« first day (3262 days earlier)      last day (18 days later) » 

5:53 AM
I just went there again and now I finally got my coffee
And yes, paper generators are really neat. It's a shame though that they need to be used to sort out shit conferences
Which makes me wonder: What actually is a "bogus conference"?
6:14 AM
Day 4 / 10 on-site! Almost halfway there
6:27 AM
@schroeder John posted yet another question regarding physical pentests
Q: How to keep yourself safe during physical pentests?

John ZhauEvery "How to prepare for a pentest" article I've read is mainly about "What tools should you bring" and "How should you gather information" and such. There's been little discussion about the safety aspect of it. The most I've seen so far is "know who to contact just in case" and "always bring yo...

I'm voting this off-topic. Personal safety isn't on-topic here afaik
1 hour later…
7:58 AM
I'm inclined to agree @MechMK1
Knowing my luck, your flag will be accepted and mine will be declined.
1 hour later…
9:24 AM
Today I found out what happens when you run AquaTone on a Notebook... It nearly lights on fire.
10:00 AM
I completely DISAGREE with this answer. AMD did not cheat on by compromising security for gaining performance (like in the stated case). Much of the AMD code is open source and can be independently analyzed. What intel did is like allowing a login while having only half of the password correct. — Overmind 20 hours ago
lol wut
@ConorMancone I don't mean plugins (although it does apply to them as well). The problem is shared libraries like the libc, libpng, libjpg, imlib2, libnss, libxml, etc. Naturally, browsers are not statically compiled. My point is just that you can't assume that an exploit for Chrome can't be made to work on Firefox as well just because the browsers are different.
Does anyone have the executable used in CVE-2019-1388?
@forest Looking at you there :D
A Windows thing? I know nothing about it.
My sadness is immeasurable and my day is ruined
10:10 AM
> The specific flaw exists within the User Account Control (UAC) user interface shown on the secure desktop. By interacting with the user interface, an attacker can launch a highly-privileged web browser on the normal desktop. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM.
The above is [from ZDI](zerodayinitiative.com/advisories/ZDI-19-975. Funny that UAC not only is broken since UIPI is so easy to bypass, but it actually makes things worse by drastically increasing attack surface area!
Yeah, you need a MS-signed executable that has a specific property set in it's cert
And apparently that executable is hard to find.
Oh, then you could probably find one easily. What property is it?
Let me see
Then it's probably not one specific executable, but any executable with said property.
Yes, exactly
This is the one. It's MS-specific
10:13 AM
no idea
Does it have to be signed by MS itself, or just with a cert MS trusts?
Good question, I don't know. I assume it works on all certs
Though I don't know how PE are actually signed
Otherwise I'd just self-sign one
Is this for testing or for an actual attack?
Pentest I am doing right now
If it's for testing, you may be able to manually trust a root cert you make yourself.
But that requires admin to do in the first place.
I have that :D
But I still would like to see how it could be done from a low-priv user
10:15 AM
Then you can probably add a cert to the root store, and then use a low-priv user.
Yeah, but my limitation on the admin is that I am not allowed to modify anything (don't ask)
Holy fuck, I closed chat and there's 33 messages.
Yeah, I need help with a pentest once again
Doubt you'll ever find help with me if it's a Windows pentest. :P
10:17 AM
Because CVE-2019-1388 requires an executable signed with a cert with a specific property
I dislike windows
What property is it specifically? Like what is it in x.509 terms?
@MechMK1 It's disappointment by the way :p
My disappointment is immeasurable and my day is ruined.
I am so bored.
Nothing to do, nothing to hack.
Bored. As. Fuck.
@J.J You own a business yet? :p
10:20 AM
You know, I totally forgot about that.
Umm, wait. Does it HAVE to be an LLC?
For example, is self employed not good enough?
Because I have to register as self employed in the next 6 months since I started doing bug bounty and I don't fancy having the tax man knocking on my door.
I think it has to be registered in some way. LLC, Gmbh, Inc, etc.
ah maybe that'll work idk
LLC is much better than GmbH
Okay, well, I have to do that soon.
If I don't, I go to jail.
So, uh, I won't forget this time.
10:21 AM
Because for a GmbH you need to have a certain capital to vouch for outstanding debts
For LLC afaik it just needs to be one pound
GmbH needs like 15k or 30k
@J.J That's why anonymous self-employment is fun. :D
I'll do that this weekend.
It doesn't take long to register afaik.
And then I'll send them an email (grsecurity), I am sure that will suffice.
I think I still have your email so.
It's hard getting that kind of shit while staying anonymous.
I'm not willing to deanon my business just for that, you know.
10:25 AM
Yeah, I get you.
Anyway it's probably better if you call them instead of email, since they have a tendency to totally ignore emails from time to time, especially if it's gmail.
Self employed is pretty much, apply, create a name, done.
Ah okay, I'll call them.
Then I just need to remember to do a self-assessment.
Don't tell them about me or they'll think I work for KSPP and ignore you. :P
But I'll just get my mother to do that.
Hhahahhaha, I won't.
They're paranoid about KSPP and other Linux Foundation guys trying to steal their work.
10:26 AM
I'll just tell them I want it for my security company.
And since it get's registered like a company then I am sure they won't care.
They charge more based on how many computers you say you'll install it on.
