Recent content on OJ's Perspective
TL;DR We’re going to build a .NET implementation of Meterpreter live on stream. Together. From scratch. Read on for all the details! The Backstory I remember kicking off my first ever live stream on Twitch back in September 2016. It feels like a lifetime ago already. That stream, broken up into two parts (1, 2), was me breaking open the Capcom.sys driver that had a blatant backdoor in it and…
Earlier this month, I donated a CTF challenge to the legendary bunch of folks that ran the Kiwicon CTF in Wellington. It’s a bit of a tradition for me to pass on at least one challenge, and I felt it was worth keeping that tradition going this year. The challenge was attempted by a few people during the conference, however I don’t believe it was successfully owned. As a result, I…
BSides Canberra for 2017 has just finished up! A cracking 2-day conference hosted by a bunch of infosec folks down here in Australia, and everything went as well as it could have. It was great fun, and the vibe there was really awesome. If you’re here for the details on how to get the CTF challenges running locally, jump to the bottom of the post. Keep reading if you want more information on…
In an effort to help dispel the myth that many security people are able to break things without trying or thinking, I decided to start live-streaming my desktop while doing various security-related things. The aim is to show that: I am stupid. I don’t know what I am doing! It’s ok if you don’t either! Security stuff is tricky, finnicky, and frustrating. It’s also awesome…
At the beginning of this year I agreed to help a good friend out and build a challenge for the BSidesCbr 2016 CTF. The aim was to: Create a fun binary pwnable. Avoid the typical exploitation paths (eg. stack/heap buffer overflows, format strings, etc). Include a couple of code related issues that are close to my heart. Design it so that multiple issues needed to be abused in order to gain code…
Recently I started live-streaming some security-related stuff on Twitch because I enjoy teaching other people and showing them the processes, tools and techniques that I use while attempting to not suck at breaking stuff. Last night I did my second stream, which aimed to cover the following: A quick analysis of a vulnerable 32-bit Linux binary. An explanation of how stack buffer overflows can…
Metasploit comes with a variety of payloads, as we all know. Those payloads come in a few different types, and vary depending on platform. Of those types, there are two major “categories” available with a key difference that is often not understood. They are staged and stageless payloads. The purpose of this post is to talk about the differences between these two, particularly in the…
I’m just another security guy trying to make the world a better place, one hack at a time. I live stream hacking and development. I help out a bit with Metasploit and Meterpreter. I’m a proud member of the Corelan team. I’ve managed to acquire OSCP and OSCE certifications. I run a specialist security consultancy called Beyond Binary.
Hit me up on Twitter. Throw a comment on a blog post on this site. Drop me an email, my address is oj@<this domain>. If it’s sensitive you can use my PGP key and send me an email.
Active users of Metasploit will no doubt be aware that Meterpreter is still being actively developed and enhanced by a bunch of people. I’m lucky enough to still be one of them! In this post I just want to cover a few things that have been done to it recently, and to give a bit of visbility of how I am able to continue contributing in the way that I do.
As many of you are already aware, Metasploit and Meterpreter talk to each other using a variety of transports. While the transports may vary from session to session, one thing that doesn’t vary is the “protocol” that travels over those transports. This information fits a well-known structure, and is referred to as TLV Packets (Type, Length, Value). Once a session has been…
This post contains a walk-through of the process required to solve The Blender . The Blender was a reverse engineering challenge that I built and submitted to hyprwired for inclusion in the Kiwicon CTF . The challenge wasn’t intended to be too mind-boggling, but it turned out that nobody was able to solve it on the day. I won’t deny that this didn’t me feel awful and great at the…
In October last year, while conducting an internal assessment for a client in Sydney, I found a vulnerability in a vendor product. The flaw allows for remote code execution on the device, as the root user , without requiring authentication. Needless to say, “instant remote root” vulnerabilities are bad. On the scale of bug severity, they’re up pretty high. For a device such as…
In November last year, I was fortunate enough to participate in the beta testing of “ The Playground ” – a new product from the folks who gave us OSCP , OSCE and others, Offensive Security . The Playground, otherwise known as the “Virtual Penetration Test Labs”, is an environment designed to aid in practising and honing your skills as a penetration tester. Offensive…
This post contains a detailed account of how I solved the Saturn exploitation challenge during CSAW 2014 CTF . I thought that this challenge was very entertaining, hopefully you will too.
