https://blog.xpnsec.com/Recent content on XPN Infosec BlogHugoen-gbSat, 25 Jul 2026 19:19:16 +0000https://blog.xpnsec.com/articles/#jailbreaking-local-models-with-jsonSat, 25 Jul 2026 19:19:16 +0000https://blog.xpnsec.com/articles/jailbreaking-local-models-with-json/This article demonstrates how to jailbreak local models using constrained decoding.https://blog.xpnsec.com/articles/#benchmarking-malicious-agentThu, 16 Jul 2026 19:19:16 +0000https://blog.xpnsec.com/articles/benchmarking-malicious-agent/In this article, we're going to look at how we benchmark the performance of our agent, and improve this capability with the macOS 27 Evaluations framework.https://blog.xpnsec.com/articles/#extracting-credsMon, 13 Jul 2026 19:19:16 +0000https://blog.xpnsec.com/articles/extracting-creds/This article shows the power of macOS 27's new foundation model and OCR model for extracting credentials.https://blog.xpnsec.com/accidental-c2/Sat, 09 May 2026 19:19:16 +0000https://blog.xpnsec.com/accidental-c2/Dev Tunnels aren’t “just port forwarding”. They consist of layers of embedded protocols with RPC messages being exchanged. Once you peel the layers, you quickly see how Dev Tunnels are a C2 framework with extra steps.https://blog.xpnsec.com/an-evening-with-claude-code/Sat, 29 Nov 2025 19:19:16 +0000https://blog.xpnsec.com/an-evening-with-claude-code/A deep dive into discovering CVE-2025-64755, a vulnerability in Claude Code v2.0.25. This post walks through the process of reversing the obfuscated Claude Code JavaScript, and exploiting weak regex expressions to achieve code execution unprompted.https://blog.xpnsec.com/administrator-protection/Fri, 20 Jun 2025 23:01:46 +0000https://blog.xpnsec.com/administrator-protection/Microsoft will be introducing Administrator Protection into Windows 11, so I wanted to have an understanding of how this technology works and how it interacts with existing offensive tooling. While this technology is just a thin wrapper around a separate account, there are a few nuances such as who is permitted to access these accounts, as well as existing UAC bypasses which are still effective against the new "backdoorless" Administrator Protection. This post explores these nuances in detail.https://blog.xpnsec.com/tokenization-confusion/Wed, 04 Jun 2025 23:01:46 +0000https://blog.xpnsec.com/tokenization-confusion/In this post we look at the new Prompt Guard 2 model from Meta, and introduce a concept I've been calling "Tokenization Confusion" which aims to confuse Unigram tokenization into generating tokens which will result in the misclassification of malicious prompts. We'll also look at why building up our ML knowledge will lead to better findings when assessing LLM API’s, as I discovered during a flight across the Atlantic.https://blog.xpnsec.com/the-sql-server-crypto-detour/Wed, 16 Apr 2025 23:01:46 +0000https://blog.xpnsec.com/the-sql-server-crypto-detour/One of the things that I love about my role at SpecterOps is getting to dig into various technologies and seeing the resulting research being used in real-time. This post will explore one such story of how I was able to go from a simple request of recovering credentials from a database backup, to reverse engineering how SQL Server encryption works, finding some new methods of brute-forcing database encryption keys.. and finally identifying a mistake in ManageEngine’s ADSelfService product which allows encrypted database backups to reveal privileged credentials.https://blog.xpnsec.com/adfs-living-in-the-legacy-of-drs/Sun, 12 Jan 2025 23:01:46 +0000https://blog.xpnsec.com/adfs-living-in-the-legacy-of-drs/In this post we’re going to focus on some ADFS internals. We’ll be looking at OAuth2, and how it underpins the analogues to Entra ID security features like Device Registration and Primary Refresh Tokens.https://blog.xpnsec.com/identity-providers-redteamers/Mon, 18 Mar 2024 23:01:46 +0000https://blog.xpnsec.com/identity-providers-redteamers/Originally presented at SOCON-2024, and continuing the series into post-exploitation techniques against Identity Providers, in this blog post we'll look at Ping, OneLogin and Entra ID. I'll discuss how post-exploitation techniques effective against Okta apply to other providers, release new tools for post-exploitation, and look at what proves to be effective when critical assets lie beyond an Identity Provider portal.https://blog.xpnsec.com/dirtynib/Wed, 04 Oct 2023 23:01:46 +0000https://blog.xpnsec.com/dirtynib/While looking for avenues of injecting code into platform binaries back in macOS Monterey, I was able to identify a vulnerability which allowed the hijacking of Apple application entitlements. Recently I decided to revisit this vulnerability after a long time of trying to have it patched, and was surprised to see that it still works. There are some caveats introduced with later versions of macOS which we will explore, but in this post we’ll look at a vulnerability in macOS Sonoma which has been around for a long time, and remains an 0day, urm, to this day.https://blog.xpnsec.com/okta-for-redteamers/Mon, 02 Oct 2023 20:01:46 +0000https://blog.xpnsec.com/okta-for-redteamers/In this blog post, I'll discuss some of the post-exploitation techniques that I've found to be useful against Okta. Specifically, this post will look at how to use delegated authentication to our advantage, silver tickets, Okta AD agent spoofing, and finally how to deploy a fake SAML provider.https://blog.xpnsec.com/lapsv2-internals/Sun, 13 Aug 2023 10:03:31 +0000https://blog.xpnsec.com/lapsv2-internals/This year, LAPS 2.0 was released by Microsoft, and thankfully it now comes built-in to Windows. This time it comes ready for use with Active Directory, as well as being supported in Azure AD aka Entra ID. In this post, we’ll look at how LAPS 2.0 for Active Directory works under the hood, so you can make those fresh recommendations to your clients, and prepare yourself for the inevitable question... “But we just deployed LAPS.. what does LAPS 2.0 do differently?!”