Posts on [audible]blink

Accidentally Graphing DLL Hijacks in Every Electron App

Tue, 25 Jan 2022 16:50:47 -0400

or Building Your Own Binoculars I like this bi-line for a couple of reasons. It touches on self-sufficiency in the face of necessity It could bring up one of two things You may be too far from the problem to be objective You may not be seeing the forest for the trees. Being an expert on something can make it difficult to have an objective/practical opinion about the downstream effects your specialty has on the world around you.

Clustering Pi Zeros With ClusterHAT, Docker Swarm, Traefik, and Ansible

Wed, 10 Nov 2021 00:00:00 +0000

It calls to you. Your drawer of misfit toys and abandoned projects. Every few months, I come back to the world of SoCs to see what’s new, but nothing ever really sticks around long enough for it to be considered useful enough to be permanent. Smart mirrors Twitter bots that shame you for not watering your plants Video Game emulators Home control devices The occasional GPIO project to manipulate things in MeatSpace The only exception is probably an ad-blocking DNS server, the Pi-Hole.

Ret2CSU

Sat, 24 Apr 2021 11:42:16 -0400

What is __libc_csu_init anyway? Hackthebox hosted the CTF event, CyberPocalypse2021 this last week. Great event. Let’s talk about the System dROP challenge. A while ago, I’d read a BlackHat paper on something called ‘ret2csu’. The TL;DR is that glibc attaches code that bootstraps your C. Within the attached code, there exists two segments of assembly, that when used together, can be very useful in constructing ROP chains without needing bother with any ASLR’d library, provided there exists some other useful code within the main ELF.

Password Dump Database - Part 2

Mon, 04 May 2020 15:58:04 -0400

THE RETCONNING It is my sincerest hope that my last post was of some use to you because I’m about to tell you to forget it. Like almost all of it. Right around the time I discovered that even with an O(log n) insertion rate, and even while saturating the IO of 2 SSDs in a RAID-0 configuration would seeding still take months… it was then, dear reader, that I decided…

Pwntool Tips 3

Sat, 04 Jan 2020 19:13:37 -0500

Before we start, in part 2 of the series I demonstrated finding asm instructions within a binary using the elf.search() function. We passed bytes ff e4 in order to find the address of a jmp rsp instruction. As it turns out, we can use also the mnemonic if we pass it through asm() first. This way, we don’t have to remember that jmp rsp is ff e4 on amd64 architecture.

Pwntool Tips 2

Fri, 03 Jan 2020 13:13:01 -0500

ELF and ROP Modules Pwntools gives us the ability to interact with ELFs and shared libraries in a programmatic way.Full ELF docs Full ROP docs ELF fit One of the Class-level members I want to talk about is fit. I’ve had to create lines in my exploit code that look like this: buf_len = 128 pad_len = buf_len - (len(gadgets) + len(mprotect)) payload = gadgets payload += mprotect payload += "A" * pad_len payload += canary payload += "A" * 16 # junk payload += jmprsp fit allows you to be declarative about where each of your exploit components should be in your payload.

Pwntool Tips 1

Thu, 02 Jan 2020 20:56:48 -0500

Do you like clean exploit scripts? Do you fidget with and refactor them long after you’ve submitted the flag? If so, then this blog series is right up your alley! At some point you’ll be developing an exploit that requires you to return to some shared library, most likely libc. Problem is there’s a good chance the libc on your local dev box is not same version as the one on the remote box.

Abusing Signals with SIGROP Exploits

Sat, 28 Dec 2019 21:59:34 -0500

TMHC: MiniPwn Walk-through This one’s just as much for me as it is for you. They say you don’t truly understand something until you’re able to teach it to someone else. So here we go! The Many Hats Club had a CTF on HackTheBox a few weekends ago that re-ignited a previous passion for exploit development. The reason it got me interested was that it required a new exploit technique of which I’d not yet heard, Signal Return Oriented Programming.

Password Dump Database - Part 1

Sat, 28 Sep 2019 19:33:14 -0400

Preface This post is first in a series where I mostly catalogue my failures, what didn’t work, and the lessons I learned along the way. This isn’t a tool drop, or a new dump. Also, part 2 basically says every choice I make in Part 1 (this part) is wrong. If you’re a DB admin or have experience with manipulating large amounts of data, prepare to cringe… HARD If you’re just interested in some stats and bencharks, you can skip straight to that section

Stop Using Python for Subdomain Enumeration

Sat, 20 Apr 2019 13:02:17 -0400

Python (and all other scripting languages) use the host system’s name resolution APIs. Skip the bottleneck and craft the DNS packets manually.

Mind Your OOPSEC

Sun, 30 Dec 2018 17:06:30 -0500

OPSEC is hard and those OOPS moments can often cost you a campaign when Red teaming. In this post I’ll go over how I set up my VMs so I never have to remember to turn on a VPN, stress about having some ‘killswitch’ fail, or being on the losing end of some network-race-condition nonsense when waking my laptop. Automation isn’t always about convenience for the user. Sometimes it’s also about determinism.

Analyzing Data Exfiltration over ICMP

Fri, 11 May 2018 20:06:55 -0400

I’m a big fan of learning through competition. Capture The Flag games have tremendous utility for training within the Security sector and even outside of it. Intentionally vulnerable web applications, like OWASP’s JuiceShop, are excellent tools for assisting in developing Secure Software Development Life-cycle programs within an organization. So let’s take an exercise I recently came across in a CTF event. The skills required to solve the challenge are actually quite useful in real-world defensive scenarios.

