Recent content in Projects on Arch Cloud Labs
As part of my doctorate program, I am regularly reading academic papers, watching presentations, and attempting to recreate prior research. Often, this boils down to experimenting with a new fuzzing framework, programming language, or navigating a codebase that I’ve never seen before. The cognitive friction involved in experimentation with new technology is where the real learning happens,…
About The Project As a part of my Doctorate, I am re-creating prior work from academic publications in the fuzzing domain. For kernel/embedded system fuzzing, a publication’s framework (kAFL, Nyx, Syzbot) often depends on a custom kernel, patches, etc… to get a fuzzing environment up and running. Often, these “academic GitHub repos” are a snapshot frozen in time, and…
About The Project As a part of my Doctorate, I am regularly building, flashing and debugging custom U-Boot bootloaders. I’ve been using OpenWrt as a part of my research on embedded systems, and developing slightly modified builds as previously documented in earlier blog posts. Recently, when flashing my OpenWrt One, I ran into errors that ultimately prevented me from writing a new image to…
About The Project I love Doom. It’s one of my favorite video game franchises, and the community around Doom that ports this game to run on bizarre hardware is nothing short of genius. The process of porting Doom to run on something it wasn’t designed for is quintessential hacking. You’re reverse engineering hardware and software, building custom loaders, writing file format…
About The Project Arch Cloud Labs projects in the past have tinkered in malware analysis and reverse engineering, but a goal of mine for 2025 was to get a deeper understanding of hardware. Now that 2025 is almost over, I was able to squeeze this blog post in right before it ends. This side project ultimately modifies the Windows driver installer of the TP-Link AX 1800. This is achieved by…
About the Project As part of my doctorate program, I’ve been analyzing how Valgrind keeps track of memory allocations in Das U-Boot (aka U-Boot). During my research, I discovered that out of the box, special configuration is required for Valgrind to “see” the allocations and frees executed by U-Boot. This blog post explores this nuance as I thought it was pretty interesting and…
About The Project The reMarkable Paper Pro is a premium e-reading and note-taking device that allows you to read, take notes, and not much of anything else. It’s the perfect distraction-free device to dive into books and academic papers and has become my go-to note-taking device for graduate school.
One obstacle with the reMarkable ecosystem is that the desktop application does not…
About The Project This past weekend was the final Shmoocon and the final Hack Fortress….for now. This blog post is a writeup on developing an 802.11 challenge for Hack Fortress while considering the congested 802.11 environment that is the Shmoocon conference. By leveraging the Linux kernel’s hwsim and hostapd, competitors were able to capture beacon frames, parse SSIDs, and…
About The Project Just like every year before, 2025 is the year of the Linux desktop. With Kubernetes solidifying itself as the de facto platform for container deployment, and Valve’s Arch Linux based Steam Deck, Linux continues its dominance in corporate environments, and our personal lives. I believe an investment in learning the internals of Linux will pay dividends for career…
Parallelizing Pacman Downloads This goal of this blog post is to make you aware of package manager modifications to speed up package downloads, and parallelize compilation efforts.
You should modify your pacman.conf file to enable parallelization of downloads. It’ll speed up installation of packages that have several dependencies. For all those distro hoppers out there, this should speed…
About The Project Following up from the most recent Arch Cloud Labs blog post on researching and choosing hardware for OpenWrt, this blog post will quickly cover how to build an OpenWrt image for a physical device. If you’re interested in building and testing an image in a Virtual machine or a container, look at the “Developer Guide” for more details.