.https://blog.xpnsec.com/png-steganography/Wed, 09 Aug 2023 10:03:31 +0000https://blog.xpnsec.com/png-steganography/Steganography is experiencing a revival as a wrapper for delivering payloads. In this post we'll go back to basics and show just how steganography can be applied to a PNG image using the common least significant bit (LSB) encoding technique. No magic... just raw information... and a little C++.https://blog.xpnsec.com/building-a-mach-o-memory-loader-part-1/Sat, 04 Feb 2023 10:03:31 +0000https://blog.xpnsec.com/building-a-mach-o-memory-loader-part-1/In this blog we'll look at what it takes to construct an in-memory loader for Mach-O bundles within MacOS Ventura without using dyld. We'll walk though the lower-level details of what makes up a Mach-O file, how dyld processes load commands to map areas into memory, and how we can emulate this to avoid writing payloads to disk.https://blog.xpnsec.com/restoring-dyld-memory-loading/Sat, 14 Jan 2023 12:03:31 +0000https://blog.xpnsec.com/restoring-dyld-memory-loading/Up until recently, we've enjoyed in-memory loading of Mach-O bundles courtesy of dyld and its NSCreateObjectFileImageFromMemory/NSLinkModule API methods. And while these methods still exist today, there is a key difference.. memory modules are now persisted to disk. So in this post we'll take a look at just what was changed in dyld, and see what we can do to restore this functionality... hopefully keeping our warez in memory for a little longer.https://blog.xpnsec.com/wam-bam/Mon, 17 Oct 2022 17:40:29 +0000https://blog.xpnsec.com/wam-bam/This post looks at the recent trend of pulling Azure tokens from Office process memory and tries to identify just how these tokens were loaded, how Office handles a Microsoft Account (MSA), and how we can recover cached credentials from the Token Broker Cache.https://blog.xpnsec.com/unobfuscating-network-access-accounts/Sat, 09 Jul 2022 23:00:00 +0000https://blog.xpnsec.com/unobfuscating-network-access-accounts/In this post we'll explore just how SCCM uses its HTTP API to initialise a client, take a look at how Network Access Accounts are retrieved from SCCM, and see how we can decrypt these credentials without having to go anywhere near DPAPI.https://blog.xpnsec.com/gcioptions-in-a-virtualized-world/Sun, 15 May 2022 06:43:29 +0000https://blog.xpnsec.com/gcioptions-in-a-virtualized-world/With the leaking of code signing certificates and exploits for vulnerable drivers becoming common occurrences, adversaries are adopting the kernel as their new playground. And with Microsoft making technologies like Virtualization Based Security (VBS) and Hypervisor Code Integrity (HVCI) available, I wanted to take some time to understand just how vulnerable endpoints are when faced with an attacker set on escaping to Ring-0.https://blog.xpnsec.com/ntlmquic/Mon, 11 Apr 2022 03:00:00 +0000https://blog.xpnsec.com/ntlmquic/In this post, we'll dig into just how SMB over QUIC works, answer some of the immediate questions around which attacks are feasible, and show how we can repurpose some existing tooling to capture NTLM handshakes.https://blog.xpnsec.com/object-overloading/Tue, 15 Feb 2022 20:01:46 +0000https://blog.xpnsec.com/object-overloading/In this post we are going to look at one such technique that I thought was cool while playing around with the Windows Object Manager, and which should allow us to load an arbitrary DLL of our creation into a Windows process during initial execution, something that I've been calling "Object Overloading" for reasons which will hopefully become apparent in this post.https://blog.xpnsec.com/weird-ways-to-execute-dotnet/Wed, 05 May 2021 08:40:46 +0000https://blog.xpnsec.com/weird-ways-to-execute-dotnet/Recently I've been looking at the .NET CLR internals and wanted to understand what further techniques may be available for executing unmanaged code from the managed runtime. This post contains a snipped of some of the weird techniques that I found.https://blog.xpnsec.com/azure-application-proxy-c2/Sat, 24 Apr 2021 13:01:02 +0000https://blog.xpnsec.com/azure-application-proxy-c2/In this post, we are going to look at the Application Proxy protocol, how it works, and show how we can recreate enough functionality to allow us to create a custom inbound proxy into a client environment for our C2 traffic.https://blog.xpnsec.com/tailoring-cobalt-strike-on-target/Thu, 04 Feb 2021 14:16:07 +0000https://blog.xpnsec.com/tailoring-cobalt-strike-on-target/We've all been there, you've completed your initial recon, sent in your emails to gather those leaked HTTP headers, spent an age configuring your malleable profile to be just right, set up your CDNs and spun up your redirectors. Then it's time, you send in your email aaaaaand... nothing.https://blog.xpnsec.com/bring-your-own-vm-mac-edition/Mon, 28 Dec 2020 10:53:00 +0000https://blog.xpnsec.com/bring-your-own-vm-mac-edition/For a while I've wanted to explore the concept of leveraging a virtual machine on target during an engagement. The thought of having implant logic self-contained and running under a different OS to the base seems pretty interesting. But more so, I've been curious as to just how far traditional AV and EDR can go to detect malicious activity when running from a different virtual environment. While this is a nice idea, the issues with creating this type of malware are obvious, with increased comple...https://blog.xpnsec.com/the-net-export-portal/Tue, 24 Nov 2020 09:10:00 +0000https://blog.xpnsec.com/the-net-export-portal/While working on some tooling recently I revisited the topic of .NET unmanaged exports and wanted to know just why this works in the way that it does. After all, by now we've all seen the COM calls required to spin up the CLR, so what makes unmanaged exports so special?https://blog.xpnsec.com/we-need-to-talk-about-macl/Sun, 18 Oct 2020 16:24:00 +0000https://blog.xpnsec.com/we-need-to-talk-about-macl/If you've never heard of MACL on MacOS, you're not alone. This obscure feature is a hidden part of MacOS that underpins Apple's concept of User-Intent, a shift in focus for MacOS privacy controls in an attempt to stop endless prompts interrupting the user. And by now we all understand just how annoying these alerts can be to us attackers. Being able to operate on an endpoint without giving the game away is of course essential, and unfortunately staying under the radar on MacOS is getting toughehttps://blog.xpnsec.com/macos-injection-via-third-party-frameworks/Wed, 23 Sep 2020 00:05:59 +0000https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/In