« first day (3797 days earlier)      last day (44 days later) » 

1:30 AM
@J-- IDK but it seems to me he will never manage to get into an important enough machine to be worth arresting.
 
 
9 hours later…
J--
10:46 AM
@nobody Hahaha, that's probably true.
 
 
9 hours later…
7:47 PM
@J-- Yeah they are. The ideal would be to just pirate the classes.
 
8:22 PM
@J-- Haha probably. +1 in your answer for mentioning using a 3rd party server.
In bash I check my ip its different then I run msfconsole so it go over tor? — dumb guy yesterday
oh dear
 
J--
@forest The unfortunate thing is that I really want to work in this stuff and based on my initial assessment of the market, if you don't have any CVEs, then you really need something concrete (like a piece of paper). It could take me a while to find a CVE so I just have to suck it up, I guess.
@forest Heh, thanks. I guess we'll never see him again, he's about to EB a government system, probably his local council :D
 
@J-- If you want to find a CVE in anything, it's not too hard.
Start fuzzing something that's really insecure and find an exploitable bug. Chances are you won't even need to write a PoC if it's pretty clearly exploitable.
I assume you've used AFL before?
 
J--
@forest Yeah, I actually have some candidates setup to hunt for once I finish this material!
Three programs to be exact
@forest Yeah, I have.
I just need to finish this material first. I'd like to finish all the challenges since they're super good experience.
I just finished the ASLR bypass challenges. Onto format strings now.
 
Good luck!
 
J--
Thanks. I am learning a fucking lot, that's for sure. lmfao.
One of the pieces of software I have picked out I already know will be riddled with bugs.
Because it doesn't even have ASLR. Not to mention, I managed to take the signature from the binary to get admin on a machine...
lmfao.
 
8:30 PM
wot
 
J--
lol, yeah.
It ran as admin right, on Windows.
 
Signature -> Admin? How?
 
J--
So then you can just take the signature off the binary and then# on your own binary.
And then you get it to execute your binary via the program
 
@J-- So what's your opinion on Windows security?
 
J--
and because the signature matches, you get admin.
 
8:32 PM
How do you put the signature on your own bin? wouldn't that invalidate the sig?
 
Ah, so the signature was never verified?
 
J--
@forest So, it doesn't seem that great, at least, not in the user-space level. The kernel space level seems... A lot more difficult. I am still yet to figure out why we hardly see many Windows RCEs, mostly just DoS' for example. If you know, please enlighten me.
@nobody Yeah, that's right.
The software is absolutely garbage. When they're not even doing basic signature verification, you know it's horrible.
I mean, its 2021, there's no excuse to compile without ASLR and NX lmfao.
 
Why isn't ASLR and NX the default in compilers?
 
J--
It is...
 
8:35 PM
Shit, so they go out of their way to reduce security
Like, just, wow
 
J--
That's precisely the reason I decided to pick this software for one of my candidates for CVE hunting. I also checked already, no CVEs so, it's perfect.
@nobody Yeah, precisely..
Pure trash, lmfao.
 
@J-- RCEs are uncommon for operating systems in general.
 
J--
That's a good point.
But in general, NX and ASLR are no where near as strong as I once thought.
I am yet to look at CFG. Not in the course material it doesn't seem so I'll have to read about it on my own.
 
I think Microsoft is getting ready to make an improved version of CFG by utilizing Intel CET.
 
J--
Oh cool, I'll have to look into that.
I've been reading some stuff on Rust.
Found a MSFT article from I think 2017 saying they were moving a lot of stuff to Rust.
 
8:39 PM
@J-- I wonder if bad userland security is specific to windows though.
 
What are they moving?
@nobody Nope. Userland security sucks everywhere.
Although disabling ASLR or NX is really never acceptable...
 
J--
From what I understand they want to move everything they can to Rust. A lot of their new projects especially were starting out with Rust from the get go. They've been using it for years, according to their blog anyways.
Will be interesting to see what the exploit development landscape is like for userspace in like 15 years when there's a lot more stuff on Rust.
 
hi. :)
 
@MatthewDaniels hello
 
just checking around rooms.
I'm new and I want to look around, see what I can talk about.
what exactly is this information security? tech?
 
8:42 PM
@MatthewDaniels Basically securing computers
 
@J-- The real issue is when you start mixing binaries and having something half-C and half-Rust.
 
ah, okay.
bye. :)
 
The problem with that is a C vulnerability may be usable to attack the Rust code which may not have as many security features (e.g. C to cause a buffer overflow in Rust code because Rust doesn't need a whole bunch of anti-buffer overflow features since it is more or less immune).
 
J--
Hmm, that's really an interesting concept.
From what I understand, Rust also somewhat solves the problem of race conditions, right? As well as being very memory safe.
 
What happens when everything starts using Rust? We go out of business?
 
J--
8:45 PM
No, definitely not.
There's always bugs, in everything.
 