Containerizing The Quick…
About The Project Here at Arch Cloud Labs, we love Arch Linux due to the ability to customize, debug, and otherwise modify every aspect of the system. This level of visibility into an Operating System allows the end user the ability to (in theory) fix any issue they come across with sufficient time and resources. Troubleshooting issues as they arise over time also makes you a better Developer/Sys…
About The Project The best blogging platforms are frictionless, and give the author control on how to create and share content. Arch Cloud Labs hosting has evolved over the years from a simple Digital Ocean droplet to a containerized deployment with CI/CD integration with a Cloud provider. This article briefly covers that journey and highlights the ease of integration and low cost of operating a…
About the Project Five years ago, on September 22 2019, I published my first blog post titled “New Homelab”. This began a journey in documenting side-projects done on nights and weekends to build skills in Reverse Engineering, Malware Analysis, and other InfoSec disciplines. While originally created to build a resume of projects for future employers, it evolved into a platform that…
About The Project Hack Fortress (HF) is a combination of a first person shooter (Team Fortress 2), and a jeopardy style CTF. Teams of ten are assembled with six gamers and four hackers in a single-elimination bracket. Hackers solve challenges and unlock points to buy in-game items for gamers. Each round is thirty minutes long except for the finals which run for forty-five minutes I’ve…
About The Project The video game hacking community is often a source of inspiration for those in the information security field. From in-depth memory hooking techniques to circumvent anti-cheat to beating the final boss via Cheat Engine scripts, there’s always something to learn that’s parallel to the challenges faced by those in the offensive or defensive field. The techniques…
About The Project Trying to stay up to date with the latest security research is challenging. There are countless security blog posts, and interesting academic papers to keep up with. Realistically you don’t have time to sit down and read everything that looks interesting. Wouldn’t it be great to have your own personal “Audible”-esque service to listen to articles as you…
This past year at DEF CON, the Embedded Systems Village (ESV) sold a custom badge that at the time, I thought was a CTF challenge. Fast forward months later when I’ve actually sat down to look at the badge, It turns out the badge is centered around a “FTDI chip” which enables communication to multiple embedded communication protocols. The badge actually enabled CTF contestants at DEF…
About The Project Arch Cloud Labs’ last three blog posts were diving into different aspects of IoT/embedded vulnerabilities. Coming off of these bug hunting adventures, I wanted to build a unique set of Capture The Flag (CTF) challenges for this year’s Hack Fortress. To do this, I referenced OWASP’s Top 10 for IoT and Buildroot to build the custom operating system for a Raspberry Pi 1 that…
About The Project Continuing on Arch Cloud Labs’ hardware and router reverse engineering journey, I wanted to dump the firmware of my TrendNet-731BRv1 via reading flash memory from the PCB vs downloading the firmware from TrendNet’s website. Considering a scenario where the firmware was no longer hosted publicly by TrendNet, (after all it is a discontinued product) being able to dump…
About The Project Continuing from Arch Cloud Labs TrendNet 731BR router hacking blog post tearing apart firmware, we’ll now start poking at router hardware! The primary objective is to grow my skills in the embedded security domain for DEF CON’s IoT and Embedded Security Villages next year. This weekend’s project focused on a GL-AR750. I originally bought this router in 2017 as a…
About The Project I recently bought an discontinued TrendNet Router to become more proficient at reverse engineering embedded systems. Each year at DEF CON, the IoT Village,and Embedded Village have CTFs/hands-on workshops, and I’m hoping to get my skills up to par to go and take a crack at one of them next year.