this post, we are going to take a look at a couple of interesting methods of leveraging third-party technologies to achieve our code injection goals. For us, this translates to running code in the context of a target application without having to resort to disabling SIP.https://blog.xpnsec.com/debugging-into-net/Mon, 10 Aug 2020 01:00:00 +0000https://blog.xpnsec.com/debugging-into-net/.NET for post-exploitation is here to stay. It has been bundled with most C2 frameworks, common tools have been ported, AMSI has been added (then bypassed) and new and clever ways have been found to launch unmanaged code. The process of loading a .NET assembly however appears to be pretty consistent. We know that tools like Cobalt Strike's execute-assembly have greatly increased the accessibility of loading a .NET assembly from memory, with most attackers using this in one way or another duringhttps://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/Sat, 06 Jun 2020 00:04:30 +0000https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/It turns out that there is a method of disabling ETW in .NET, strangely exposed by setting an environment variable of COMPlus_ETWEnabled=0. This post explores how this works.https://blog.xpnsec.com/designing-the-adversary-simulation-lab/Sat, 18 Apr 2020 13:31:06 +0000https://blog.xpnsec.com/designing-the-adversary-simulation-lab/In this post we will walk you through the technology used to create and deploy the ActiveBreach Adversary Simulation Lab, and look at the hurdles we jumped through to get things running smoothly.https://blog.xpnsec.com/hiding-your-dotnet-etw/Tue, 17 Mar 2020 23:57:20 +0000https://blog.xpnsec.com/hiding-your-dotnet-etw/In this post we will focus on Event Threading for Windows (ETW), how it is used to surface events on .NET assemblies, and how we can evade this kind of detection.https://blog.xpnsec.com/aws-lambda-redirector/Tue, 25 Feb 2020 12:09:00 +0000https://blog.xpnsec.com/aws-lambda-redirector/In this post we will be looking at AWS Lambda, how we can deploy code using the Serverless framework, and how we can use this technology as a redirector for Cobalt Strikehttps://blog.xpnsec.com/testing-redteam-infra/Tue, 28 Jan 2020 19:47:05 +0000https://blog.xpnsec.com/testing-redteam-infra/As RedTeaming has grown with the industry, so has our need to build dependable environments. In keeping with the cat-and-mouse game we find ourselves in, it's essential to possess the capability of maintaining robust infrastructure which can be recreated if discovered, and more importantly, we need to ensure that the environment is free of issues upon deployment. Today I'm kicking off the first of a series of posts where we will be adopting some of the practices made popular by the DevOps teamhttps://blog.xpnsec.com/macos-filename-homoglyphs-revisited/Tue, 10 Dec 2019 11:59:31 +0000https://blog.xpnsec.com/macos-filename-homoglyphs-revisited/Last year I posted a few tricks to help when targeting MacOS users, and included a technique useful for spoofing file extensions with the aim of taking advantage of Finder's removal of the .app extension from certain filenames.https://blog.xpnsec.com/protecting-your-malware/Mon, 04 Nov 2019 09:42:45 +0000https://blog.xpnsec.com/protecting-your-malware/In Cobalt Strike, blockdlls was introduced to allow protection of spawned processes from non-Microsoft signed DLL's. In this post I will show just how this works, and look at an additional process security option which could help us to deter endpoint security products.https://blog.xpnsec.com/bypassing-macos-privacy-controls/Mon, 23 Sep 2019 06:17:49 +0000https://blog.xpnsec.com/bypassing-macos-privacy-controls/Encountering Apple devices during RedTeam engagements is becoming increasingly common, so it's useful to have a few techniques available when navigating around whatever privacy or security changes are introduced with each version of MacOS. When MacOS Mojave rolled out at the end of 2018, a set of privacy restrictions were introduced to alert a user when an application requested access to sensitive data, such as the camera, microphone, address book, calendar etc.. And as (more often than not) ohttps://blog.xpnsec.com/inter-realm-key-roasting/Fri, 06 Sep 2019 11:06:35 +0000https://blog.xpnsec.com/inter-realm-key-roasting/In this blog post we will look at a somewhat familiar, but extremely limited window of opportunity which may come in handy when reviewing a fresh Active Directory forest deployment.https://blog.xpnsec.com/analysing-rpc-with-ghidra-neo4j/Thu, 01 Aug 2019 06:43:29 +0000https://blog.xpnsec.com/analysing-rpc-with-ghidra-neo4j/Hunting for new lateral movement techniques or interesting ways to execute code can be a nice way to sink some free time. With Windows spawning numerous RPC services on boot, finding unusual execution techniques is sometimes as simple as scratching just below the surface. And often the payoff far outweighs the time to discovery, with SOC or EDR vendors focusing on the more common published techniques, identifying a new way to introduce code execution on a host can throw a spanner in the works ofhttps://blog.xpnsec.com/evading-sysmon-dns-monitoring/Sat, 15 Jun 2019 22:48:05 +0000https://blog.xpnsec.com/evading-sysmon-dns-monitoring/In a recent update to Sysmon, a new feature was introduced allowing the ability to log DNS events. While this gives an excellent datapoint for defenders (shout out to the SysInternals team for continuing to provide and support these awesome tools for free), for us as attackers, this means that should our implant or payloads attempt to communicate via DNS, BlueTeam have a potential way to pick up on indicators which could lead to dehttps://blog.xpnsec.com/exploring-mimikatz-part-2/Fri, 07 Jun 2019 08:24:10 +0000https://blog.xpnsec.com/exploring-mimikatz-part-2/If you haven't had a chance to check it out, take a look here. Continuing on, in this post we will review what has become a nice way of subverting security controls added by Microsoft to prevent dumping of credentials, as well as extracting credentials as they are provided by a victim.https://blog.xpnsec.com/exploring-mimikatz-part-1/Fri, 10 May 2019 07:10:40 +0000https://blog.xpnsec.com/exploring-mimikatz-part-1/We’ve packed it, we’ve wrapped it, we’ve injected