Password Spraying with DoxyCannon

Mon, 16 Apr 2018 22:43:36 -0400

Password sprays are here to stay. It’s probably a good idea to configure some clever WAF rules, implement captcha systems, and set up additional alerting. But once implemented, how do you test and tune your protective measures? Enter DoxyCannon DoxyCannon’s name borrows from ProxyCannon, a script that instantiates cloud infrastructure through which one can proxy requests. Unlike ProxyCannon, DoxyCannon gives you the same functionality without needing to rely on cloud providers.

BashyNumb.sh

Tue, 22 Aug 2017 22:47:45 -0400

I’ve been running into more and more Linux boxes that don’t have python 2 installed. It’s been a little frustrating since I like to use a slightly modified version of the famous linuxprivchecker.py that almost all OSCP students know and love. I’m lazy and hate manual enumeration; makes my fingers go numb. I decided to spend an evening translating it to python 3, but quickly realized, “This python is just invoking shell commands, why am I doing this?

Creating a VPN Access Point

Fri, 18 Aug 2017 20:07:36 -0400

By now, there shouldn’t be any doubt that not only are you being watched online, but your browsing habits, particularly your political ones, are of interest to the current administration. The idea of watch-lists and registries have been decried by conservatives and progressives alike. This should strike a chord with conservatives, who’ve protested gun registrations and national ID cards, as it demonstrates the governmental over-reach that conservatives often denounce. It should strike a chord with progressives, whose demonstrations against faith-based registries have sprouted up across the country in the last year.

Chrome Extension Steals Cloudflare Api Tokens

Thu, 03 Aug 2017 20:59:56 -0400

Upon receiving news that the popular Chrome Extension, Web Developer, had been compromised, I quickly began to wonder about the what and how. Several stories exist about how the extension came to be compromised and they touched a bit on what it did. This post is meant to expand upon, what I believe to be, the more nefarious behavior of the extension. Since the extension calls out to an attacker-controlled URL, the payload hosted at that URL could be changed to anything at any time.

Creating BashBunny Payloads

Sat, 01 Apr 2017 22:08:35 -0400

What is it? The BashBunny is an attack platform that allows attackers to create payloads in Bash. The device can be scripted to enumerate as a HID (keyboard), mass storage, serial, and Ethernet. This enables a multitude of attacks including thing like exfiltrating documents over a network interface or stealing account hashes from locked computers. Creating a Payload We want to create a payload that allows for easy exfiltration from macOS.

Finding Your Way Out From Behind Firewalls with Strict Outbound Rules

Tue, 07 Feb 2017 19:44:18 -0500

You’ve achieved code execution on a machine, but for some reason your reverse shell isn’t pinging you back. Or that wget/tftp command isn’t downloading your recon/post-exploitation tools. There’s a chance you’re dealing with an egress problem. Typical ports that need outboud access are blocked. You try the main ones you can think of (21, 22, 53, 80, 8080, 443), but none of them seem to be connecting. Do you start at 1 and manually test?

Configuring SSH for Pivoting

Thu, 02 Feb 2017 16:32:04 -0500

You’re on a pentesting engagement and you’ve discovered a dual homed machine that allows you access to a subnet you can’t access directly from your attack machine. Assuming you’ve compromised at least one machine on the initial network, you can use it as a proxy to other machines on the “hidden” subnet. The ssh client has an often-overlooked configuration file that resides in your ~/.ssh folder. You can configure things in here that are specific to certain hosts or you can set default configurations for every host.

B2R: Wallaby Walkthrough

Fri, 30 Dec 2016 19:16:02 -0400

Executive Summary This machine had an unlisted but open webapp path that allowed for remote command execution. After establishing a reverse shell as the limited user www-data, privilege checks showed the user was allowed to modify firewall rules. There was also an IRC server that contained a bot that allowed command execution through the use of the .run command. The command would only obey the user waldo so modification of the firewall allows an attacker to kick and assume the waldo identity.

B2R: Stapler

Sat, 24 Dec 2016 23:45:38 -0500

Adding the IP address of the VM to the hosts file allows one to cut down on some typing. Executive Summary This machine had several services running, some of which revealed employee names and accounts that could later be leveraged to compromise the system. A Wordpress plug-in vulnerability was found and used to extract database credentials, which then led to a non-privileged shell. Once scanned, it was discovered that a script ran every 20 minutes as the root user and that the script was writable to our non-privileged user.

B2R: SickOSv1.2

Tue, 20 Dec 2016 23:45:50 -0500

Executive Summary This machine had an unprotected folder which allowed uploading of malicious PHP code which could then be executed remotely. An attacker could then create an unprivileged shell on the victim machine and begin to explore the system for additional vulnerabilities which could lead to a full compromise. During the exploration, an outdated version of chkrootkit was found. By exploiting a known vulnerability in the way chkrootkit parses arguments, an attacker could create a malicious file that would later be run by chkrootkit as a fully privileged user.

B2R: IMF Walkthrough

Tue, 01 Nov 2016 19:16:02 -0400

After mapping the network and finding our IP address at 192.168.1.162, we can add it to our /etc/hosts temporarily to make things a little easier for us. echo "192.168.1.162 imf" >> /etc/hosts Lets see what kind of machine we’re dealing with. Ok, so web only. Great. nikto didn’t reveal any low-hanging fruit so let’s dive into the source. Check that out! Our first flag was hidden in http://imf/contact.php. This looks like base64.

B2R: Tr0ll Walkthrough

Thu, 20 Oct 2016 20:57:00 -0400

A couple of weeks ago, work sent me to a security class for an upcoming product. While there, I learned about vulnhub, a repository of intentionally vulnerable virtual machines for anyone to compromise. Since coming back, vulnhub has become my new obsession. Here’s a walkthrough of my attempt. Note: I struggled a bit more that this writeup lets on. The struggle is ommited for clarity and brevity. __ After finding the VM with an nmap scan, we see a couple of open ports.