Stuff I find interesting.
Overview A long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to modify the device to have an open WiFi access point and a web server hosting banned books. The idea was that if you lived somewhere that banned books you thought were important, you could theoretically…
I've tried using RSS readers a few times in the past. I had liked the idea of RSS but for whatever reason it never stuck. I think what tended to happen was that my reading list would get so backed up it would start to feel overwhelming. I had chosen to follow all of those feeds and felt almost an obligation to read every single post from every one. But some of them were uninteresting or otherwise…
Am I Afraid of AI? I'm not afraid AI is going to take over the world and enslave us all. But recently I realized that I'm afraid to use AI tools. And I'm simultaneously afraid I'm missing the boat. I had a conversation the other day with some friends about AI and how they were or were not using it. Someone posted an AI-related article and I started asking questions about how agentic AI works and…
Background At the end of 2024 I had wanted to learn more about Windows driver exploitation. I've spent a fair bit of time in Windows user-land, but not with the kernel. I haven't looked at the Windows kernel much since I took the OSEE course . So I set a goal for myself this year to research a known-vulnerable Windows driver and craft a functional exploit. The goals of this project were to: Choose…
Background Someone I know once told me about a device they purchased at a county fair. It's a small box that you plug into your TV and hook up to your Internet connection. It's basically a digital content streaming box (like a Roku), except the seller claimed that you could get any movie or TV show you wanted for free. This supposedly included live television and films that were still in theaters.…
CVE-2023-40477 I've recently been looking at N-day vulnerabilities in Windows software in an attempt to hone my reverse engineering and exploit development skills. Last month, I read about an interesting bug in WinRAR version 6.22 and below which could result in remote code execution. This bug was assigned CVE-2023-40477 . It was discovered by Zero Day Initiative . When I started, all the…
Intro After recently finishing the Offensive Security OSEE exam, I wanted to start looking at some real-world vulnerabilities in Windows. I had hoped I might find a recently patched vulnerability with an available PoC that could simply trigger the bug. If a PoC wasn't available, then maybe a blog post somewhere doing a root cause analysis so I could build my own PoC to trigger the bug, and then…
Updates When I left off in my last post , I had only just started working on the OSEE course material at home by myself. Now a whopping nine months later, I'm finally done with the training. It's been a long road and a lot of work, but it was worth it! Best Laid Plans My original plan when I got back from Blackhat and Defcon was to work on one module per month leading up to the exam. They told us…
Background Check Point Research recently disclosed three security bugs in the Microsoft Windows MSMQ service. The most critical bug disclosed was CVE-2023-21554 . They've named this bug QueueJumper and claim that it can result in unauthenticated remote code execution. Recently, a few coworkers discovered some vulnerable systems on their network penetration tests and were trying to find public…
The Browser Bookmark Problem I've been looking for a better way to bookmark useful content I find on the web. I've got a number of bookmarks stored in Firefox, but I find that I rarely look through them. Occasionally when I do, I'm surprised to find something interesting that I had completely forgotten about. Even when I know I have something bookmarked somewhere, I tend to just run a web search…
Background OpenAI chat has exploded in popularity over the last couple of weeks. People are using it to do all sorts of interesting things. If you are unfamiliar with OpenAI Chat and GPT-3, you can find a primer here . The gist is that it's an artificial intelligence model that you can chat with as if it were a person. It can do all kinds of things like answer questions, write code, find bugs in…
Background I'm currently taking Offensive Security's PEN-401 course and studying for their OSEE exam. One concept I've been learning about is Supervisor Mode Execution Prevention (SMEP). I found it to be one of the more confusing topics to learn, so I thought I'd try to explain how it works to help fill my own knowledge gaps and better solidify my own understanding. Supervisor Mode Execution…
Summary of tips for the training course Study before you arrive Use the syllabus as a guide to fill knowledge gaps. Study the material they send before the course begins. When you are given time in class to do an exercise, find the exercise in the guidebook and follow along there. Study the guide book in the evening to fill in any knowledge gaps. Ask questions during class if you need to. That's…
Background I recently worked on a phishing engagement involving a malicious email attachment. The final payload was an executable file that exfiltrated some data back to a server under my control. I'd normally use my attack server for this, but my attack server was already in use, so I opted to use Burp Suite's Collaborator to catch my exfiltration payloads. My employer has their own collaborator…
