Recent content on 0xv1n
🍎 MacNoise 
 It’s been quite a while since my last blog post but I’ve been really busy working on a project I’m thrilled to talk about, MacNoise . MacNoise is a modular macOS telemetry noise generator for EDR testing and security research. It generates real system events: network connections, file writes, process spawns, plist mutations, TCC permission probes, and more so…
What is qwinsta? 
 qwinsta : Displays information about sessions on a Remote Desktop Session Host server. The list includes information not only about active sessions but also about other sessions that the server runs. (ref: MSFT Docs ) 
 It is also possible to remotely enumerate user sessions via the /server:{hostname} parameter. Despite the Microsoft documentation specifying this binary…
Acknowledgments : Thanks to the various people that proofread my ramblings and offered valuable feedback. Thanks to @_RastaMouse (and ZeroPointSecurity) for creating courses that have inspired me to learn more about security every day. 
 
 I want to start this blog by stating basically none of this research is “new”. A lot of the information surrounding process protection in…
Living off the Land 
 Earlier this week, Grzegorz Tworek posted a really cool way of establishing a persistent LPE that I haven’t previously seen in the wild . From a ( compromised ) privileged account we can abuse the Service Control Manager to allow any arbitrary non-administrative user to have full SYSTEM permissions on a machine persistently by feeding an overly permissive ACL to the…
Collecting Information 
 As always, we will start by collecting as much information as we can about our file and looking for low-hanging fruit (hardcoded strings, function names, etc). 
 
 From our strings output, we do see the strings returned during the initial run (e.g. granted/denied) and also some interesting functions like giveFlag but there’s no obvious flag. 
 GDB…
Safe-space 
 Please don’t ever execute any random ELF/PE binary you find on the web directly on your workstation. Even if it comes from a trusted source like HTB or THM, we should always work in a segmented environment. Since these challenges are all ELFs, I spun up a Kali machine (you can literally use any OS to do these, I just had a VM ready to go) to run through these. Once…
Safe-space 
 Please don’t ever execute any random ELF/PE binary you find on the web. Even if it comes from a trusted source like HTB or THM, we should always work in a segmented environment. Since these challenges are all ELFs, I spun up a Kali machine (you can literally use any OS to do these, I just had a VM ready to go) to run through these. Once you’ve done that, you can just…
A new foe has appeared ! 
 Earlier this week, a super cool project was uploaded to GitHub by an Optiv researcher called ZipExec . (And of course, we need to include the awesome ASCII art!) 
 __________.__ ___________
\____ /|__|_____\_ _____/__ ___ ____ ____
 / / | \____ \| __)_\ \/ // __ \_/ ___\
 / /_ | | |_> > \> <\ ___/\ \___
/_______ \|__|…
Challenge Description: 
 Who needs AES when you have XOR? 
 What is XOR? (A short lesson in Logic) 
 Before we dive into this challenge, let’s take a journey through the world of logical operators and what they mean (specifically, XOR ). However, before we can really understand what makes XOR special let’s break it down to its fundamental component - the OR statement. 
…
Work Experience: 
 
 IR SOC Analyst 
 Threat Hunter / Intrusion Response 
 Detection Engineer 
 
 Education 
 
 B.Sc. Computer Science (ABET Accredited) 
 M.Sc. Cybersecurity 
 
 Active Certifications 
 Red Team / Pentesting: 
 
 Certified Red Team Operator (ZeroPointSecurity) 
 Certified Azure Redteam Professional (Altered Security)…

 Why do you have an entire page devoted to your dog? 
 I don’t need to explain this. It’s Tifa.