The DMZ

forest

3:18 AM

I don't know anything at all about Samba but I can try.

Journeyman Geek

3:54 AM

@J.J went to see a psycologist or psychiatrist, had CBT...

Anonymous

8:49 AM

@JourneymanGeek Oh, I see.

Anonymous

@forest Ah, are you here now or did I miss you? :O

forest

I'm here.

Anonymous

So, I'm looking at CVE-2007-2447.

Anonymous

I understand this was caused by essentially unsanitized user input, I'm just struggling to understand what the "username map script" configuration option actually does.

Anonymous

I did a quick Google & searched here on the site but I couldn't find anything, unless I'm just f*cking blind.

forest

8:57 AM

That must be a Samba-specific term.

Anonymous

I believe so, yes.

Anonymous

This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands.

Anonymous

I'm trying to basically write a blog post and my own code for each vulnerability I come across on boot2root boxes in preparation for my OSCP because simply just Metasploiting all of them teaches me nothing.

Anonymous

But with this one I'm having a hard time finding any in-depth detail on it.

forest

Run the program in a debugger while you exploit it with Metasploit?

Anonymous

8:59 AM

Hmm, that might be a good idea.

forest

That way you can set a breakpoint wherever the bug is triggered.

Anonymous

Considering Samba is open-source (I think) I'm a little surprised there isn't much detail on the Internet regarding this CVE.

forest

There's often not much detail on any given vuln. Only a few particularly interesting ones get published with a lot of detail.

The problem is that people who discover it just send it to MITRE and are like "OK I'm done I'll go do something else now", everyone upgrades or gets pwnt. The end.

Anonymous

Heh, that's annoying.

forest

No one ends up doing any kind of detailed analysis.

Anonymous

9:01 AM

I wish people did :(

Anonymous

I'm over here trying to learn, that makes it pretty difficult.

forest

You might want to specifically pick exploits that do have a writeup.

Well, or attach a debugger. That works too.

Especially since it gives you more experience with using debuggers.

Anonymous

The only problem with that Forest, the OSCP materials are very outdated.

Anonymous

So most of these exploits I will come across will be very old exploits such as 2007 CVEs.

forest

Go read "The Art of Debugging" which gives info on GDB, DDD (a frontend for GDB), and Eclipse. After all, an exploitable bug is still a bug in the eyes of GDB!

Anonymous

9:05 AM

Alright, I will do.

forest

...I need to get better with debuggers. :(

Anonymous

Hah!

forest

I still only use them for basic debugging. I'm... I'm a printf debugger.

Anonymous

If you need to get better then well..

forest

Even when I do kernel dev.

Anonymous

9:07 AM

I need to start, lmao.

forest

In that case I just use printk. :(

Anonymous

I know a very, very, very, very, very, very tiny amount about RE.

Anonymous

In fact, I know as little as LiveOverflows first video on RE.

forest

Same.

It's something I really want to get better with.

Anonymous

Oh, that surprises me.

forest

9:08 AM

But as it is, I only know basic x86 and MIPS assembly.

Anonymous

I would like to get better with it but at the same time on top of, work, commute, study, girlfriend I don't really get much free time as I mentioned before.

forest

RE is actually one of the ways to get a lot of money.

Anonymous

And the little other free time I get I either spend watching something on Netflix (typically less than one-two episodes a week) or just relaxing and staring into the middle distance.

Anonymous

Oh and I missed out the big one - sleep.

Anonymous

That takes a lot of my time as well, I try and only get about 6 hours a night but sometimes I sleep a little over.

forest

9:10 AM

Sleep is the best time to learn!

Think about your problems as you fall asleep.

The solution will come to you in a hypnagogic state.

Anonymous

You really don't want to know what I think about when I sleep, lmao.

Anonymous

One word ... Fill in the blank.

forest

hah

Fair enough

Anonymous

I wouldn't fill in the blank, Tom might have a breakdown lmao.

Anonymous

In all seriousness, I do wish I had more time but I simply don't know where I can obtain it from.