During the course of exploit development it is not uncommon to require jumps in your shellcode. The most common case for these jumps is when doing SEH overwrites , due to their nature. There are times when the author of the exploit has a hard time performing these jumps due to the fact that only a subset of characters are deemed valid for use by the target application in that particular input…
In my previous post I covered off, in relative detail, how to exploit the IDSECCONF offline CTF myftpd server running on Windows XP. This exploit makes use of a Vanilla EIP overwrite along with some shellcode golf to allow for execution of arbitrary payloads. At the time I had intended to write up a way of making this work on other versions of Windows, but that post ended up long enough so I…
Update 2018-09-13 Lots of people have asked for a copy of the binary so that they can play along with this. I’ve contacted Ammar and he has said it’s ok for me to provide it here. So for those that are keen to have a go at this themselves, have at it! . On with the Show With OSCE out of the way and the family in need of a break from me doing study and certifications, I decided to turn…
I might not have mentioned this before, but I have to tell you that building Meterpreter is easy. In the old days, downloading the source was the easy bit and compiling it was the hard bit. The steps involved in getting a Meterpreter build environment together were extensive and prone to error. In fact if you got one wrong, or you did things in the wrong order, then you could end up having to…
I have always found it hard to separate myself from something that I have a keen interest, and this has certainly proven to be the case when it comes to Information Security. My recent foray into the field, both as a developer and as a wannabe pentester/researcher, has had a big impact on me and my desire to learn more has not lessened as time has passed. When I passed my OSCP exam last year I…
In August this year I was fortunate enough to land a three-month contract working with the awesome people at Rapid7 . The job: make Meterpreter more awesome on Windows . That’s right more awesome than it already is. Tough gig, but what an amazing opportunity! Those three months have already come and gone, and what a ride it has been. In this post I would like to detail some of the work that…
Since publishing the article that detailed my experiences with the PWB labs and the OSCP exam, I have received scores of emails from potential and current students searching for more information and (quite often) hints. While I do my best to answer most of them, it’s close to impossible to get to them all as my email debt is already way too high. From this point on I have decided not to…
If you haven’t ever heard of Meterpreter before, you might want to go and take a look at it before reading this post to help give some context. In short, Meterpreter is an amazing library that is part of the Metasploit Framework and can be used to give you tremendous power and control over target machines during a penetration test . Anyone and everyone in the security game is most likely…
The PWB course by Offensive Security is absolutely awesome, as is the exam which earns you the prized OSCP certification. I took this course and exam recently; I loved it and I nailed it! I am now equipped with a much better understanding of the security world and am in a better position to help businesses improve the security of their application architecture and infrastructure. Hit me up and…
I’ve been documenting my experiences with IO at SmashTheStack for a while, but decided not to post them publicly for a few reasons. However level 7 (in particular the alt level) was the first that I thought worthy of posting. This post includes how I broke both applications to make it through to the level 8. If you haven’t had a play on the SmashTheStack wargames yet, I really do…
Given my renewed focus on security I’ve been looking to lock down much of my communications so that I feel more secure online. One of the things that I use quite a lot to connect with people who know WTF they’re talking about is IRC. #freenode is my network of choice as it has a bunch of interesting places with fairly active communities. irssi is my current client of choice for a few…
Forgive the title of the post, it was hard coming up with something succinct that captured the purpose of the post. This was inspired by a recent experience with a client who had this exact problem with one of their production systems. TL;DR Never use Request.QueryString to access parameters in your views, even when you’re sure your actions have validated them. You may open your application…
For the past two years I’ve been heavily involved with organising two user groups in Brisbane: BFPG and BNoSQL. Those of you out there who organise your own user groups no doubt know how much is involved in keeping these things going. My focus has been on building communities around the subject matter and trying to get attendance up. It was a tough gig. For the most part I think I succeeded…
Life is way too short to be working on boring, uninteresting or meaningless stuff. Get out there and do what you love. Screw working for the dollar on something that you don’t enjoy. Don’t study in a field that doesn’t inspire you just because you got the marks or because people expect you to. Don’t do what you’ve always done just because it’s easy. Chase your…
{% img right /uploads/2010/09/riak-logo.png ‘Riak Logo’ %}Newcomers to the series should first take a look at the previous four parts of the series ( Part 1 , Part 2 , Part 3 , Part 4 ) first to make sure that you’re up to speed. Feel free to read on if you feel comfortable with the general concepts in use. When we finished Part 4 we were able to authenticate users using Twitter…
Webmachine is currently my favourite tool for building websites. I’ve been lucky enough to use it on a few things now, some commercially some personally. While working on my Erlang web development series I had to handle the case where URLs redirected to other URLs. I found some basic documentation on this but wasn’t able to find a canonical example of how to do it. After a big of…
{% img left /uploads/2010/09/riak-logo.png ‘Riak Logo’ %}For those of you who are new to the series, you may want to check out Part 1 , Part 2 and Part 3 before reading this post. It will help give you some context as well as introduce you to some of the jargon and technology that I’m using. If you’ve already read then, or don’t want to, then please read on! Upon…