it and powershell’d it, and now we've settled on feeding it a memory dump, and still Mimikatz remains the tool of choice when extracting credentials from lsass on Windows systems. Of course this is due to the fact that with each new security control introduced by Microsoft, GentilKiwi always has a trick or two up his sleeve. If you have ever looked at the effort that goes into Mimikatz, this is no easy task, withhttps://blog.xpnsec.com/silencing-cylance-a-case-study-in-modern-edrs/Thu, 18 Apr 2019 23:21:06 +0000https://blog.xpnsec.com/silencing-cylance-a-case-study-in-modern-edrs/In this blog post we will explore some of our findings that might assist red teamers operating in environments where CylancePROTECT is in place and briefly touch on CylanceOPTICS, a complementary solution that provides rule based detection to the endpoint.https://blog.xpnsec.com/building-modifying-packing-devops/Mon, 11 Mar 2019 18:54:07 +0000https://blog.xpnsec.com/building-modifying-packing-devops/In this post I will be showing how to build a Azure DevOps pipeline for .NET projects, and hopefully show some techniques which I have found useful to modify build artifacts to make them a bit different, and in some cases, to increase the time it takes to analyse our tools if detected by Blue Team.https://blog.xpnsec.com/azuread-connect-for-redteam/Mon, 18 Feb 2019 08:50:46 +0000https://blog.xpnsec.com/azuread-connect-for-redteam/With clients increasingly relying on cloud services from Azure, one of the technologies that has been my radar for a while is Azure AD. For those who have not had the opportunity to work with this, the concept is simple, by extending authentication beyond on-prem Active Directory, users can authenticate with their AD credentials against Microsoft services such as Azure, Office365, Sharepoint, and hundreds of thirdhttps://blog.xpnsec.com/how-to-argue-like-cobalt-strike/Mon, 28 Jan 2019 08:11:44 +0000https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/In Cobalt Strike 3.13, the argue command was introduced as a way of taking advantage of argument spoofing. I was first made aware of the concept while watching Will Burgess's awesome talk RedTeaming in the EDR Age, with Will crediting Casey Smith who presented the idea during a series of tweets. As with anything introduced to Cobalt Strike which has the chance to improve operational security, I wanted to dig into the concept further to see just howhttps://blog.xpnsec.com/blockchainc2/Sat, 05 Jan 2019 17:00:06 +0000https://blog.xpnsec.com/blockchainc2/I’m not actually sure when the abstraction of Blockchain started or when it became such a marketing buzzword, but with so many things claiming to be “Powered by The Blockchain”, I wanted to dig into the technology to understand if there was any benefit to be had by an aggressor.https://blog.xpnsec.com/rundll32-your-dotnet/Mon, 05 Nov 2018 18:37:33 +0000https://blog.xpnsec.com/rundll32-your-dotnet/In this post I wanted to look at a technique which is by no means new to .NET developers, but may prove useful to redteamers crafting their tools... exporting .NET static methods within a DLL... AKA using RunDLL32 to launch your .NET assembly.https://blog.xpnsec.com/cisco-amp-bypassing-self-protection/Sat, 27 Oct 2018 21:48:34 +0000https://blog.xpnsec.com/cisco-amp-bypassing-self-protection/Sometimes when you are in the middle of an engagement, you will come across a hurdle which requires a quick bit of research, coding, and a little bit of luck. This was the case with a recent engagement in which we came across Cisco AMP, an endpoint protection technology which provides analysis of processes, provides spawn chains, and exposed a bunch of the other goodies you have come to expect from EDR products, including our old friend…. self-protection. We’ve explored self-protection thttps://blog.xpnsec.com/constrained-language-mode-bypass/Mon, 01 Oct 2018 09:56:18 +0000https://blog.xpnsec.com/constrained-language-mode-bypass/Constrained Language Mode is a method of restricting Powershell's access to functionality such as Add-Type, or many of the reflective methods which can be used to leverage the Powershell runtime as a launchbed for post-exploitation tooling. Despite what Microsoft may claim, this feature is very much being used as a security control, providing defenders with the ability to stop tools such as "Invoke-Mimikatz" from executing due to the heavy reliance on reflection techniques . As I was gettinghttps://blog.xpnsec.com/macos-phishing-tricks/Sat, 22 Sep 2018 11:56:29 +0000https://blog.xpnsec.com/macos-phishing-tricks/If you follow our research over on MDSec's blog, you will have seen a number of posts documenting macOS research we've recently completed. As RedTeamer's, we have a wealth of information available to us when it comes to attacking Windows endpoints, whether that be via a HTA, OLE, a macro office document or even simply binary hiding as a legitimate application, we are never short of options to gain access to a targets machine when phishing. The same unfortunatelyhttps://blog.xpnsec.com/disabling-macos-sip-via-a-virtualbox-kext-vulnerability/Mon, 20 Aug 2018 12:01:20 +0000https://blog.xpnsec.com/disabling-macos-sip-via-a-virtualbox-kext-vulnerability/As presented in our previous post exploring AV self-protection, the ability for an attacker to hide or protect software by leveraging protection features has become extremely interesting to me. With this in mind, I wanted to look at just how SIP bypasses were performed... enter VirtualBox.https://blog.xpnsec.com/macos-av-self-protection-methods/Tue, 14 Aug 2018 17:56:04 +0000https://blog.xpnsec.com/macos-av-self-protection-methods/In this post we will analyse BitDefender on MacOS, looking at some of the self-protection methods hooking MacOS. At the end of the post, we will have a bit of fun and show just how we can leverage this technology to hide our malware during an engagement.https://blog.xpnsec.com/escaping-the-sandbox-microsoft-office-on-macos/Wed, 08 Aug 2018 13:11:20 +0000https://blog.xpnsec.com/escaping-the-sandbox-microsoft-office-on-macos/You’ve completed your recon, and found that your target is using MacOS… what next? With the increased popularity of MacOS in the enterprise, we are often finding that having phishing payloads targeting