So I shall tell them.. 1?
Since I don't need it and I'm assuming you only need it for 1 machine?
I need it for one, yes. A research workstation.
10:27 AM
Okay, no problem.
x86_64, latest stable kernel (they ask what arch and what kernel version)
Question: for the payment, do they need it to come from the company?
They also ask about Pro support but Pro support is way more expensive and doesn't give you much extra, unless you know nothing about kernel stuff and need them to do everything.
Or can you just send them it?
Yeah I think it has to come from the company, but it can be via bank transfer.
10:28 AM
I'll send you the bitcoins, you pay them in whatever way you see fit.
Since they no longer take btc directly :(
Yeah, that's fine.
With any luck they won't tell me to fuck off :D
lol yeah
At least I have someone in my family who can do taxes for me.
Those self-assessment forms are ass.
Life is so much better without doing taxes. Less money being used for evil that way.
10:32 AM
Unfortunately I don't have an awful lot of choice.
It's too bad.
Unless of course I go greyhat/blackhat.
Greyhat best hat.
Heh. Well, I just started more whitehat shit since I started bug bounty.
So. Much. Work.
Also, devs write such shitty code and then just stick a WAF in front of stuff its aids
In terms of bureaucracy or the actual pentesting?
10:34 AM
The enumeration.
Yeah most programmers don't know how to write secure code...
They just have so much shit.
I'm on a few programs right now, one of them has 1000 subdomains+
Get used to fuzzing. It'll help you find bugs much more quickly.
It's like... "do you guys do any kind of dns management?"
At least for binary exploitation. Not quite so much for webdev.
10:35 AM
Yeah, I am mostly doing web app stuff now since that's most of my day job now.
OSCP kinda' went to waste... But, it did help me get this role I guess.
No such thing as going to waste.
It helped hone your mind for exploitation.
I want to do the OSCE but I'm sorta' trying to buy a house so I don't have much money to spunk up the wall.
Yeah that's true. I just meant wasted in the sense that I don't do any infrastructure based pen-testing in my current role.
At least, not yet...
With that said, I kinda' enjoying web more than infrastructure based stuff.
More attack surface, more cool bugs imo.
Less CVE usage, more brain usage.
I don't like web stuff mostly because I don't know web stuff lol
Oh there is so much to learn, it's crazy. I am really awful at it considering I am a full-time pen-tester.
You learn as you go along. As the years pass, you'll realize just how much you've gathered.
10:38 AM
I don't want to do it forever, but I'm having quite a lot of fun with the exploitation side of it. I do want to move into more low-level stuff but I just need funding for a few courses, etc.
I really badly want to go to the CoreLan Exploit Apprentice course but it's like £3000 + flights + hotels + other expenses.
It's kinda' outside of my self funding range. Maximum I could afford to spend on a course right now would be like £2000 total and I'd feel damn sick about that.
But hey /shrug.
These messages will self destruct
Hello, my first chat room
do you talk about airdrops here?
Oh, nice, Forest.
And, hello John.
10:42 AM
Hello JJJ
I mean only 2 J's
Airdrops? hm
Like what? Literal air drops?
Did you read that document by Fisher yet, Forest?
I saw crypto in the tags, was just wondering
Was a really interesting read.
@J.J I didn't read it yet. I'm lazy I guess.
10:43 AM
Cryptocurrency airdrops, free crypto for new blockchains and what not
@JohnHarvey Oh, some cryptocurrency? We don't really do that here.
Most of those are pretty scammy fwiw.
yea, they can be
It's pretty interesting. I had to break half way through because I felt like I was reading for hours.
But it was damn interesting. Her take on the world is super interesting too.
I need to find something to do right now, I am so fucking bored. I should have brought my personal laptop to work with me.
I don't have any of my files :(
A lot of people who get deep into underground geopolitics have interesting ideas.
okay y'all, just passing through, heading out
10:45 AM
aight, ttyl john
Yeah, for sure.
What I find hilarious is people on Twitter are calling her out for "not being a woman".
wait what
With ridiculous comments like "I am sure Fisher claiming to be a woman is nothing more than just a publicity stunt"
Some kind of transphobia or something?
oh wow
I just think they don't believe a woman would do such a hack, I guess.
10:46 AM
There are some very smart female hackers out there. :/
I know plenty of female hackers very capable of doing such a thing.
Most are guys but that doesn't mean they all are.
The person who coined "rootkit" is female.
Yeah, it was ridiculous. I had such a desire to ask them why they thought it couldn't possibly be a woman but I didn't bother.
Or maybe that was bootkit... But yeah.
Well they're probably just trolls.
Just because if I did ask them why, I know how that conversation ends.
10:47 AM
And hell even if isn't a woman, most likely that'd be for opsec reasons, not a PR stunt.
Not great opsec anyway since stylometry can usually differentiate genders in text.
I imagine a percentage were trolls, but there were some people who were really quite serious lol.
Well, they need to hang around the hacker community more often.
Real hackers welcome anyone who can hack, male or female.
Eh, I don't really care if it is or is not a woman, although I am pretty sure that they would not say they are not if they were not.
Ever read "The Mentor" on Phrack?
It rings a bell but I'm not sure I've read it.
Can I Google that at work?
10:49 AM
"The Conscience of a Hacker", usually known now as "Hacker's Manifesto".
By The Mentor. An old and beautifully written manifesto about hacking.
It's short, but sweet.
I'll have to give it a read.
==Phrack Inc.==

