Recent content in Kernal on kernal
Background After the United Kingdom passed the Online Safety Act 2023 went into effect in July 2025, many websites started forcing users to verify their age before accessing content deemed inappropriate for minors (this includes sites like YouTube, Spotify, etc., along with adult sites). This is also the case in the United States , where some states like Florida have passed similar laws. One…
Secure WiFi isn’t just about passwords. It’s about understanding every protocol, every port, every potential bypass. RasterSec provides comprehensive WiFi and network security audits: captive portal testing, wireless encryption analysis, segmentation validation, and real-world attack simulations. Have you noticed how many WiFi access points in Turkey require ID or phone numbers? The…
A while ago, I found an old Samsung SRD-852D DVR powering some analog security cameras in my home. I got curious and decided to take a look at it. Initial Recon I started by plugging the device into a VLAN with no internet access. I then ran nmap to see what ports were open. I found that the device was running a few services: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind…
Finding a place to store your backdoor/beacon/malware data can be tricky. Some ways that come to mind: creating new files, modifying existing ones or storing it in memory via /dev/shm . Malware on Windows has abused NTFS file attributes to store malicious data or binaries instead of metadata for a long while. I had the idea to experiment with the same on Linux while conducting EDR evaluation…
XMPP is an open standard mostly used for messaging. There are many server/client implementations and protocol extensions for XMPP. Servers can also be configured to federate with each other. An XMPP server belonging to an organization can leak crucial information such as employee names and titles, IP addresses and client information. An XMPP server can also be prone to MITM when encryption…
It seems that there isn’t really any good guides on how to do this when i did it a while ago. I struggled alot with understanding and getting everything to work right, so i’m writing one of my own :) This guide will be a compilation of wiki pages and random things, which i will link in the references section. Now to get into it, Setting up Prerequisites You will need the following to…
Vilnius Gediminas Technical University made its platforms inaccessible to its students by enforcing proprietary and privacy-compromising 2FA methods. The students demanded open standards and free software. Read the news post by Free Software Foundation Europe (FSFE) here . UPDATE 2023-04-26 The university has locked out its students again. Without notice as usual. Subject: University blocked…
One day, I wanted to switch my custom ROM and I downloaded the new one and rebooted to TWRP to flash it and I didn’t have any backups of system partitions like EFS! I flashed the custom ROM but my phone broke. even the splash screen of my phone was broken and nothing worked! when I rebooted my phone it got stuck in TWRP and rebooted to TWRP again and again and again, I tried flashing a…
The title contains Go because the post’s main focus is Golang and the golang-migrate library but the same logic can be applied to any language/library that does step-by-step migrations. The database I use is PostgreSQL but I made sure to indicate PSQL specific features. How does golang-migrate work? The golang-migrate can be imported into a project or its migrate binary can be called…
Introduction This post is an update to the previous post on Linuxfx . Please read that first if you haven’t done so. Aftermath Several hours after DistroTube uploaded a video on the previous post , the Linuxfx “developers” revoked the leaked database credentials after people started griefing the database. However, they did not properly fix the underlying issue, leaving the…
Update: More information about Linuxfx after this article was published can be found here . Introduction Linuxfx Software is (or was, depending on when you read this) a Brazilian “software” “company” run by skids, for skids. Their primary “product” is an “operating system” called Linuxfx, which is a Microsoft Windows 11 clone that also clones the…
What you need to do is: Create the sockets. Add the sockets to the set ( FD_SET ). Find the socket with the highest file descriptor for calls to select(). Above also works with different type sockets (e.g. AF_INET , AF_INET6 ). It even works if you have different type sockets (e.g. one IPv4 and one IPv6) listening on the same port number. Dual stack sockets are a thing but this approach is more…