only Microsoft Windows endpoints is not enough during a typical engagement. With this in mind, I wanted to find an effective method of landing a stager on a MacOS system during a phishing campaign. In this walkthrough, I will show one possible way we can go about gaining a foothold by leveraginghttps://blog.xpnsec.com/exploring-powershell-amsi-and-logging-evasion/Mon, 09 Jul 2018 00:19:41 +0000https://blog.xpnsec.com/exploring-powershell-amsi-and-logging-evasion/By now, many of us know that during an engagement, AMSI (Antimalware Scripting Interface) can be used to trip up PowerShell scripts in an operators arsenal. Attempt to IEX Invoke-Mimikatz without taking care of AMSI, and it could be game over for your undetected campaign.https://blog.xpnsec.com/total-meltdown-cve-2018-1038/Mon, 23 Apr 2018 06:16:32 +0000https://blog.xpnsec.com/total-meltdown-cve-2018-1038/This week I had some free time to look into CVE-2018-1038 aka Total Meltdown. The aim was to create a quick exploit which could be used to elevate privileges during an assessment. I ended up delving into Windows memory management more than I had before.https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/Mon, 09 Apr 2018 07:02:33 +0000https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/One of the many areas of this field that I really enjoy is the "cat and mouse" game played between RedTeam and BlueTeam, each forcing the other to up their game. Often we see some awesome tools being released to help defenders detect malware or shellcode execution, and knowing just how these defensive capabilities function is important when performing a successful pentest or RedTeam engagement. Recently I came across the awesome post "Defenders Think in Graphs Too!", which can be found over onhttps://blog.xpnsec.com/exploring-cobalt-strikes-externalc2-framework/Fri, 30 Mar 2018 10:24:58 +0000https://blog.xpnsec.com/exploring-cobalt-strikes-externalc2-framework/As many testers will know, achieving C2 communication can sometimes be a pain. Whether because of egress firewall rules or process restrictions, the simple days of reverse shells and reverse HTTP C2 channels are quickly coming to an end. OK, maybe I exaggerated that a bit, but it's certainly becoming harder. So, I wanted to look at some alternate routes to achieve C2 communication and with this, I came across Cobalt Strike’s ExternalC2 framework. ExternalC2 ExternalC2 is a specification/framewhttps://blog.xpnsec.com/cve-2018-4878/Thu, 15 Feb 2018 19:16:50 +0000https://blog.xpnsec.com/cve-2018-4878/Recently I joined the MDSec team after seeing many of the cool things that they had contributed to the community, and to hopefully pick up some of their awesome skills. Shortly after joining I was pointed to a small research project, CVE-2018-4878, a Flash vulnerability classified as a "Use-After-Free". This vulnerability was being exploited in the wild, however due to the way in which the malware was encrypted, it was not possible to recover a live sample of the exploit. Basing research on sohttps://blog.xpnsec.com/evernote-webclipper-uxss/Thu, 18 Jan 2018 08:58:52 +0000https://blog.xpnsec.com/evernote-webclipper-uxss/During an evening of bug hunting, I found a cool issue in Evernote's WebClipper tool. The result was a Universal XSS vulnerability, which we will explore in this post.https://blog.xpnsec.com/hevd-null-pointer/Mon, 15 Jan 2018 07:00:00 +0000https://blog.xpnsec.com/hevd-null-pointer/In this post, we will continue to explore driver exploitation, focusing on NULL pointer dereferences, and demonstrating how we can exploit this class of vulnerability on both Windows 7 x64 and Windows 10 x32.https://blog.xpnsec.com/hevd-stack-overflow/Tue, 02 Jan 2018 12:40:32 +0000https://blog.xpnsec.com/hevd-stack-overflow/Following on from my earlier post in which we walked through creating an exploit for the WARBIRD vulnerability, over the next few posts I'm going to be looking at Windows kernel exploitation. If you haven't had chance to read it, I'd recommend that you pause and give it a quick glance as some of this walkthrough will rely on concepts introduced previously. This post will start off by laying the groundwork for future posts, and walking through a simple stack overflowhttps://blog.xpnsec.com/anti-debug-openprocess/Wed, 13 Dec 2017 12:27:08 +0000https://blog.xpnsec.com/anti-debug-openprocess/This week I took a break from SYSTEM chasing to review some anti-debugging techniques. With quite a few Bug Bounty programs available relying on client-side applications, I thought I'd share one of the techniques used by numerous security products (and apparently game anti-cheat engines) to stop you from debugging core components, and just how we can go about bypassing this. Obviously it goes without saying, but the technique shown in this post is not a vulnerability, if an attacker has this lehttps://blog.xpnsec.com/windows-warbird-privesc/Mon, 27 Nov 2017 13:02:00 +0000https://blog.xpnsec.com/windows-warbird-privesc/In this post I wanted to take a look at something which I touched on previously, and that is just how a Windows kernel based exploit achieves privilege escalation. Rather than take something like HackSys Extreme Vulnerable Windows Driver, I wanted to work on something a little bit differenthttps://blog.xpnsec.com/becoming-system/Mon, 20 Nov 2017 11:02:26 +0000https://blog.xpnsec.com/becoming-system/For many pentesters, Meterpreter's getsystem command has become the default method of gaining SYSTEM account privileges, but have you ever have wondered just how this works behind the scenes? In this post I will show the details of how this technique works, and explore a couple of methods which are not quite as popular, but may help evade detection on those tricky redteam engagements. Meterpreter's "getsystem" Most of you will have used the getsystem module in Meterpreter before. For those thahttps://blog.xpnsec.com/kerberos-attacks-part-2/Wed, 08 Nov 2017 12:30:00 +0000https://blog.xpnsec.com/kerberos-attacks-part-2/In this post we will be exploring another "roasting" method which involves exploiting a weak account configuration setting in Active Directory.. AS-REP Roasting.https://blog.xpnsec.com/defcon-25/Sat, 04 Nov 2017 08:00:00 +0000https://blog.xpnsec.com/defcon-25/This year I attended