The topic of tools is often a hot one amongst developers and every year we see an influx of blog posts where people rant and rave about which ones they love the most, and why. Far be it from me to stay out of such a discussion! Here is a list of the tools that I use as of the end of January 2012. Some are simply noteworthy. Others are very handy and while I would get by without them they would be…
I was about to head to bed when I stumbled across a poorly-titled article on news.com.au . At first I thought it was going to cover off the best locations around Australia, or perhaps the world, for finding work in a variety of industries. It turned out to be a failed attempt at highlighting the key growth industry areas for jobs in Australia. It began like this: JOBS demanded across several…
I can clearly remember the first time I got involved in an Agile project – it was back in 2004, it was in London and in the finance industry (insurance to be exact). When I joined the project the team was small though over time it become much bigger. While on that gig I met and worked with a few of the nicest and best devs that I’ve worked with ( RobG , Yoann and The Chief ). It was an…
When I first signed up for Twitter back in mid-2008 I didn’t really take it seriously. My view was that it was a toy and one that I intended to have a bit of fun with. I didn’t really think that it would turn into what it did. I certainly didn’t think it would be such an amazing source of information, nor did I expect it to give me contact with so many smart and interesting…
Last week JP and I released our first Open Source project, CorrugatedIron . The release seemed to be fairly well received by those people who gave it a spin. We’ve had some good feedback along the way which we’ll be evaluating, and no doubt those suggestions and comments will be influencing the future of the library. In the interim, we wanted to get another version out which sorts out…
It’s Alive! It is with great pride that I introduce my first ever Open Source product release: CorrugatedIron ! A feature-rich .NET client for the Riak Key-Value store. Together with my partner-in-crime Jeremiah , we’ve put together a driver which exposes a great deal of Riak’s functionality. CorrugatedIron is at v0.1.0 , and while it doesn’t support every feature the Riak…
At an early age I realised that it’s not always a bad thing to go with your first instinct. I won’t go into the reasons here, nor the way I came to that conclusion. What I will say is that I wish I’d listened to my inner-8-year-old-self when I started down the thread of emails and Tweets you’re about to read. Suffice is to say that I have learned my lesson! The thread…
For those of you who are new to the series, you may want to check out Part 1 and Part 2 before reading this post. It will help give you some context as well as introduce you to some of the jargon and technology that I’m using. If you’ve already read then, or don’t want to, then please read on! This post builds on the previous two, but not without a few little modifications. If…
In the last few days I’ve been working on resolving issues in a production system which runs on ASP.NET MVC 2 . Most of the issues were actually really easy to resolve and the team of developers were able to fix them and deploy to production without too many problems. Unfortunately, as always, there was one problem in particular that had us scratching our heads and was causing some of us to…
In Part 1 of the series we covered the basics of getting the development environment up and running. We also looked at how to get a really simple ErlyDTL template rendering. If you haven’t yet gone through Part 1, I suggest you do that now. If you have, read on! There are a few reasons this series is targeting this technology stack. One of them is uptime . We’re aiming to build a site…
It has been a long time coming, but the first post is finally here! This is the first in a series of post, as promised a while ago , covering off web development using Erlang . This post is the ubiquitous “get up and running” post, which aims to get your environment set up so that you can dive in to development. The next post will detail how to handle a basic end-to-end web request.…
The time has come for another meeting of the Functional Programming minds! This months BFPG Meetup, starting 6pm Monday 28th, is the first one at our new venue: Microsoft HQ, Waterfront Place, Brisbane. For details on the location, take a look at the BFPG about page. This month we have three speakers, and I am one of them! In my talk, “Erlang - Why should you care?”, I will be giving a…
Two nights ago I was fortunate enough to attend a YOW! Nights conference held at the local Microsoft Office here in Brisbane. The speaker for the session was none other than Dave Thomas , the man behind the likes of ObjectMentor . Not only is this guy incredibly switched on, he is thought-provoking and very entertaining to boot. I’ve been to a few of these sessions in the past but I’ve…
What is Perception? As cheesy as it sounds, I’m going to start off with a definition ripped straight off Dictionary.com : perception noun the act or faculty of apprehending by means of the senses or of the mind; cognition; understanding. immediate or intuitive recognition or appreciation, as of moral, psychological, or aesthetic qualities; insight; intuition; discernment: an artist of rare…
The title of this post is a statement that I’ve heard a few times in the past while at work. The people who said it might not have used those exact words, but the intent is the same. Usually I hear it in the following form: “We’re very happy with the work you’ve done for us as a contractor. We want to keep you on, but would like you to take a job as a permanent employee and…
Not too long ago I mentioned that I’d setup and installed Nginx on this server. All seemed well to start off with, then on certain occasions I started to notice that some pages were being served truncated while I was at work. I thought that the issue was work-related, as they have a fairly draconian security policy in place and I thought that it had something to do with severing the…
There is one thing about my industry that I still find truly amazing (and not in a good way). This is despite the fact that it has happened to me so many times that you think I’d be used to it! I’m talking about non-technical people making technical decisions. For some reason, it’s a very common practice for those people who don’t have expertise in a certain field to make…
I’ve recently discovered the joys of CodeKatas . If you’re a geek looking for a way to sharpen the saw then I highly recommend taking a look at these and trying a few out. They’re great fun and they’re a good way of getting your feet wet with new languages (especially if you’re tired of Project Euler ).