Keep poking it, until you understand it!
Just a few weeks ago, we lived in a world where a robust security architecture with regular tests + patching semi-regularly provided a decent protection for most companies. Then, large language models (LLMs) started to generate working exploits for freshly patched vulnerabilities, or even 0-days they themselves had found. It is worth to read the Month of AI-Discovered Bugs (MAD Bugs) series series…
The National IT Competition (aka. OITM, Országos IT Megmérettetés) is a yearly, individual, large-scale Hungarian online competition designed for IT professionals, developers, students, and technology enthusiasts. It runs over several weeks and features practical, real-world challenges across more than twenty IT categories, such as programming, cybersecurity, DevOps, data science, and other…
In this report, we use our Kaibou Search Services to find related samples to the Notepad++ supply chain attack that happened between 2025-06 and 2025-12. During the analysis we uncover 14 new similar samples and 11 new stager URLs related to the threat actor . If you are already familiar with the attack, skip to our contribution . Attack overview # On October 23, 2025 a Notepad++ user reported…
Overview # On September 30, Unit42 of Palo Alto Networks released a report about a new Chinese APT thay named Phantom Taurus. They've been tracking the activity of this actor for 2.5 years and now they determined that they knew enough to promote them to a new formally named threat actor. They describe a new .NET malware suite named NET-STAR, used by the threat actor. They publish 3 components:…
Overview # During our follow up on Phantom Taurus Assembly Executer samples, we analyzed many .NET samples that implemented some kind of AMSI bypass technique. Though we deemed them unrelated to the original Assembly Executers, they are still interesting from a what's inside a malware database standpoint. In this report we analyze the different kinds of samples. The process of finding these…
Like in any field of critical infrastructure or manufacturing, physical protection is crucial in a nuclear facility. In case an adversary can penetrate the site, they may disrupt operations causing vast economic damage, steal radioactive material to be used later in terrorist attacks, or threaten human life in a wide range of ways. Therefore, especially in the nuclear field, approaches in physical…
The task # Crack this SHA1 hash: 4e174bbc3e0a536aa8899d1f459318f797dc325a We have a machine with two NVIDIA GeForce RTX 4090 cards, so hash performance is GREAT! $ hashcat -m 100 -b Speed.#1.........: 47426.7 MH/s (44.94ms) @ Accel:32 Loops:1024 Thr:512 Vec:1 Speed.#2.........: 49805.4 MH/s (42.75ms) @ Accel:32 Loops:1024 Thr:512 Vec:1 Speed.#*.........: 97232.1 MH/s So the second card has ~50000…
tl;dr # create a writeable overlay .qcow2 image backed by the read-only base image attach the disk with qemu-nbd mount the windows system partition replace Utilman.exe with cmd.exe copy SECURITY and SYSTEM registry hives from the mounted partition create a UEFI virtual machine using Virtual Machine Manager with the .qcow2 attached boot up the machine, click on the accessibility icon in the bottom…
Problem # There's no built in solution in Ansible to be able to see the output of a long running command as it exeecutes. You can register a task's output and then print its output with the debug module after it has finished, but not while it is running: - name : Echo command command : echo "hello" register : hello - name : Print output debug : msg : "{{ hello.stdout }}" Async task # There's an…
TL;DR # Using the read function, we can write our shellcode to the stack and return to a jmp rsi gadget to jump on it, using the 0x10 byte stack buffer overflow. This challenge was marked very easy (~140 solves) but it took a looong time for me to figure out why. First I came up with a longer solution that didn't work on the remote server, but more on this bellow. Challenge: pwn_regularity.zip…
TL;DR # Using fgets stack buffer overflow, gain arbitrary write to known address using RBP control. Use this to overwrite strlen@.got.plt with call printf to leak libc address (others with their original resolver) and use the same technique to call system("/bin/sh") . This challenge was marked easy (40 solves) but I only got on the right track 1h before the end of the event so I couldn't solve it…
TL;DR # There is a byte copy in cmd_login() that copies until 00 and our input is not terminated after read , so there is a stack buffer overflow. The trick is that the index i is also in the path of the overwrite so we can jump over RBP to write on RET and not corrupt it. This challenge was marked easy (34 solves). Challenge: pwn_abyss.zip Exploit: exploit.py The task # You can download the…
Microsoft Cabinet archive files have MSCF magic at the beginning: 00000000: 4d 53 43 46 00 00 00 00 e3 aa 01 00 00 00 00 00 MSCF............ 00000010: 44 00 00 00 00 00 00 00 03 01 01 00 12 00 04 00 D............... 00000020: 00 00 00 00 14 00 00 00 00 00 10 00 e3 aa 01 00 ................ 00000030: e0 25 00 00 00 00 00 00 00 00 00 00 2d 07 00 00 .%..........-... Windows updates use forward and…