Defcon for the second time. I live in the UK, so making it out to the US for this awesome conference is something that I look forward to throughout the year. As part of my day job I'm a penetration tester, and I actually found myself in Santa Clara the week before Defcon on an assessment. Due to some unique circumstances, I took what I think must be a record breaking detour back to Defcon. After checking out the local famous garages and technology spots, I was on a flight bhttps://blog.xpnsec.com/setting-service-principal-names-to-roast-accounts/Sat, 04 Nov 2017 01:38:53 +0000https://blog.xpnsec.com/setting-service-principal-names-to-roast-accounts/As a continuation of our previous post, we wanted to discuss another technique that can help during an red team engagement where the intention is to usually stay under the radar when compromising high value accounts.https://blog.xpnsec.com/using-machine-accounts-during-an-engagement/Mon, 30 Oct 2017 11:53:50 +0000https://blog.xpnsec.com/using-machine-accounts-during-an-engagement/Of the many advancements in red teaming over the last 12 months, the development of BloodHound has provided a monumental step forward and is quickly becoming an essential tool in the arsenal of an attacker.https://blog.xpnsec.com/kerberos-attacks-part-1/Sat, 30 Sep 2017 22:28:08 +0000https://blog.xpnsec.com/kerberos-attacks-part-1/Recently I've been trying to make sure that my redteam knowledge is up to date, exploring many of the advancements in Active Directory Kerberos attacks... and there have been quite a few! I finally found some free time this week to roll up my sleeves and dig into the internals of some of these attacks, and hopefully document them for other people to learn. This post is the first in a series aimed at explaining what is happening under the hood when you execute your favourite Powerview or Mimikathttps://blog.xpnsec.com/explodingcan-a-vulnerability-review/Mon, 18 Sep 2017 14:16:57 +0000https://blog.xpnsec.com/explodingcan-a-vulnerability-review/A few months ago, my colleagues over at Secarma released a review of ExplodingCan, one of the many exploits released as part of the ShadowBrokers dump. At the time I was asked to complete a review of the vulnerability, specifically how this affected a vulnerable server and if anything could be done to protect users.https://blog.xpnsec.com/apt28-hospitality-malware-part-2/Sun, 13 Aug 2017 20:19:00 +0000https://blog.xpnsec.com/apt28-hospitality-malware-part-2/In the first part of this malware review, we looked at the VBA code used by APT28 to drop a DLL onto the victims' machine as part of their recently highlighted hospitality campaign. In this post, we will look at the dropped file, and understand just what it does, and how we can analyse it using IDA Pro. So we know from the first post that we have a DLL, which ishttps://blog.xpnsec.com/apt28-hospitality-malware/Sat, 12 Aug 2017 14:48:55 +0000https://blog.xpnsec.com/apt28-hospitality-malware/This week, FireEye published a writeup of yet another APT28 campaign, this time targeting the hospitality sector. I'm always interested to see the latest APT group techniques, so I decided to review the malware to see how the dropper workedhttps://blog.xpnsec.com/how-github-login-detection-works/Fri, 11 Aug 2017 16:11:08 +0000https://blog.xpnsec.com/how-github-login-detection-works/Sometimes I come across things non-security related that intrigue me, albeit mostly I'm thinking how I can use it to exploit a service, but still... One such piece of functionality caught my interest, a banner displayed at the top of GitHub. I was thinking of the different ways that this type of functionality could be achieved. We have seen similar methods of detection exploited in the past to leak out information, although much more targeted at cross-origin detection (such as Social Media Fhttps://blog.xpnsec.com/industroyer-c2-protocol/Tue, 04 Jul 2017 20:22:30 +0000https://blog.xpnsec.com/industroyer-c2-protocol/As part of my day job, I work for Secarma (previously known as Pentest Limited) as a Senior Penetration Tester. During engagements, the question of malware threats is increasingly raised, in part due to media focus on APT groups such as APT28, and malware campaigns such as WannaCry. While looking into another malware variant recently uncovered by ESET, Industroyer, I started reviewing the protocol used to communicate with the backdoor component of the malware. Details of the research have beehttps://blog.xpnsec.com/hopper-scripting-macransom/Thu, 15 Jun 2017 22:18:17 +0000https://blog.xpnsec.com/hopper-scripting-macransom/This week, Objective-See published a walkthrough of the recently released "Malware as a Service" family, MacRansom, originally identified by FortiNet. Patrick from Objective-See does a brilliant fly-by of the malware using LLDB, and presents some nice "anti anti-analysis" tricks. If you are interested in the internals of the malware, I'd recommend that you take ahttps://blog.xpnsec.com/apt32-phishing-malware/Sat, 20 May 2017 21:50:16 +0000https://blog.xpnsec.com/apt32-phishing-malware/This week, FireEye released an awesome review into APT32 (aka OceanLotus). The full writeup of their analysis can be found on FireEye's site here, and is certainly worth a read if you are interested in the evolving world of APT and attribution. One of the things I found interesting about this group was their use of "off the shelf" open source tools and techniques, often associated with commercial red-team engagemhttps://blog.xpnsec.com/pwndbg/Tue, 02 May 2017 08:28:16 +0000https://blog.xpnsec.com/pwndbg/This bank holiday weekend I spent a bit of time updating my docker containers (I know, rock-n-roll!). One of the tools I've been hearing good things about is pwndbg, an open source plugin for GDB which aims to help with exploit development. I've always been a fan of peda, which provides similar functionality, but seeing the integration that pwndbg had with radare2, I couldn't help but give it a shot. To install the tool, I used the provided installation instructionshttps://blog.xpnsec.com/revisiting-plaidctf-bigpicture/Tue, 25 Apr 2017 23:40:29 +0000https://blog.xpnsec.com/revisiting-plaidctf-bigpicture/During the PlaidCTF challenge, there were a couple of binaries which, whilst I had a general