UPDATE 2022-10-16: While the integration logic is still the same, there have been changes made to the API and the callback feature. Please refer to moneropay.eu for documentation. MoneroPay is a simple backend service for merchants, developers and everyone who is looking to accept XMR. It sits on top of a wallet RPC server instance and provides a simple API. What makes MoneroPay stand out is its…
We apologize for the inconveniences caused by our 5 day Matrix downtime. Some of our sysadmins got stranded at weird corners of the world. Although there is a lack of documentation on migration, migrating Synapse is fairly easy. Here is a checklist of what you need to do: Make sure Synapse isn’t running. Backup the Synapse database. Copy over the media store, homeserver configuration files…
This lovely province in eastern Turkey. I have attempted to email their IT staff and the province itself. Unfortunately the email address they provide on their contacts page is a Yandex free plan and they have ran out of storage. <bilgi@sirnak.bel.tr>: host mx.yandex.net[2a02:6b8::311] said: 552 5.2.2 Mailbox size limit exceeded 1615727140-JVz3btrGZk-5e9O9Bd0 (in reply to end of DATA command)…
Background information The following vulnerability was reported to the National Cyber Security Centre (“NKSC”) and patched within days. Access control is a security process that controls usage of specific resources within a predefined criteria. “National Health Insurance Fund under the Ministry of Health” also known as “VLK” in Lithuania is an institution that…
We’ve seen the recent CityBee leak from Lithuania (the report is on this site). The main cause of this strategy is a misconfiguration of the Azure Blob Storage, allowing public unauthenticated access leading to the leakage of over 110,000 users’ information. So I was thinking, what if we could replicate this with Amazon S3 Buckets? And heck yeah it worked. So just like the steps shown…
Introduction All of this is obviously for educational and informative purpose. And I do not support any sort of crime either. All of the information below comes from the researcher himself from his interview and some of my own tests obviously. :D Well what even is CityBee you may ask? It is a car, bike and scooter rental service in Lithuania. And oh yes they store some data (can tell that just by…
Quick story About a year ago I had found this design feature . If you go to http://narsyk.tele2.lt/ while on mobile data it displays how much mobile data you have left and most importantly your own phone number. After a scandal by another security researcher from Lithuania. Tele2 and most other providers fixed this design feature (they even replaced the large part of the phone number inside…
It is very easy to root a machine if you have access to the bootloader and can change it’s boot parameters. In this tutorial I am going to show common flaw with virtual machines and exposed unauthenticated VNC access. Let’s get rolling. To begin with. all you need is a VNC client. Or other sort of hardware access. I recommend using TigerVNC Viewer . Typical ports for VNC are: 5900 ,…
Do you like watching movies with friends? Every night??? Even tho it is the middle of pandemic but it does not matter as they live thousands of nautical miles away anyway? Or maybe torrenting seem a bit tedious and inconvenient as everyone having to download same file? Read ahead our setup has none of the above mentioned flaws. :) Here we are going to use qBittorent-nox as our torrent client. We…
Have you ever had your .pdf file being opened with GIMP by default? Or maybe even worse .txt file opened by Notepad via Wine? Well good news. This post is exactly for you. How does it work? GUI application usually includes a Desktop Entry file. Which describes what MIME types it can handle. Usage examples View all XDG desktop entries echo $XDG_DATA_DIRS | tr -d '\n' | xargs -d : -I % find…
Some Background Raunt (RNPlayer) and VCloud (VCollabPlayer) are both remote education software made by a Turkish software company called Sebit (who also has a past of making several popular education platforms, it’s a shame to this day they still haven’t learned or simply don’t care about information security). There are only two instances of these software: Sebit’s own…
