> dmcdonald.net / tools > ─────────────────────
Tools, Code, & Exploits
offensive tooling and small utilities, mostly released under GPL-3.0. Pre-Cryptic Red work sits under R3n5k1/; the Cryptic Red era under CR-DMcDonald/; new work consolidating under R3n5k1/.
── current ───────────────────────────────────
Thin Client? Thin Crypto (DEF CON 34)
The proof-of-concept scripts and slide deck from the DEF CON 34 talk. The scripts directory holds the per-bypass PoCs across the three vendors: HP ThinPro initramfs patches that recover the LUKS key after the TPM releases it, Dell ThinOS GELI decryption, and IGEL OS boot-registry injection, plus a decoder for obfuscated WiFi credentials. The slides directory is the full HTML deck with the embedded demo videos (open slides/00-start.html in a browser). Authorised testing on owned devices only; every finding was reported to the vendors before release, and the scripts support dry-run modes.
dellpwn
Recovers and resets Dell (and some related HP) BIOS passwords from an SPI flash dump. Dell stores BIOS passwords XOR-encrypted rather than hashed, and a length mismatch leaks the key, so the password is recovered deterministically from a dump with no brute force (CVE-2026-40639). Joint research with Craig S. Blackie of MDSec. Authorised use only: recovery requires physical access to the device and its flash chip.
IRExitSensors
A collaborative reference collection on infrared exit sensors: the sensor models found on access-controlled doors, their susceptibility to signal patterns, and how to build IR emitters ("torches") to trip them. Less a single tool than a shared knowledge base for hardware hackers and red teamers working on door-sensor bypass. I maintain it, but several others have made significant contributions.
voipire
RTP Bleed exploit for vulnerable Session Border Controllers. Scans for RTP streams and dumps raw audio to file for analysis. Renamed from rtp-red-cap (the original Cryptic Red name). Use with authorisation: the exploit can cause significant disruption on vulnerable SBCs.
── historical ────────────────────────────────
WebLogic 10.3.3 UNC Path Exploit Package
A pre-packaged vulnerable WebLogic 10.3.3 environment plus UNC-path payload batch file, built because the public Node Manager UNC-path RCE was painful to reproduce on engagement. Not a novel vulnerability; this is exploitation tooling for an existing public bug, made to lower the setup cost during testing. Default credentials weblogic / w3bl0g1c.