idea of how the vulnerability worked, I couldn't complete in time to grab a flag. This has been bugging me since the end of the CTF, so I wanted to revisit one such challenge and see what I was missing. That challenge was "bigpicture". To begin with, you are given a simple descriptionhttps://blog.xpnsec.com/plaidctf-no_mo_flo-writeup/Mon, 24 Apr 2017 23:19:53 +0000https://blog.xpnsec.com/plaidctf-no_mo_flo-writeup/This weekend I joined team NeverTry on PlaidCTF. One of the interesting challenges that I attempted was the "no_mo_flo" reverse engineering exercise. The description provided was simple... Can you go with the flow? To begin with, we load the challenge in IDA Pro. After some parsing, we see the first step is to read 0x20 bytes from STDINhttps://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/Wed, 19 Apr 2017 09:27:50 +0000https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/If there is one thing I've come to appreciate over this past few weeks, it's just how much support you are provided from the Win32 API. That being said, I wanted to tackle some Linux process injection, with the aim of loading a shared object into another process address space without having to resort to LD_PRELOAD, or stopping the process. The goal I set myself was quite simple, could I recover plain text credentials from the sshd process using ptrace. Granted, this is a bit of an arbitrary goahttps://blog.xpnsec.com/blog-tech/Thu, 06 Apr 2017 13:58:17 +0000https://blog.xpnsec.com/blog-tech/As you may have noticed, I've migrated my blog from Tumblr to a shiny Ghost powered engine. While it does feel like I'm leaving the social media buzzword bingo revolution behind, editing on Tumblr wasn't exactly made with lengthy InfoSec posts in mind. Of course, moving to Ghost in my case means provisioning and managing a new server, so I wanted to take some time to document the architecture of my solution incase anyone else is looking to make a similar change in the future. Hosting My hostihttps://blog.xpnsec.com/bsidessf-dnscap/Mon, 06 Mar 2017 01:24:18 +0000https://blog.xpnsec.com/bsidessf-dnscap/Of all the BSidesSF CTF challenges, I think this one has to be my favourite. Combining a mix of packet capture analysis, scripting, frustration, and trying to beat the clock. The brief provided by the challenge was quite straight forwardhttps://blog.xpnsec.com/bsidessf-sensors/Sun, 05 Mar 2017 19:06:50 +0000https://blog.xpnsec.com/bsidessf-sensors/Continuing my write-up series from BSides SF's CTF, today I'll be looking at a "pwn" challenge, Steel Mountain - Sensors. The challenge starts with a link, and a cryptic commenthttps://blog.xpnsec.com/bsidessf-b-64-b-tuff/Sun, 05 Mar 2017 19:06:13 +0000https://blog.xpnsec.com/bsidessf-b-64-b-tuff/This week I was part of team "NeverTry" who competed in the BSidesSF online capture the flag. As far as CTF's go, this was a fun one, taking place over 2 days there were a range of cool puzzles and flags to find. Over a series of upcoming posts I'll be running through the solutions for a number of my favourite challenges, starting with b-64-b-tuff. This challenge started with a simple application which receives binary shellcode over the network, and executes thhttps://blog.xpnsec.com/rop-primer-level-2/Sun, 05 Mar 2017 19:05:32 +0000https://blog.xpnsec.com/rop-primer-level-2/In the final post in this series, we'll be looking at Level 2, the last level of ROP Primer from VulnHub. This level gives a very simple program, similar to the first challenge that we faced in Level 0. The source of the application is as followshttps://blog.xpnsec.com/rop-primer-level-1/Sun, 05 Mar 2017 19:04:58 +0000https://blog.xpnsec.com/rop-primer-level-1/Continuing from the previous post which shows a solution for Level 0, we are going to look at Level 1 of ROP Primer from VulnHub. Level 1 is a server application, which suffers from a typical buffer overflow. Reviewing the application source provided by the challenge, we can see that the overflow vector is within the following codehttps://blog.xpnsec.com/rop-primer-level-0/Sun, 05 Mar 2017 19:04:20 +0000https://blog.xpnsec.com/rop-primer-level-0/I recently found Vulnhub ROP Primer, which is a brilliant playground for refreshing your Linux ROP skills. To try and share some of the techniques I used to solve these challenges, I'm completing a series of writeups detailing the steps to solve each level. In typical Vulnhub style we start with a virtual machine which runs a number of services alongside a HTTP server documenting the 3 levels of difficulty. This post will be looking at Level 0https://blog.xpnsec.com/radare2-using-emulation-to-unpack-metasploit-encoders/Sun, 05 Mar 2017 19:03:31 +0000https://blog.xpnsec.com/radare2-using-emulation-to-unpack-metasploit-encoders/Radare2 is an open source reverse engineering framework, and is quickly becoming one of my favourite tools when picking apart malware or looking at CTF binaries. I was recently introduced to Radare’s ESIL (Evaluable Strings Intermediate Language), which is a way of representing instructions in a forth like language, and allows emulation of machine instructions in Radare’s ESIL VM. To help understand this functionality, lets look at some examples from the radare2 bookhttps://blog.xpnsec.com/windows-server-2016-docker-privilege-escalation/Sun, 05 Mar 2017 19:02:16 +0000https://blog.xpnsec.com/windows-server-2016-docker-privilege-escalation/After catching Microsoft's talk at DockerCon discussing the recent addition of Docker container support in Windows Server 2016, I wanted to play around with the technology with the aim of understanding how this could be leveraged during a security assessment. Before starting, I first had to configure Windows Server to support Docker containers. This was pretty painless using the following stepshttps://blog.xpnsec.com/kentico-cms-9-0-42-sqli/Sun, 05 Mar 2017 19:01:10 +0000https://blog.xpnsec.com/kentico-cms-9-0-42-sqli/Kentico CMS is a web content management system for building websites, e-commerce stores and numerous other web applications in ASP.NET. During a review of the CMS in a lab environment, I came across a SQL injection vulnerability which was interesting due to the complicated regex check which is used to try and prevent this kind of exploit. Kentico CMS