Anonymous

9:12 AM

Well, of course I could cut the 1-2 hours on Netflix, cut the girlfriend but that's just moronic - I will burn out so fast like that it's a stupid idea in the first place.

forest

You can get money quickly by learning exploitation and RE.

Enough at least to not need to spend time with a job.

Anonymous

That is the one very appealing side.

forest

As always, if you find any interesting exploits, come to me with them. :P

I'm currently looking for pre-auth RCE in embedded systems (switches, routers, etc.) and web frameworks that are commonly used for forums. And I never re-sell to governments! So I'm an ethical broker. ;)

Anonymous

I hate working for someone else as it is, but if I could have enough money to just sit at home find some exploits a couple times a year and then do whatever the f*ck I want, I'd be living the dream.

Anonymous

I'm thinking pretty far into the future here but after maybe 2 years as a pen-tester for a company I think I might go freelance.

forest

9:14 AM

Freelance pentesting?

Anonymous

Yeah, contracting I guess.

Anonymous

I don't know what you guys call it in the US.

Anonymous

But I don't really like working for companies, I'd rather work for myself.

forest

Well contractors can be freelance or not.

Anonymous

Only pain in the ass there is accounting.

forest

9:15 AM

You can work for a "company" that just manages contractors, and sends them off to people who need them (in which case you'd be their contractor, not employee).

Kind of like a pimp. You'd be the ho, the companies you work with are the johns, and the company that manages it all is the pimp.

Anonymous

Hmm, I like the idea of working for myself though.

Anonymous

So.. Yeah, freelance pen-testing, is that a thing?

forest

Yeah, but it's not as easy to get clients.

Anonymous

Yeah that's the only issue I guess.

forest

But you can still do freelance infosec stuff even without that.

Anonymous

9:16 AM

But it would give me a lot more free time.

forest

Which could include pentesting.

Anonymous

Which I can then use to do research or something and make a bit of cash.

Anonymous

Yeah that's true.

Anonymous

I just don't like working in an office 9-5 with people I don't like, with policies I don't agree with for customers I hate.

forest

Ah, not all jobs are like that.

Especially if you do blackhat stuff, then it's on your own time even if you work for someone. All that matters is you get the job done.

Anonymous

9:17 AM

Hmm, I guess.

Anonymous

I mean - I cannot comment I've only been working a year & a half.

forest

Well more experience is always a good thing.

Anonymous

And I realise my employers can very well see this chat so if they have a problem with my opinion they can feel free to come to me.

Anonymous

But I've noticed one thing; I f*cking hate this kind of environment, it's literally awful.

forest

yep

You're cattle.

Anonymous

9:18 AM

But... Needs must. And I cannot really complain, for my age I've got a pretty good job & I make a decent wage.

Anonymous

But the point remains, I hate it.

Anonymous

There are people in much worse off positions than me (clawing their way through their A-levels) but then I see it as... Well, that was their choice & I made mine, mine was probably just better.

Anonymous

shrugs

HamZa

I work for a company as an employee. The company gets clients and i need to pentest/code review each "job". Most of our "pentests" do not exceed a week. So I can imagine, that if getting a client is hard, then getting consistent clients is even harder.
Unlike development when you're outsource for several months per "job", pentesting in my world doesn't take more than a couple days.

forest

Pentesting can certainly take longer depending on the scope.

I mean, if it includes a source code review...

Anonymous

9:21 AM

Yeah I guess you're right HamZa, finding clients could be quite difficult.

Anonymous

But, if I have other sources of income - is that a bad thing?

forest

Not at all.

Just be minimalist. Don't buy excessive shit. Spend your time learning.

As long as your other source of income is steady and stable...

Anonymous

As Forest mentioned, you can make a lot of money from RE even just research in general so if it means I get a better working environment then I'm not sure I care all that much about the money.

