Jeffrey Bencteux

A review of Serious Cryptography: A Practical Introduction to Modern Encryption (1st edition) by JP Aumasson

Introduction The Linux kernel audit subsystem is a security mechanism allowing one to detect potential threats on a Linux system.

Understanding windows sheningans of local accounts network logons.

A course and exam review of Hack The Box CDSA

A corner-case of how to perform Configuration Manager credential harvesting, extracting NAA and various other secret policies.

The passprompt plugin in PPP project do not loose privileges permanently, leading to a potential privilege escalation under specific conditions.

Yet another auditd ruleset

Unchecked return value can allow Apache Traffic Server to retain privileges on startup.

Dropping privileges is a common operation done by programs having setUID and/or setGID bits set.

GNU inetutils do not check return values of set*id() family functions, leading to potential privilege escalations in binaries such as ftpd or rcpd.

Process injection, hollowing and stealth on Linux operating system

Explaining and bypassing some Windows explorer restrictions.

GNU inetutils do not check return values of set*id() family functions, leading to potential privilege escalations in binaries such as ftpd or rcpd.

If set*id() syscalls' return values are not checked, it can cause security issues such as privilege escalation.

Netkit-rcp is vulnerable to a command injection in filenames used as copy arguments.

Malwarebytes' software for firewall management let unprivileged users perform administrative firewall actions without access controls allowing for local network rules bypass.

TL;DR; Images hosted by websites contains numerous metadata fields depending on their filetype (JPG, PNG…).

From subdomain takeover to phishing mails TL;DR; if you have a subdomain takeover for a given domain, and default DMARC alignment settings, you can create emails that passes SPF and DMARC for phishing purposes.

Book by David Okeyode

Detecting network scans When we speak about detection, you can often hear “let’s detect attackers' scans”.

In order to find phishing payloads, one needs to understand how executable filetypes on Windows are handled, finding which ones can be delivered to mail clients, thus users, without being caught by mail defences in between and without requesting multiple…

the doskey command can be used to evade some command-line detection rules by hidding the executable name behind an alias.

Context The recent release of the Red Team OPS II course by Zero-point Security caught my attention on Twitter in August.

Context Since I took the eLearnSecurity Certified Incident Responder (eCIR) a good while ago and that according to eLearn, the Certified Threat Hunting Professional (eCTHPv2) is the next stepping stone, I decided to give it a go.

Book by David Okeyode & Karl Fosaaen

I recently found two bugs in cifs-utils, the userland tools of SMB implementation in Linux, which led to the release of version 6.15.

Context I recently took Zero-point Security’s Red Team Ops) course and associated exam (CRTO).

While doing a CTF box, I escalated privileges using an unintended path that led to the below discoveries.

Context After a few months away from ElearnSecurity certifications, mostly due to OSCP preparation, I decided to take the second web course and certification they offer: Web Application Penetration Tester eXtreme (eWPTXv2).

I recently found two vulnerabilities in SonicWall’s Mobile Access (SMA) web interface.

What is PHP’s open_basedir?

Context After a real good experience with ElearnSecurity content, I decided to enroll for the eLearnSecurity Certified Incident Responder (eCIR) certification course.

Context I passed eLearnSecurity eJPT’s certification a couple of months ago and decided to take some more certifications from this company, in accordance with that, my employer paid me a yearly subscription to their learning plateform INE.

Context A few months ago, I decided to change job to focus more on pentesting and offensive activities while I never done it before.

Context Studying about Content Security Policy (CSP) features, I came across a nice bypass of Chrome’s URL restrictions that the browser implements to prevent leak of HTML data.

Italy is not known for information security and finding a job in this area, or any other really, in this country is not as easy as it seems.

Forensic, MacOS & Volatility I recently came to investigate on a MacOS memory dump and raw disk.

Rubrique-à-brac The name of this blog is a wink to Gotlib, a great comics writer and illustrator. whoami /id: Jeffrey Bencteux /alias: highlander/h1ghl4nd3r - “There can be only one” - good movie /interests: programming, network engineering, information s…

Disclaimer All of this material is my intellectual property but you can reuse it for your own purposes as long as you quote me and/or link to this website.