Recent content on Jackson T.
Contents Disclaimer Introduction Problem Space Solution Space Concluding Remarks Disclaimer This article contains subject matter that requires careful discussion. While the general topic is not new, this might be unsettling for some subsets of readers. It may result in feelings of disbelief in one subset, and perhaps feelings of dread in another. I kindly ask that we, including myself, keep an…
As a cybersecurity practitioner in the private sector, this question has been nagging me in recent years. At this time, I think my short answer is: we haven’t been doing enough to serve the national interest of Western countries, but we’ve been doing plenty to accidentally serve the interests of adversaries who seek to undermine the national interest. I understand this opinion might…
Last year, I watched a thought-provoking talk from David Krakauer (president of the Santa Fe Institute), and from it I learned a mental model about tools or what he called “cognitive artifacts”. He breaks down tools into two categories, one that improves our skills when not using them, and another that diminishes our skills to complete the tasks we assign them to. Paraphrasing a…
Autocratization (a.k.a. democratic backsliding) is happening around the world. While it is not solely caused by foreign adversaries of the West, it is being amplified by them as they seek power with cost effective levers that fall below the threshold of conventional war. With this disposition, it is in their interest to gradually morph us all into being the coarsened architects of our collective…
The technology tree from Civilization (turn-based strategy video game series). Bottom Line Up Front An analogy borrowed from marketing helps us understand one key difference in the thinking between sophisticated adversaries and many of the red teams that try to simulate them. Ad-tech is natsec-tech. Concepts that power personalized search engines and social media platforms can be used to reduce…
This hasn’t been ported over to the new blog. Redirecting to archived page …
This hasn’t been ported over to the new blog. Redirecting to archived page …
Below is some code I wrote that was helpful for recovering proto definition files from encoded descriptor blobs that were embedded in binaries. This uses a DebugString() function that’s available in the C++ binding , but a Python-based implementation of this is available in PBTK (Protobuf Toolkit) by @marin-m . I don’t think my implementation provides any advantage, and I probably…
Introduction This article introduces a more subtle way to hide data within Windows Registry keys. It avoids detection from RegHide because it leverages class attributes instead of null characters . Malware implants often need to persist data including configurations, encryption keys, modules, and so on. This can be done with varying degrees of sophistication, ranging from XOR-encrypted files to…
Summary : This post goes over how attackers could use search engines to find and abuse legitimate code-signing certificates. With this technique, I was able to find a valid code-signing certificate belonging to a leading tech company and disclosed it to them. This isn’t particularly novel but I’m writing this to raise defensive awareness that abusing code-signing certificates is not…
About This short post goes over the workflow I use for the PMKID attack using an Alfa AC1200 (AWUS036ACH) card with a bootable Kali USB and bettercap + hcxdumptool . I have noticed more results using hcxdumptool compared to wifi.assoc all in bettercap, but still prefer to view and log the output in bettercap, so this workflow helps make the most of both tools. There’s plenty out there about…
CVE details for a COM-based local privilege elevation with a brief write-up on the process from discovery to root. Part 1: Technical Advisory Part 2: Discovery Walkthrough Part 3: Exploitation Walkthrough Download exploit code here . Technical Advisory The CxUtilSvc system service (CxUtilSvc.exe) is associated with the Synaptics Sound Device Driver. The service exposes a COM interface named…
This post discusses a CVE for driver-based LPE with an in-depth tutorial on the process from discovery to root. At the end of this, we’ll better understand how to select worthwhile targets for driver vulnerability research, analyze them for vulnerabilities, and learn an exploitation technique for elevating privileges. If this sounds like your cup of tea, then grab it and start sipping. Part…
Here are five talks I enjoyed in understanding the state-of-the-art in memory corruption strategies and exploit mitigations. This should be valuable to anyone who is moving from traditional “CTF-style” exploitation and wants to know what they’re up against in today’s era. The Layman’s Guide to Zero-Day Engineering by @gaasedelen and @itszn13 is a talk on some of the…
Hey folks, happy new year. Today I wanted to go over how I do assessments on system images. I’ve been interested in this topic for a little over a year, and most of that experience has been on Windows 10. So this won’t cover other operating systems, but the concepts should still apply. I’m going start this series off with a barebones overview, and in future posts we’ll…
The goal here is to find valid IOCTL codes for the HackSys Extreme Vulnerable Driver (HEVD) by analyzing only the binary. The control flow varies between the binary and source due to compiler optimizations. This results in a situation where only a few IOCTL codes in the assembly are represented as a constant with the remaining being computed at runtime. The code in hevd_ioctl.py is a approximation…
Usage This script leverages the Project Zero exploit for a heap overflow vulnerability in the JScript library (CVE-2017-11907) to generate a payload for use with Responder . Generate a payload with main.py . Copy and paste the output into the WPADScript field of Responder.conf . test@test:~$ python3 main.py --help usage: main.py [-h] [-o OUT] cmd positional arguments: cmd Command (e.g. calc.exe).…
This post is about the approaches I’ve learned for finding vulnerabilities in applications (i.e. software security bugs, not misconfigurations or patch management issues). I’m writing this because it’s something I wish I had when I started. Although this is intended for beginners and isn’t new knowledge, I think more experienced analysts might gain from comparing this…
© 2010 Italy Travel Experience (CC BY-NC-SA 2.0) tl;dr : I found bugs in Oracle's hotel management platform which can be used to escalate app privileges and gain access into the operating system and database. An attacker on the network starting from an unauthenticated standpoint could exploit them to exfiltrate stored cardholder data. The issues were reported to Oracle, quickly patched, and CVE…
Occasionally there are times when command execution payloads via Runtime.getRuntime().exec() fail. This can happen when using web shells, deserialization exploits, or through other vectors. Sometimes this is because redirection and pipe characters are used in a way that doesn’t make sense in the context of the process that’s being launched. For example, executing ls > dir_listing in a…
In my line of work, I enjoy finding and exploiting subtle defects in systems that could be used to compromise the assets those systems are entrusted to protect. It’s extremely rewarding (and challenging) to dive deep into a system built for an unfamiliar problem domain so that I can understand it just enough to undermine its assumptions and gain unauthorized access. Inspired by the Underhanded C…
Decoding and Decompiling the APK apktool d crack-me-if-you-can.apk d2j-dex2jar -o crack-me-if-you-can.jar crack-me-if-you-can.apk java -jar procyon-decompiler.jar -jar crack-me-if-you-can.jar -o src Finding the Flag Two common starting points are the AndroidManifest.xml and strings.xml files decoded from Apktool. The AndroidManifest.xml file tells us that the main activity class for this…