HamZa

@forest Clients most of the times do not want to pay too much. After all, security does not give them any tangible results, as a matter of fact, it might slow down their development in the short term. I got pentests literally because they were required by their investors

Anonymous

As I mentioned before, as long as I can provide for myself & eventually whenever I take that leap to move in with her, my girlfriend I do not really care about money.

Anonymous

9:23 AM

Sure I could drive a nice car... Or, I could work less.

Anonymous

I know which one I prefer.

forest

For freelance, it's often useful to help out people who cannot get a security audit easily because of the controversial nature of their website/platform/service/etc.

For example weirdo religious stuff or perverted websites.

Anonymous

Oh great...

Anonymous

Well, as long as it's not illegal stuff I'm not sure I care to be honest.

HamZa

hahaha never thought about this...
but i'm not sure if my conscious would allow me to do so

forest

9:24 AM

Well you can pick and choose. I mean I do it for pretty much everything.

But there are some people who go even farther. I know someone who worked with a cartel. I'll pretty much do anything that isn't going to get me decapitated.

Anonymous

Christ, lmao.

Anonymous

Well, I'm not sure I'd be willing to go that far. But as I said, I don't really care an awful lot for money.

Anonymous

I'd rather get very few clients, have a shed load of free time, earn some cash with research etc & just exist doing things I enjoy.

forest

Fuck the law man. Don't base your morals on what some politician says.

Anonymous

Sadly Forest, I don't feel like getting arrested if I'm caught.

Anonymous

9:26 AM

I wouldn't last 12 hours in a prison.

forest

Security is as much about defense as it is offense.

You have to learn how to help yourself before you help others.

Anonymous

Yeah but the defense side is boring.

forest

I find the defense side to be fascinating.

Anonymous

I've never been more bored in my life than when I did a small course on incident-response.

Anonymous

Maybe I just have a destructive nature/streak within me thus I prefer offensive-sec lmao.

forest

9:28 AM

Because for offense, it's the same thing over and over. For defense, you have to learn how to expect the unexpected.

I mean what's more fun, popping some crappy Japanese webhost, or looking at your security logs and realizing the FBI was actually poking around the site?

Anonymous

Considering my previous statements this may sound hypocritical but, Forest you're talking to an Autistic guy about routine, hah.

forest

lol

Anonymous

I like doing the same thing over & over it makes me feel safe & to be perfectly honest, less anxious.

Anonymous

I actually don't think I'd last in freelance.

forest

You might really like RE then. It's very methodological and routine.

Anonymous

9:30 AM

I'm too... On edge, anxious, nervous, uncomfortable.

forest

Ah

Anonymous

I'd worry constantly about my next client.

Anonymous

That's probably not healthy, that's the one thing I worry about.

forest

Then work as a contractor, but not a freelance contractor.

That's basically freelance, except someone else finds clients for you, and they get a cut of the profit. Other than that, you're pretty much free to do whatever.

Anonymous

Hmm, that's probably the best option.

forest

9:31 AM

No office work, no (very) strict deadlines.

And if you're not able to do something, someone else will pick it up.

Anonymous

I'll look into that.

Anonymous

I'm getting closer & closer to being able to move out and I am starting to worry a lot.

forest

And because you're a contractor and not an employee, you can choose to say fuck these guys and find another client.

Anonymous

I don't know how I'm going to survive to be honest with you, lol.

Anonymous

I'm pretty self-sufficient but when I move out there will be nobody to ease my anxiety anymore.

forest

9:32 AM

Well the most stable ways to make money are RE, web exploitation, and SEO.

Anonymous

I'ma have to start smoking I think...

Anonymous

I need to chill out lmao.

forest

Try edibles. Smoking is bad for your lungs.

Anonymous

Yeah good point.

Anonymous

Either way, I am far too on edge to live on my own I think, but we'll see how it goes.

Anonymous

9:34 AM

I'll probably get a steel reinforced front door lmao.

forest

Make sure you get a lock that doesn't have a bypass pin.

A lot of door locks have little bypass pins in them.

Which is fucking retarded. Just get a good door and window frames, and a shotgun.

And cameras. Cameras are nice.