Volume One, Issue 7, Phile 3 of 10

The following was written shortly after my arrest...

\/\The Conscience of a Hacker/\/


+++The Mentor+++

Written on January 8, 1986

Another one got caught today, it's all over the papers. "Teenager
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
Damn kids. They're all alike.
There ya go if you don't want to load the Phrack website.
(Some formatting, particularly tabs, broken in the above copy-paste)
That is some powerful text.
It really is. Famous in hacker lore.
I love this sentence.
"You build atomic bombs, you wage wars, you murder, cheat, and lie to us
and try to make us believe it's for our own good, yet we're the criminals."
10:54 AM
"Yes, I am a criminal. My crime is that of curiosity. My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
It's a beautiful piece of text that really highlights the hacker mentality.
And that was written in the 80s.
I'm waiting for Tom to come in here... I can already imagine what he would say.
Yet it's still powerfully relevant to so many modern day hackers.
Why, what would he say?
"why are you guys quoting this nonsense?" - Tom. K, 2019.
Something like that, lol.
Does he not like this kind of stuff?
It's part of hacker blood. Can't be a hacker if you don't grok hacker culture.
Based on all the other conversations we've had with him on politics in here over the last two years, no.
10:56 AM
It was more of a tongue in cheek joke though, maybe he does like this stuff, I cannot speak for him exactly but it was funny to imagine his reaction in my head.
Another good read that shows where some of my anti-government mentality comes from is in my profile (also from Phrack). A wall of text and it is in dire need of whitespace, but it's an insight into the hackers that stab others in the back (the pro-government blackhats), even at the expense of their brethren. It's an enlightening read, and good enough that Phrack Staff accepted it.
It sort of shows how the hacker community split in the recent two decades.
That's pretty neat. I could've written one but someone has already done it well so that's a plus.
Heh, just found a cool script that automatically searches for subdomains (from a list) on GitHub.
(I didn't write it, but it was influential in forming my anti-government sentiments)
It, and things like it.
Oh the pro-government blackhats are awful people.

« first day (3262 days earlier)      last day (18 days later) »