TrendNet home router model “TEW-731BRv2” has a known vulnerability identified by…
About The Project Modern Software Development environments have significant debugging capabilities to troubleshoot issues with the complex nature of modern software . These debugging capabilities typically manifest in Interactive Development Environment (IDE) as features that extend an IDEs capabilities to examine the given state of an application at runtime or analyze previous binary executions.…
About The Project On September 18th, The twitter account Malware Hunter Team Tweeted about a DLL, batch script, and PowerShell script being publicly hosted at 103[.]68[.]109[.]31. Given that a DLL was being hosted, I thought it would be an interesting target to reverse engineer. This blog post is analyzing that DLL and ultimately patching this simple reverse shell to call back to a local virtual…
About The Project In continuation of Arch Cloud Labs’ previous blog post on Pwntools, we dive deeper into the Pwntools framework, focusing on automating interactions with binary programs. Imagine a scenario where you need your binary to follow a specific path before deploying your final payload. Simply piping your shellcode into the binary won’t suffice. This is where Pwntools’…
About The Project Following up from Arch Cloud Labs’ previous blog post on Pwntools, we’ll continue to explore the pwntools framework this time focusing on shellcode generation. It’s not uncommon in the world of pwn/reverse engineering challenges for a requirement of the challenge to be to execute shellcode. Ultimately the end goal may be to obtain access to a remote system, or…
About The Project Pwndbg and Pwntools are Python frameworks for automating different parts of exploit development. These frameworks are highly popular amongst CTF players as they simplify and accelerate the creation of Proof of Concept (PoC) scripts for memory corruption exploits. I’m not proficient in using pwntools, and pwndbg, but this marks the beginning of a series of blogs aimed at…
About the Project Several tutorials exist on how to leverage the GNU Debugger (GDB) to debug misbehaving applications. However, a majority of these blogs just show commands to run that poke at memory addresses, and don’t show the process of resolving said bug. This blog post will walk through how I recently identified, tried to fix, and ultimately reported a bug in dhcpcd 10.0.1 via…
About The Project Recently I’ve been building rudimentary file monitoring tools to get better at Golang, and build faux-watchdog programs for research at Arch Cloud Labs. Through this experimentation, I’ve identified some interesting gaps in the inotify subsystem that are new to me, but are well documented in the Linux man pages. This blog post will explore how to circumvent read…
About The Project Recently a close friend fell victim to a scam that resulted in giving access to their laptop to a scammer via LogMeIn. This type of scam is inline with “refund scams” that YouTubers create videos for where they spend hours on call with the scammers to waste their time. This blog post will discuss the steps Arch Cloud Labs took post-access, the artifacts recovered and…
About The Project CVE-2022-4883 outlines a Linux PATH hijacking vulnerability in the libxpm package. Libxpm is used in a variety of projects to parse “X Pixmap” images. The National Vulnerability Database rates this vulnerability at a CVSS score of 8.8 and Red Hat has given it a CVSS score of 8.1. Per, the Arch Linux package page, 39 packages currently list libxpm as a dependency. This…
About The Project ClamAV is an Open Source antivirus engine that is widely used on mail servers to scan incoming messages. On February 15, 2023 ClamAV published a security advisory detailing a potential remote code execution vulnerability in its HFS+ file parser. This vulnerability was given the CVE identifier of CVE-2023-20032. While reading about this vulnerability, I stumbled across an open…
About The Project GPT3 has caught the InfoSec world by storm, and there’s a million tweets, posts, articles, etc… with interesting use cases. Most of these use cases I’ve seen are focused around offensive/red team tooling. A notable exception is with IDA Pro/Ghidra plugins that aid in commenting assembly code blocks with plain english (or close to) explanations of what’s…
About The Project In December of 2022, a DLL Hijacking vulnerability with a CVSS score of 7.8 was reported in the Squirrel.Windows auto-install/update utility. This blog post will analyze the vulnerability, and the root cause of said issue with procmon.