supports the ability for users to query a website via a REST based API. Whilst varying levels of authorisation are used to restrict access, a numhttps://blog.xpnsec.com/offensive-forensics/Sun, 05 Mar 2017 18:57:26 +0000https://blog.xpnsec.com/offensive-forensics/At the moment, I've been looking at post exploitation methods, weather that is gaining persistance, extracting hashes, or finding additional pivot points. One area that I'm quickly becoming interested in is applying basic forensics techniques to help recover data during an assessment. One framework that can help with this, is PowerForensics. This framework comes with a number of interesting options, but the one which is useful for recovered deletedhttps://blog.xpnsec.com/github-desktop-dom-xss/Sun, 05 Mar 2017 18:56:43 +0000https://blog.xpnsec.com/github-desktop-dom-xss/I’ve always enjoyed “unusual” vulnerabilities, either bugs that you never knew were exploitable, or just funny quirks which lead to a vulnerability. My recent finding within the Github Desktop for OSX ticked a few of those boxes, allowing me to trigger cross-site scripting in a desktop application. The vulnerability is present due to the use of the Chromium Embedded Framework, which is used by the comparison graph you see at the top of the windohttps://blog.xpnsec.com/extracting-master-mdf-hashes/Sun, 05 Mar 2017 18:54:23 +0000https://blog.xpnsec.com/extracting-master-mdf-hashes/During a number of engagements, I have found myself in a position in which I have held administrative access to a server running a local instance of Microsoft SQL Server, but had not held credentials to access the service. For seasoned penetration testers out there, you will know that there are multiple ways to gain access to a SQL Server once you have access to the local server, for example running SQLQuery as the SYSTEM user which often runs under the SysAdmin permission, or injecting into thhttps://blog.xpnsec.com/cve-2016-3955/Sun, 05 Mar 2017 18:53:41 +0000https://blog.xpnsec.com/cve-2016-3955/Recently I was forwarded a link to a patch within the Linux kernel which mitigates an overflow vulnerability within the USBIP functionality. For those that have never encountered USBIP, this is a protocol offered to allow remote clients to access USB devices plugged into a host machine. Reviewing the patch, the issue was immediately visible as being a heap overflow vulnerability, exploitable due to a user controlled size value being trusted without validation. So first let's look at the patchhttps://blog.xpnsec.com/github-desktop-rce/Sun, 05 Mar 2017 18:45:14 +0000https://blog.xpnsec.com/github-desktop-rce/Recently GitHub disclosed a vulnerability which I reported within the GitHub for Windows client. This report can be found here. The aim of this post is to give a quick rundown of how the issue was discovered, and to introduce this type of vulnerability for those that may not have seen it before. The GitHub for Windows client provides users with an easy way to manage their GitHub repo’s, from pushing to GitHub for the first time, to creating pullhttps://blog.xpnsec.com/bettercap-capturing-ntlm/Sun, 05 Mar 2017 18:44:22 +0000https://blog.xpnsec.com/bettercap-capturing-ntlm/As many of you who follow me on twitter will know, I'm a big fan of the Bettercap project. Created by @EvilSocket, this tool is a reimagining of the historic Ettercap project, bringing it up to date, it's an invaluable tool for the penetration testing arsenal. One of the many modules offered by the project is the HTTP Proxy module, which allows a man-in-the-middle to transparently proxy and modify HTTP traffic being returned to a user. While the possibilities arhttps://blog.xpnsec.com/xbox-one-controller/Sun, 05 Mar 2017 18:42:57 +0000https://blog.xpnsec.com/xbox-one-controller/So today I had a bit of free time, and decided to experiment with the LibUSB framework on a Raspberry Pi I had lying around. After a bit of reading, and reviewing the excellent documentation provided by the Xbox hacking community, I managed to get a simple C program running which demoed interrupt transfers for both activating the controller rumble feature, and receiving button presses. For those interested, the code for the demo application can be found herehttps://blog.xpnsec.com/sql-server-auth-mitm/Sun, 05 Mar 2017 18:38:27 +0000https://blog.xpnsec.com/sql-server-auth-mitm/While exploring the depths of Metasploit capture modules, I came across auxiliary/server/capture/mssql which can be found here. The module can be used to capture Microsoft SQL Server logon credentials if a user or client authenticates with the module. What caught my attention is just how effective this module can be in retrieving plain text credentials. First a bit of background on SQL server authentication. Usually authenticathttps://blog.xpnsec.com/cve-2015-8560/Sun, 05 Mar 2017 18:34:49 +0000https://blog.xpnsec.com/cve-2015-8560/Just a quick writeup today, recently I uncovered an issue in the Foomatic-RIP package. The bug can be found within the "filter/foomatic-rip/util.c" source and is due to the whitelist used within the following linehttps://blog.xpnsec.com/ms15-099/Sun, 05 Mar 2017 18:30:00 +0000https://blog.xpnsec.com/ms15-099/Recently during a review of Sharepoint, I came across a vulnerability discovered by the Fortinet team and published on their blog. The post contained information on what a successful exploit would look like, but provided no final exploit for verification or testing. After a bit of review, I found the following POC code which, when triggered, shows a simple alert dialog boxhttps://blog.xpnsec.com/from-csv-to-meterpreter/Thu, 05 Nov 2015 18:20:00 +0000https://blog.xpnsec.com/from-csv-to-meterpreter/As many of you have probably seen, last year Context published research into spreadsheet applications such as Excel which render CSV files (and their embedded formula) when opened. If you haven't, I suggest stopping and reading http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/ Many web applications provide a user with an option to export data to a CSV file format, and when the data can be influenced by an attacker (registration names, analytics etc), you are facing a pothttps://blog.xpnsec.com/about/Mon, 01 Jan 0001 00:00:00 +0000https://blog.xpnsec.com/about/