Linux ptrace introduction AKA injecting into sshd for fun

If there is one thing I've come to appreciate over this past few weeks, it's just how much support you are provided from the Win32 API. That being said, I wanted to tackle some Linux process injection, with the aim of loading a shared object into another process address space without having to resort to LD_PRELOAD, or stopping the process. The goal I set myself was quite simple, could I recover plain text credentials from the sshd process using ptrace. Granted, this is a bit of an arbitrary goa

Read More »

New Blog and the Technology that powers it

As you may have noticed, I've migrated my blog from Tumblr to a shiny Ghost powered engine. While it does feel like I'm leaving the social media buzzword bingo revolution behind, editing on Tumblr wasn't exactly made with lengthy InfoSec posts in mind. Of course, moving to Ghost in my case means provisioning and managing a new server, so I wanted to take some time to document the architecture of my solution incase anyone else is looking to make a similar change in the future. Hosting My hosti

Read More »

BSidesSF CTF - DNSCap Walkthrough

Of all the BSidesSF CTF challenges, I think this one has to be my favourite. Combining a mix of packet capture analysis, scripting, frustration, and trying to beat the clock. The brief provided by the challenge was quite straight forward

Read More »

BSidesSF CTF - Steel Mountain: Sensors Walkthrough

Continuing my write-up series from BSides SF's CTF, today I'll be looking at a "pwn" challenge, Steel Mountain - Sensors. The challenge starts with a link, and a cryptic comment

Read More »

BSidesSF CTF: b-64-b-tuff Walkthrough

This week I was part of team "NeverTry" who competed in the BSidesSF online capture the flag. As far as CTF's go, this was a fun one, taking place over 2 days there were a range of cool puzzles and flags to find. Over a series of upcoming posts I'll be running through the solutions for a number of my favourite challenges, starting with b-64-b-tuff. This challenge started with a simple application which receives binary shellcode over the network, and executes th

Read More »

ROP Primer - Walkthrough of Level 2

In the final post in this series, we'll be looking at Level 2, the last level of ROP Primer from VulnHub. This level gives a very simple program, similar to the first challenge that we faced in Level 0. The source of the application is as follows

Read More »

ROP Primer - Walkthrough of Level 1

Continuing from the previous post which shows a solution for Level 0, we are going to look at Level 1 of ROP Primer from VulnHub. Level 1 is a server application, which suffers from a typical buffer overflow. Reviewing the application source provided by the challenge, we can see that the overflow vector is within the following code

Read More »

ROP Primer - Walkthrough of Level 0

I recently found Vulnhub ROP Primer, which is a brilliant playground for refreshing your Linux ROP skills. To try and share some of the techniques I used to solve these challenges, I'm completing a series of writeups detailing the steps to solve each level. In typical Vulnhub style we start with a virtual machine which runs a number of services alongside a HTTP server documenting the 3 levels of difficulty. This post will be looking at Level 0

Read More »

Radare2 - Using Emulation To Unpack Metasploit Encoders

Radare2 is an open source reverse engineering framework, and is quickly becoming one of my favourite tools when picking apart malware or looking at CTF binaries. I was recently introduced to Radare’s ESIL (Evaluable Strings Intermediate Language), which is a way of representing instructions in a forth like language, and allows emulation of machine instructions in Radare’s ESIL VM. To help understand this functionality, lets look at some examples from the radare2 book

Read More »

Windows Server 2016 / Docker Privilege Escalation

After catching Microsoft's talk at DockerCon discussing the recent addition of Docker container support in Windows Server 2016, I wanted to play around with the technology with the aim of understanding how this could be leveraged during a security assessment. Before starting, I first had to configure Windows Server to support Docker containers. This was pretty painless using the following steps

Read More »