Anonymous

Yeah I will have cameras for sure.

HamZa

Damn, isn't this going a bit too far?

Anonymous

HamZa, I literally worry about everything

Anonymous

So probably not, lmao.

forest

9:36 AM

Get a few cheap cameras, use the program Motion (works on Linux, dunno about other systems) to detect motion and automatically respond.

HamZa

I would say work on your mental state. Working out, martial arts (self defense) and/or religion might help

Anonymous

@HamZa Eh, it's just my anxiety.

Anonymous

I suffer with it pretty badly.

Anonymous

And... Well, I could see a counsellor but I think they're kinda' a waste of money.

forest

>or religion

Anonymous

9:38 AM

I'm skeptical of people that listen to others problems for a living.

Anonymous

And... I hate religion.

forest

Right because believing in a magic Hitler that will burn you forever helps.

HamZa

(shrug)

Anonymous

I am fine.

Anonymous

I'm still breathing thus I am fine.

forest

9:39 AM

I mean where would you rather go, into the same place you were before you were born (oblivion), or where the wyrm dieth not and the fire is never quenched?

Anonymous

lol

forest

That's Christians anyway. Muslims believe your skin will be ripped off and your face will be boiled in oil, then left to heal instantly, then ripped off again while you're sitting in a lake of lava.

Anonymous

This sounds really bad/offensive but I am so glad my girlfriend is not muslim.

forest

That's not at all bad or offensive.

I prefer sane folk as well.

Anonymous

Because if she said, oh I'm muslim.

Anonymous

9:41 AM

I'd run.

Anonymous

shrugs

forest

:P

Anonymous

I seriously couldn't deal with that.

Anonymous

Her mother is Muslim so that's interesting but she's not so that's fine I guess.

Anonymous

I don't really have a problem with other peoples beliefs but I couldn't deal with them being so close to me all the time.

forest

9:42 AM

I dunno, Muslims are so sexist and so oppressive of women that you don't have to worry about a female Muslim. She won't preach if you tell her not to, probably because she's too used to being beat up by her father for talking out of line.

I mean sure, Christians can be pretty sexist too, but not to the same extent.

Also vegans. Vegans are fucking insane.

Anonymous

It's kinda' funny, my girlfriend was more likely to be punished by her mother than her father when she was young, hah. Well, that's probably because her father isn't Muslim nor Arab.

forest

heh

HamZa

tbh the beating thing sounds more like a cultural thingy
even males get beatup pretty much all the time

forest

@HamZa True. It's a violent culture.^W^Wreligion of peace.

Anonymous

lmao.

forest

9:45 AM

But don't get me wrong, I got no sympathy for Jews either.

Anonymous

@HamZa Oh.

Anonymous

I had no idea.

forest

I'm an atheist, but was raised Roman Catholic.

Anonymous

I just think the idea of believing in a higher being is f*cking stupid.

Anonymous

shrugs

forest

9:47 AM

(And before anyone gets all offended, it's the beliefs and the resulting behavior that I dislike, not the people themselves. I got nothing against any individual races.)

Tom K.

wtf? what's with the BS?

Anonymous

???

forest

@J.J I feel that way with any kind of magic superstition.

Tom K.

maybe you should rephrase your sentences then...

forest

@HamZa I look for evidence that is reproducible and empirical.

Sometimes, the truth can be very non-intuitive.

Anonymous

9:48 AM

@forest Yeah...

Tom K.

"I got no sympathy for Jews either." is pretty much talking about "the people themselves" and not the beliefs

Anonymous

The speaking to dead people thingy, I really despise that.

Anonymous

That is a scam.

forest

@TomK. Unfortunately, there's no specific word to differentiate the religion from the culture. I have no problem with Jewish culture or Hebrews.

Tom K.

try Judaism

or "religious beliefs of the jewish people"

forest

9:49 AM

Good point. s/Jews/Judaism/

I mean, some parts of the culture I don't like, like mutilating children.

But that's religiously-inspired most of the time, even if it is often cultural.

