XPN Infosec Blog

I’m not actually sure when the abstraction of Blockchain started or when it became such a marketing buzzword, but with so many things claiming to be “Powered by The Blockchain”, I wanted to dig into the technology to understand if there was any benefit to…

In this post I wanted to look at a technique which is by no means new to .NET developers, but may prove useful to redteamers crafting their tools... exporting .NET static methods within a DLL...

Sometimes when you are in the middle of an engagement, you will come across a hurdle which requires a quick bit of research, coding, and a little bit of luck.

Constrained Language Mode is a method of restricting Powershell's access to functionality such as Add-Type, or many of the reflective methods which can be used to leverage the Powershell runtime as a launchbed for post-exploitation tooling.

If you follow our research over on MDSec's blog, you will have seen a number of posts documenting macOS research we've recently completed.

As presented in our previous post exploring AV self-protection, the ability for an attacker to hide or protect software by leveraging protection features has become extremely interesting to me.

In this post we will analyse BitDefender on MacOS, looking at some of the self-protection methods hooking MacOS.

You’ve completed your recon, and found that your target is using MacOS… what next?

By now, many of us know that during an engagement, AMSI (Antimalware Scripting Interface) can be used to trip up PowerShell scripts in an operators arsenal.

This week I had some free time to look into CVE-2018-1038 aka Total Meltdown.

One of the many areas of this field that I really enjoy is the "cat and mouse" game played between RedTeam and BlueTeam, each forcing the other to up their game.

As many testers will know, achieving C2 communication can sometimes be a pain.

Recently I joined the MDSec team after seeing many of the cool things that they had contributed to the community, and to hopefully pick up some of their awesome skills.

During an evening of bug hunting, I found a cool issue in Evernote's WebClipper tool.

In this post, we will continue to explore driver exploitation, focusing on NULL pointer dereferences, and demonstrating how we can exploit this class of vulnerability on both Windows 7 x64 and Windows 10 x32.

Following on from my earlier post in which we walked through creating an exploit for the WARBIRD vulnerability, over the next few posts I'm going to be looking at Windows kernel exploitation.

This week I took a break from SYSTEM chasing to review some anti-debugging techniques.

In this post I wanted to take a look at something which I touched on previously, and that is just how a Windows kernel based exploit achieves privilege escalation.

For many pentesters, Meterpreter's getsystem command has become the default method of gaining SYSTEM account privileges, but have you ever have wondered just how this works behind the scenes?

In this post we will be exploring another "roasting" method which involves exploiting a weak account configuration setting in Active Directory..

This year I attended Defcon for the second time.

As a continuation of our previous post, we wanted to discuss another technique that can help during an red team engagement where the intention is to usually stay under the radar when compromising high value accounts.

Of the many advancements in red teaming over the last 12 months, the development of BloodHound has provided a monumental step forward and is quickly becoming an essential tool in the arsenal of an attacker.

Recently I've been trying to make sure that my redteam knowledge is up to date, exploring many of the advancements in Active Directory Kerberos attacks... and there have been quite a few!

A few months ago, my colleagues over at Secarma released a review of ExplodingCan, one of the many exploits released as part of the ShadowBrokers dump.

In the first part of this malware review, we looked at the VBA code used by APT28 to drop a DLL onto the victims' machine as part of their recently highlighted hospitality campaign.

This week, FireEye published a writeup of yet another APT28 campaign, this time targeting the hospitality sector.

Sometimes I come across things non-security related that intrigue me, albeit mostly I'm thinking how I can use it to exploit a service, but still...

As part of my day job, I work for Secarma (previously known as Pentest Limited) as a Senior Penetration Tester.

This week, Objective-See published a walkthrough of the recently released "Malware as a Service" family, MacRansom, originally identified by FortiNet.

This week, FireEye released an awesome review into APT32 (aka OceanLotus).

This bank holiday weekend I spent a bit of time updating my docker containers (I know, rock-n-roll!).

During the PlaidCTF challenge, there were a couple of binaries which, whilst I had a general idea of how the vulnerability worked, I couldn't complete in time to grab a flag.

This weekend I joined team NeverTry on PlaidCTF.

If there is one thing I've come to appreciate over this past few weeks, it's just how much support you are provided from the Win32 API.

As you may have noticed, I've migrated my blog from Tumblr to a shiny Ghost powered engine.

Of all the BSidesSF CTF challenges, I think this one has to be my favourite.

Continuing my write-up series from BSides SF's CTF, today I'll be looking at a "pwn" challenge, Steel Mountain - Sensors.

This week I was part of team "NeverTry" who competed in the BSidesSF online capture the flag.

In the final post in this series, we'll be looking at Level 2, the last level of ROP Primer from VulnHub.

Continuing from the previous post which shows a solution for Level 0, we are going to look at Level 1 of ROP Primer from VulnHub.

I recently found Vulnhub ROP Primer, which is a brilliant playground for refreshing your Linux ROP skills.

Radare2 is an open source reverse engineering framework, and is quickly becoming one of my favourite tools when picking apart malware or looking at CTF binaries.

After catching Microsoft's talk at DockerCon discussing the recent addition of Docker container support in Windows Server 2016, I wanted to play around with the technology with the aim of understanding how this could be leveraged during a security assessm…

Kentico CMS is a web content management system for building websites, e-commerce stores and numerous other web applications in ASP.NET.

At the moment, I've been looking at post exploitation methods, weather that is gaining persistance, extracting hashes, or finding additional pivot points.

I’ve always enjoyed “unusual” vulnerabilities, either bugs that you never knew were exploitable, or just funny quirks which lead to a vulnerability.

During a number of engagements, I have found myself in a position in which I have held administrative access to a server running a local instance of Microsoft SQL Server, but had not held credentials to access the service.

Recently I was forwarded a link to a patch within the Linux kernel which mitigates an overflow vulnerability within the USBIP functionality.

Recently GitHub disclosed a vulnerability which I reported within the GitHub for Windows client.