Recent content on blog.rice.is
If you’ve ever poked at one of my CTF challenges, you’ve probably noticed a pattern - I love hiding payloads in TXT DNS records. I stash the malicious code in a TXT record, have the implant query for it at runtime, and now suddenly the payload is being delivered by the same infrastructure that resolves grandmas-cookie-recipes.com. It’s trivially easy to set up and surprisingly…
Paggles I don’t know when inspiration will strike. This time, I was stoned and scrolling Instagram when I came across a screenshot of this Reddit post: I don’t know why I found this so funny, but my first thought was “how does someone even do this?”. The first comment had the answer: Sure enough, there it is. I didn’t realize the AM/PM field were mutable string…
Challenge Title: Palimpsest Event: Huntress CTF 2024 Challenge Description: Our IT department was setting up a new workstation and started encountering some strange errors while installing software. The technician noticed a strange scheduled task and luckily backed it up before deleting it! Can you analyze it and figure out what's going on? We've included the exported scheduled task and log files…
The Basics of Event Log Manipulation My interest in event log manipulation started when Kaspersky had observed “fileless” malware in the wild utilizing the Windows Event Log to hide shellcode, and ever since watching Tim Fowler’s (BHIS) presentation on offensive Windows Event logs, I’ve been obsessed with hiding whatever I can find in there. In October 2023, I used this…
Hi, I’m Adam Rice! I’m an Infrastructure and Security Engineer with over a decade worth of experience designing, deploying, maintaining, and securing cloud and on-premise network and server infrastructure. I like puzzles and I find creative solutions to challenging problems, show me a 50 foot wall and I’ll show you a 51 foot ladder. This site serves as a place for me to document…