Last week I was working on a social engineering engagement that included pretext phone calls, email phishing, and USB drops. I had to build payloads for the phishing email attachments and USB drops. This engagement was standalone, and therefore was not supporting other testing efforts like an internal pentest. Therefore, the payloads didn't have to do anything fancy. I just needed proof that they…
Introduction I'm taking Offensive Security's PEN-401 course this summer in an attempt to earn my OSEE certification. It's the most difficult and most technical course they currently offer. I really enjoyed earning my OSCE and OSED certifications through them and I figured some day I would make an attempt at the OSEE. I wasn't expecting to go for it in 2022, but they reached out to me with an…
Aha! I think I figured something out. I did some web searching to see if I could figure out how to identify the firmware entry point address. I found a StackExchange post that mentioned something called a "reset vector". It sounds like a reset vector is a pointer that the CPU looks at to tell it where to begin program execution. The reset vector location is CPU-specific. I went back to the…
After having dumped the firmware for my Kantronics KPC 9612+ TNC, my next thought was to try and disassemble this code with IDA Pro, however it turns out IDA Pro free edition doesn't support this architecture. I'm not excited enough about this project to go spend the money on a professional license. Next I tried Ghidra. I hadn't used Ghidra before, but it seemed like a good time to test it out.…
After working on my WinAPRS exploits , I had a thought that my ham radio TNC (radio modem) could have vulnerabilities built right into the TNC itself. I have a Kantronics KPC 9612+ TNC. I think it originally was released sometime in the 1990's and was finally discontinued in 2020 for a newer model. Mine still works just fine, though. The TNC runs its own little operating system that supports…
In early 2021 I took an Offensive Security course to earn my Offensive Security Exploit Developer certification. This course taught me a lot about exploiting memory corruption vulnerabilities in Windows 32-bit programs. It was also a lot of fun. Aside from security things, I also dabble in ham radio. Most of my experience with ham radio has been through the use of packet radio and other digital…
My name is Rick Osgood. I'm interested in infosec, open source software, making things, breaking things, and more. This website exists for me to share things I find interesting. Maybe you'll find some of this stuff interesting too!
My friend Sierra has gone through two Fitbit Charge’s now. Each time the strap game unglued from the FitBit itself. There’s really nothing you can do to fix it at that point except for try to glue it back together. She asked me if I could try making a leather strap for her old one and I gladly accepted the challenge. I didn’t take any progress photos since this was a pretty small project.…
I got my ham radio license eight years ago so I could use it for a high altitude balloon project with some friends from college. We had a lot of fun, but I haven’t used the license much since then. I get into it for a few weeks every couple of years and then get bored. I just don’t have much interest in talking to strangers over the air. I’ve always been much more fascinated by the idea of packet…
The last phone and wallet holster I made was designed to be super simple and inexpensive to make. I did modify it a little bit by adding some extra holes for adjustments as well as adding a Chicago screw on the back to hold the two straps together. That helped keep the whole thing from shifting around too much. Two days ago I suddenly was inspired to make a more decorative back piece for the…
I build a holster for my everyday carry items last year. I love the thing, but it’s a bit bulky, heavy, and flashy. I’ve been wanting to make a much more simple holster for some time now, but I wasn’t sure how I wanted to design it. Then last week, a redditor contacted me asking if I could build them a simple phone and wallet holster. Also, Uncharted 4 was finally released! These two things…
I have been pretty lazy ever since I moved into my new house last November and took a three week vacation. I haven’t had many projects lately, but after going to SOAK last May, I was finally inspired to do something. SOAK is the regional Burning Man event for the Pacific Northwest. I had never been before, but I had a blast while I was there. I noticed that some people had some nifty leather…
After months of work, I finally got my Nathan Drake costume together. Just in time for Halloween. Luckily, most of the stuff was easily obtainable online. It was really the custom leather work and buckles that took up all the time. Here are a few photos to show the completed costume.
To finish off my Drake costume I also ended up making a belt and a leather cuff. It’s going to be a mishmash of Uncharted 1 Drake and Uncharted 2 Drake. I was able to buy the belt buckles from Uncharted 1 and 3, but the Uncharted 2 buckle doesn’t actually exist in real-life and I didn’t have time to make something. So I went with the Uncharted 1 buckle and made the belt look the same as the…