Analyzing the Security Advisory Squirrel.Windows is an installation utility for Windows desktop applications that does not require a…
Know Your Tools, and Fear No Bug One of my favorite series of blog posts of all time is “Unix as an IDE”. These blog posts walks you through how your Unix/Linux environment is your IDE. This philosophy of thought challenges using a dedicated IDE for development, as all the tools you need are already on your Operating System. Debugger integration? Why not just use gdb rather than the…
About The Project In November of 2022 the FreeBSD project announced CVE-2022-23093, a buffer overflow vulnerability in the ping utility. This blog post will analyze the vulnerability as well as document the steps to setup said environment to analyze the root cause of the issue with gdb. Illuminating the Security Advisory The FreeBSD advisory gave the following description to the…
About The Project Several Red Team projects exists to “live off the land” and avoid introducing additional executables into an environment. This gives Red Teamers and adversaries an advantage to not risk something within their toolkit from gettin caught by the latest and greatest EDR. But what about the Blue Teamers? The DFIR engineers out there tireless working to ensure the saftey of…
About the Project Today, we’re going to analyze a malicious binary recently identified by Arch Cloud Labs malware collection system “Archie”. This binary leverages the LoadLibraryA function to resolve DLLs at run time for additional functionality. Malware samples typically do this to ensure there’s limited information in the import table in an attempt to avoid triggering…
About The Project Last week I looked at a Cryptojacking campaign that leveraged a curl trick in the bash dropper to resolve IPv4 addresses from large integers values. Revisiting the bash dropper, I discovered the threat actor has updated the script to download and execute a command-and-control payload called “Termite” from the Platypus Github project. This blog walks through the…
About The Project Today we’re going to look at a couple neat curl tricks I found in a recent bash dropper I was analyzing that resulted in surprisingly low VirusTotal detentions! As previously blogged about([1][2][3]), Arch Cloud Labs runs a handful of honeypots to collect attacker data to hone my skills in DFIR topics . While this was just another Cryptominer targeting an exposed docker…
About The Project I’m currently studying for my Certified Kubernetes Security Specialist (CKS) certification. As apart of this certification, training courses recommend looking into runtime security provided by Falco. Falco is a Cloud Native Computing Foundation project created by Sysdig that allows for cloud, container and Kubernetes based log alerting. While training courses such as…
About The Project Security researcher Silas Cutler recently tweeted a link to a unique data set of Cobalt Strike Beacon payloads, and their extracted configurations (thanks Silas!). This is a fairly large data set going back to November of 2021, and containing over 100k entries (112,900 to be exact, but I had trouble parsing about 900 of them). This blog post will take a quick look at a subset of…
About The Project Recently I’ve started supporting a package in the Arch User Repository (AUR) in order to contribute to the Arch Linux project. In an effort to “automate all the things!”, I have regular Jenkins builds cloning and building the upstream Github project. This blog post outlines how I’ve tried to align to the Supply Chain Level for Software Artifacts framework…
About The Project The e-zine tmp.out focuses on ELF/Linux related research in a style of Phrack. After reading an article on fuzzing radare2 for 0days in 30 lines of code, I thought it would be a fun weekend project to extend this research, and port their code to a container and deploy it in a Kubernetes cluster. To take it one step further, building fresh releases of the radare2 project’s…
About The Project Lately I’ve been playing around more with binary exploitation CTF challenges. This blog post will cover recent experimentation with ELF binary loaders, and extending them to fetch a remote resource, load it into memory, and finally execute it. There are several github repos with different purpose built binary loaders for ELFs/PEs/Machos/etc… so it was easy to focus…
About the Project Lately, I’ve seen some horror stories (1, 2) about side projects gone awry resulting in HUGE cloud bills. As a homelab enthusiast, and cloud user I wanted to write up some notes on how I stay ontop of billing to avoid surprise costs. This blog will outline some alerting pipeline I’ve built in my homelab.
Building Notification Pipelines AWS Billing allows for…
About The Project With IDA Pro’s recent announcement of going to a subscription model it has some revisiting the current state of available decompilers. Off the top of my head you have Hopper, Ghidra, Radare2/Cutter, and of course Binary Ninja. Each of these utilities have their own pros and cons and also considering how frequently you’re spending time performing reverse engineering…
Preparing for The CKA & Diving into the Kubes I recently passed the Linux Foundation’s Certified Kubernetes Administrator (CKA) certification and thought I’d throw some notes together on how I prepared. The CKA is a hands-on practical test. There are no multiple-choice questions, just raw application of Kubernetes knowledge.
Overall I enjoyed the CKA, and find that the questions…
The Art of The Homelab I’ve been homelabbing/blogging about side projects for about two years now and thought I’d compile a list of things that have been useful to me in my homelabbing journey. These are just my opinions and everyone’s goals for their homelab are different. I view my homelab as a blank canvas upon which to experiment, fail, learn and share said failures (or…
About The Project Threat Intelligence comes in many forms and services that help enable the analyst, incident responder, reverse engineer, etc… to be aware of ongoing threats against enterprise environments.
As a home lab enthusiast, I don’t have access to enterprise subscriptions (ex: Virustotal) to obtain insight into the latest threats. Luckily for the community, several free…