Anonymous

@forest I'm guessing you don't believe in any of this ghost stuff either?

forest

G-g-g-ghosts!!!

Anonymous

I'll take that as a no.

Anonymous

It's so stupid.

forest

Yeah I don't believe in ghosts. Aliens maybe, but I don't believe they've ever come to Earth. They're probably somewhere out there way too far away for us to ever find them. But that's also just me hoping.

Anonymous

9:50 AM

Like, anybody that says they have seen a ghost has probably never seen a ghost.

Anonymous

I find it so stupid.

forest

Well the thing is, seeing ghosts is a well-known psychological phenomenon.

E.g. the feeling of being choked while you're waking up.

That creates a mental feeling of a "presence" standing over you.

Anonymous

But I guess if people like spending their time hunting for ghosts I cannot judge them.

forest

However it's nothing more than sleep paralysis and the like.

Anonymous

I spend my time staring at terminals so...

forest

9:51 AM

Eh, I dunno, the people who spend time hunting ghosts are mostly doing it for the money they get out of merch and TV shows.

Anonymous

Yeah.

Anonymous

Exactly the same thing as people that say "I can speak to the dead"

Anonymous

No you can't...

forest

Yeah, that's cold reading.

Anonymous

You can hear money falling into your bank account.

Anonymous

9:52 AM

"I can hear the dead"

forest

lol

I see dead people!

Anonymous

Eh, people that fall for that kinda' stuff - they deserve to get scammed if I am honest.

forest

mhm

Anonymous

But I guess people do the strangest of things when they lose a loved one so I shouldn't really say that.

forest

Problem is that those people also vote, and hold corporate shares.

Anonymous

9:53 AM

lmao.

Anonymous

Funny thing is, a relative of mine claims that she can talk to dead people.

forest

wow

Anonymous

And on multiple occasions she has offered to "give me a reading" to tell me the future.

forest

I mean I can do that too, but they won't talk back.

Anonymous

Do you think I want to know the future darling? I'm scared of now.

forest

9:54 AM

They just kinda sit there decaying.

Anonymous

Let alone the future.

forest

heh

Anonymous

Yeah she has tried a few times.

Anonymous

I just politely reply with "no thanks"

forest

I usually humor them.

Anonymous

9:55 AM

Apparently she has some stone that can help her decide when someone is telling the truth as well.

forest

heh

Anonymous

Which is just totally moronic.

forest

Well to be fair, it can work well, even if a $5 wrench is the more common tool.

Anonymous

I did actually do that one.

forest

Never said how it gets people to tell the truth! :P

Anonymous

9:56 AM

I said something completely false.

Anonymous

And she said "oh I can see you're telling the truth"

forest

hah

Anonymous

I really hate that kinda' stuff.

forest

I know someone on IRC who's like that, to the extreme.

Anonymous

Ghosts, higher powers, speaking to dead people, etc it's all a load of rubbish.

forest

9:57 AM

Like, she thinks I'm some kind of demon or something.

Anonymous

lmao.

Anonymous

This is how cults form that's the part that worries me the most.

forest

I gave her an encrypted copy of like $10k USD in a bitcoin wallet.

Tom K.

@forest I wonder how that came about...

forest

Told her to get her ghosts to read my mind and find out the key.

Turns out no money was ever taken from that account.

Anonymous

9:58 AM

One person get's so obsessed with an idea that they start to believe it's real themselves.

Anonymous

Then they push that on other people and then those people start to believe it and soon enough you have a cult.

forest

@TomK. I'm a very different person on IRC. Probably a worse person.

Anonymous

Crazy...

forest

@J.J And a cult is for crazy people, until you collect millions of followers, then it's an established religion with all the legal benefits that come with it.

Tom K.

jeez..

Anonymous

9:58 AM

I've always wanted to join a cult for like a week or something.

Tom K.

are you a worse person in real life as well? :/

forest

Like, you know, mentally abusing children because a magic book told you to.

Anonymous

See what the fuss is all about.

Anonymous