New Blog
This will be a pretty short blog post to inform you I have a new site with blog at https://SimulatedAttack.com . All new stuff will be posted there.
M0NOC.com
Musings of the IT and Security world
Latest posts
LXC Container Privilege Escalation in More Restrictive Environments
It is well-known that if you gain RCE as a user in the lxd group you can quite easily escalate your privileges to that of root. An example is at https://reboare.github.io/lxd/lxd-escape.html . However, most examples on the Internet use something like the following to create the container: lxc init ubuntu:16.04 test -c security.privileged=true The problem with this is that you may be on a system…
Bypassing Kaspersky 2017 AV by XOR encoding known malware with a twist
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 One thing that I haven't had a really good look at, coming from a non-pentesting background, is how to avoid anti-virus scanners; so here is my first serious dive into it. I suspect to most this isn't anything new to experienced testers. Given the limitations of even “smart” anti-virus products, this type of issue is expected…
E9 3E 50 4F 53: What comes in red pills and is highly addictive?
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Since passing my OSCP exam a few weeks ago I've been debating whether to add to the vastness of reviews on the PWK course and OSCP exam. It, however, feels like a right of passage; so here goes. What is the PWK course , I hear you ask. To quote from Offensive Security's website: “ Penetration Testing with Kali (PWK) is a…
Linux Ransomware and SSH
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 I recently came across this article on the FAIRWARE ransomware attacking Linux servers by brute forcing SSH according to the referenced article here . I thought why in this day-and-age is brute forcing SSH from the Internet working? Surely we are not exposing SSH administrative interfaces to the big bad Internet, let alone in…
A look at an SELinux error message
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 As a fan of the SELinux security framework that runs as part of Linux, I thought it would be a good idea to improve my skillset in this area, and go beyond the basics. Part of that is research, subscribing to SELinux mailing lists, playing with test setups and, of course, reading what others are saying via Google searches.…
A Brief Look at EMail, SPF, DKIM and DMARC
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Having recently built my home email server and wanting to be a good MTA I decided to look a number of anti-spam mechanisms. Whilst host-based anti-virus solutions and the like offer anti-spam engines, there also exist a number of other technologies to…
Kernel Tracing Qmax on Solaris – Part 2
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Following on from Part 1 , we will further enhance our script to trace incoming connections through the kernel to the application. Before doing that we will tweak the script to provide a CSV output. We do this using a BEGIN probe to print the header and then update the probes. We will also split the probes. Where there is a…
Kernel Tracing Qmax on Solaris – Part 1
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Time to poke around the kernel and do a simple bit of reversing. Whether you are a sysadmin, penetration tester, or reverse engineer, if you don't know about Solaris DTrace you will want to. It allows for low-latency instrumentation of the system. This includes function boundary tracing (FBT) of pretty much any function in…
Samsung Self Signed Certs
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 With this blog entry I thought I would ask a question. As you would expect, someone with my background has a home network that is someone different to that of the average home user. Part of that is the use of a web proxy server, so all devices need to go via that to access the outside world over http-type protocols; including…
Beyond TCP Qmax
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 When it comes to network security and performance of network services, an important concept is how the UNIX kernel handles establishing TCP connections. Whilst the three-way handshake is commonly known, unless you write communications code (e.g. the listen() call and the backlog parameter), you may not have looked at what is…
Frustrating Sysadmins, pentesters and adversaries with Linux Attributes
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Following on from my article on Linux Capabilities I thought I would cover another, interesting, but yet not that well known feature on Linux – that of filesystem attributes. This is not to be confused with extended ACLs. Linux (file) attributes cover a wide range of features, such as the ability to mark a file as immutable,…
Working round problems with DTrace
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 In this article I'm going to introduce an awesome bit of technology developed by Sun Microsystems (now part of Oracle), called DTrace. Adding to the mix I'll look at setting up a privileged role to perform DTrace operations. DTrace allows you to instrument any part of the system from internal kernel functions, through…
NFS Abuse for Fun and Profit - Part 3
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Following on from Part 1 and Part 2 ; in this final part of this overview of NFS version 2 and 3, we will look at a number of other countermeasures and a nice way to compromise a system. Case 5 – Read only shares This is one of the more useful options.…
NFS Abuse for Fun and Profit - Part 2
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Following on from Part 1 of this article, we continue our introduction to NFS by abusing SUID. When we talk about SUID here, we also infer SGID. i.e. you can set the effective group ID as well; but I will leave that as an exercise for the reader. Case 4a – nosuid Unlike the no_root_squash option, which is by default…
NFS Abuse for Fun and Profit - Part 1
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 Part 1 In this blog I thought that it would be good to look at a common network filesystem in use on Linux and UNIX systems; that of NFS - specifically versions 2/3. NFSv3 can be found in Internet RFC1813 , from 1995. For NFSv2 see RFC1094 from 1989 . NFSv4 really needs separate treatment. Due to the fun that can be had, I've…
Data Exfiltration with ease
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 As someone who has to regularly diagnose issues on a plethora of operational systems and under various failure scenarios, just as a pen tester or adversary I need to think of alternative ways to do things. Some turn out to be incredibly straightforward ways to exfiltrate data from a system. From a data loss prevention…
Linux Capabilities - A friend and foe
Normal 0 false false false EN-GB ZH-CN X-NONE MicrosoftInternetExplorer4 As an infrastructure engineer (3rd line support) with a healthy interest in security I like to discover and play with the less well known features of technology. It is surprising how many people are not aware of these, even some senior administrators, yet such features can offer both strong mechanisms to improve the security…