This year has been a race condition. A race condition of a bunch of shit with fuck-all memory management. Perhaps that’s why the year crashed this fast. Some good things also happened such as: We got some new members. (primarily from our onion service) Introduction of a new server called doner.kernal.eu which hosts our mail server. We ended the year with quite a few interesting data…
WHAT!? They Put MINECRAFT In POSIX SHELL!?!?!? We GNU/musl/BusyBox/Linux boomers were in need of real Command-line Minecraft launcher for a long time. Because Graphical user interface on Tiling window managers gives us severe anxiety . So here I announce a new revolutionary Minecraft launcher written purely in POSIX shell WOW!!! This was inspired by Luke Smith and this video: Oh, yes where can I…
What’s the point of doing this? Well you might end up in a place that only allows HTTP/HTTPS traffic which is pretty common in schools, universities, dorms, etc. Once when I stayed in a dorm I noticed that most non-whitelisted ports and IP ranges were throttled. Ok so let’s begin… Requirements: WebSocat — Netcat, curl and socat for WebSockets. Nginx — High Performance Load…
But why? You might ask what’s the point of this because Termux exists? Right? Well the answer is simple… Why thfq not??? Show your {boy,girl}friend that you’re a real boomer . Termux is for skids with questionable skills and nationalities . :-D You also get full software and hardware control. Way more efficient and extensible. Step #1 Root your device Blah blah blah. Seriously…
Why would anyone do this? Most VPS providers only give so many distros to choose from. Usually all they provide is ancient Debian Debilian based distros and sometimes CentOS or Fedora if you’re lucky and for Ubuntu I have no words to say . Might as well use TempleOS or Haiku :) Real chad sysadmins need Void (Linux) or at least that’s what I prefer myself and that’s what I’m…
Structure This CTF consists of 3 VirtualBox image files . Skids_playground.ova - Beginner (Skid) level. * Actually not so easy nor interesting… Suggest skipping. The_Young_God_lives_here.ova - Intermediate (Elite gamer) level. Slitaz_go_brr.ova - Experienced (1337 Haxor) level. To start playing you will need to install VirtualBox and also the VM images listed above. Note: Login into the 1st…
This post describes how to have a server operate ncurses on its clients’ sockets. Limitations ncurses has to know what sort of terminal the client is using beforehand. In this post I will assume it’s xterm. ncurses isn’t thread-safe. For handling multiple clients a multiplexed approach is required rather than pthreads. Drawing to a remote terminal After the standard way of socket…
First type: The marshal Algorithm: import marshal , zlib , base64 exec ( marshal . loads ( zlib . decompress ( base64 . decode ( 'Skid stuff here' )))) Deobfuscation: Replace exec() with a variable claration: skid = marshal . loads ( zlib . decompress ( base64 . decode ( 'Skid stuff here' ))) Add imports that will be used in the latter steps import py_compile,time,ast Write the code object got…
Here is the Ghetto-Pi running i3 Hardware Raspberry Pi 3b+ 3.5" TFT screen A 5Ah smartphone powerbank with 5V and 1.5A as output Bluetooth keyboard of unknown brand Enclosure: Who needs enclosure? We are ghetto, we don’t own a 3D printer. All of the above are from Aliexpress. Software I didn’t want to have issues with the TFT’s drivers so I chose the recommended distro, that is…
UPDATE 2022-05-25: We have moved to Matrix, #join:kernal.eu . Sorry comrades for making this post a little bit too late. I wanted to set this up yesterday (2019-06-24) but oh well unexpected issues like always … I know this doesn’t mean that much to newer members of kernal but it really does matter for me. :) Thank you all for keeping this community alive for so long. So here I…
Who are we? Kernal is a small funny, friendly and talented community of “hackers” or other weirdos. And this is our official blog coming from our darkest and dankest headquarters… Our primary goal is to meme, create and overall have quality time while keeping our user base small and friendly. We work to make each other stronger through sharing our progress, achievements and…
VPS hosting Members can host their own services on our dedicated server. Matrix Registration is not public, you will need to ask an admin to create you an account. Homeserver: https://matrix.kernal.eu kChat kChat or Kernal Chat is a functional chat-room server that you can connect using netcat, telnet or any TCP client. We suggest installing rlwrap and connecting with it to prevent overlapping…