DerbyCon 2018 CTF Write Up

/0 Comments/in /by

We have just returned from the always amazing DerbyCon 2018 conference. We competed in the 48 hour Capture the Flag competition under our usual team name of “Spicy Weasel” and are pleased to announce that, for the second year in a row, we finished in first place out of 175 teams and netted another black […]

Read more →

CVE-2018-5240: Symantec Management Agent (Altiris) Privilege Escalation

/0 Comments/in /by

During a recent red team exercise, we discovered a vulnerability within the latest versions of the Symantec Management Agent (Altiris), that allowed us to escalate our privileges. Overview When the Altiris agent performs an inventory scan, e.g. software inventory scan, the SYSTEM level service re-applies the permissions on both the NSI and Outbox folders after […]

Read more →

CVE-2018-12897: Solarwinds Dameware Mini Remote Control Local SEH Buffer Overflow

/0 Comments/in /by

Dameware Mini Remote Control (MRC) is a remote administration utility allowing remote access to end user devices for a variety of purposes. You can often find it among the plethora of toolkits used by system administrators managing the IT infrastructure in organisations. Having recently completed my OSCE and looking to use some of the skills […]

Read more →

Introducing Scrounger – iOS and Android mobile application penetration testing framework

/0 Comments/in /by

Scrounger is a modular tool designed to perform the routine tasks required during a mobile application security assessment.  Scrounger conveniently brings together both major mobile operating systems – Android and iOS – into a single tool, in a way that is easy use, well documented, and easily extensible. Where it differs Scrounger consists on a […]

Read more →

Extending C2 Lateral Movement – Invoke-Pbind

/0 Comments/in , /by

Invoke-Pbind is a mini post exploitation framework written in PowerShell, which builds C2 communications over SMB named pipes using a push rather than a pull mechanism. Pbind was initially created to overcome lateral movement problems, specifically in restricted environments where the server VLAN could not directly talk to the user VLAN (as it should be […]

Read more →

Using PoolTags to Fingerprint Hosts

/0 Comments/in /by

Commonly, malware will fingerprint the host it executes on, in an attempt to discover more about its environment and act accordingly. Part of this process is quite often dedicated to analyzing specific data in order to figure out if the malware is running inside a VM, which could just be a honeypot or an analysis […]

Read more →