community created a Pivot Lab with 11 different pivoting tools! Check it out: docs.ludus.cloud/docs/environ...

Stealth syscalls (@darkrelaylabs), VM introspection (@memn0ps), Marebackup LPE (@itm4n.bsky.social), Azure Arc C2 (@zephrfish.yxz.red), Obfusk8 (@x86byte), and more! blog.badsectorlabs.com/last-week-in...

BadSuccessor (@YuG0rd), o3 finds SMB 0day (@seanhn), crashing defender (@InfoGuard_Labs), MDT looting (@Oddvarmoe), and more! blog.badsectorlabs.com/last-week-in...

MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name If this query hits, you're DA: www.akamai.com/blog/securit...

Certipy 5 (@ly4k_), MobileIron pwnage (@chudyPB), new CRTO pricing (@_ZeroPointSec), Volatility 3 parity (@volatility), and more! blog.badsectorlabs.com/last-week-in...