Well, will binex still be a thing?
 
J--
Exploit development for user-space applications will be drastically different though, I expect.
 
What would the exploits be based on? Just logical errors?
 
@J-- It doesn't "solve" it, but writing concurrent code is way easier in Rust.
 
J--
Yeah, I would assume mostly only logical errors at that point. But I don't think we need to worry about Windows itself going entirely to Rust or Linux. So we're probably fine.
But yeah, from what I understand, Rust solves a lot of the current userspace binex problems. Memory corruption specifically.
 
8:46 PM
Well I doubt Windows or Linux will be replacing their kernel with Rust any time soon.
 
J--
Yeah, exactly.
They won't.
But user space will change a lot, for sure.
I mean, Rust has only been around since 2011, it already has a lot of traction because of the whole memory safety thing.
@forest Right, makes sense.
 
I'm hopeful that we'll be able to solve this with better compilers, but that's mostly because I'm grumpy and don't like change, and Rust has ugly syntax.
 
J--
Good thing I want to go into kernel exploitation right
 
yeah lol
 
J--
wont make myself redundant
lmfao
Speaking of which, I have my C book now. So I can start learning more C.
I noticed earlier today.
 
8:51 PM
I was wondering, could it be possible to make C memory safe?
 
J--
That I can basically make ROP chains without even thinking about it anymore.
I was just picking gadgets seemingly out of thin air
without a compiler
 
@nobody Pure C? No, but you can write code that is memory-safe.
 
J--
and they were working.
so thats fun.
@nobody As forest said, the whole idea is that you write memory-safe code. The reason for Rust even existing is so that you get most of the control of something like C but without needing to actually write memory safe code or spend time thinking about memory safe code.
Its a cool solution for sure.
 
Yeah I was wondering if a compiler that deviates from the C standard can prevent memory corruption
 
J--
I don't known an awful lot about it. But it's on my list to read about more because it does seem super cool.
 
8:53 PM
So you don't have to depend on devs for secure code (cause that's never gonna happen)
 
J--
Yeah, that's basically what Rust is.
I mean, there's more to it than that.
But at a high level, it does exactly that. By having a compiler designed for memory-safety without you needing to write the code to do that yourself.
 
But Rust is a different language
 
How much Rust do you know?
@nobody Yeah, you need to change the language a lot to make it memory-safe.
 
You can't take existing C code and compile it as rust
 
So much so that it's a totally new language.
 
J--
8:55 PM
Oh none. I would like to learn though. But, I have more important things on the list for now.
I've just been reading about Rust the last few days because someone mentioned it to me.
 
ah
 
J--
Since I want to do kernel exploitation, it isn't so important to me right now. As you say, nobody is porting their kernel to Rust anytime soon.
 
@J-- You're making me jealous. I never learned much binex. :P
 
J--
Well, now you know how I feel any time I talk to you, forest.
 
lol
 
J--
8:56 PM
Although, I don't get jealous just... Fascinated.
You're like my information security dad lul
 
@J-- Want to know a great way to learn kernel exploitation? Backport (forwardport?) a vulnerability from an old kernel into a new kernel, and try to attack it with the new kernel's mitigations in place. E.g. try to attack the keyctl() refcount overflow bug by porting the vulnerable code to a modern kernel with refcount protection (or better yet, a PaX kernel with PAX_REFCOUNT).
 
J--
Got a question? Ask forest, he always knows.
@forest Oh that's a super cool idea. That sounds like a lot of fun for sure.
My plan right now is, finish this course, pass this exam, learn more C, find some cool bugs, learn more about kernels, learn more about C, find some cool bugs in kernel.
profit?
 
Lots of profit.
 
J--
Heh, hopefully :D
Although, I don't much care about the profit anymore. I don't really need more money.
 
Also, if you want some easy kernel exploits, go after OpenBSD. :D
 
J--
8:59 PM
If I could trade money for knowledge, I would for sure.
 
You can.
 
J--
@forest Yeah, I actually have seen a lot of OpenBSD exploits any time I go on exploitdb, etc. Since I started even pen-testing I see them appear a lot.
 
Money/resources/information or whatever.
 
J--
@forest Heh, yes I know. That's why I bought this course.
I wish there was someone to learn kernel exploitation in linux from though, there's no training like that.
 
@J-- Yup, because OpenBSD's actual code is really insecure.
 
J--
9:00 PM
i'd like someone really well known to offer something even just... uh, one-one.
or whatever.
 
@J-- Look for people who have contact with e.g. Solar Designer.
He hangs out with kernel exploit folks.
 
J--
didnt this guy basically invent ret2libc
and heap buffer overflows
im sure someone told me that once
 
yes
 
J--
Yeah, thought so.
 
Back in the days when people were learning that there is more to exploitation than linear overflows.
 
J--
9:02 PM
Man, what a fucking awesome thing to say you did.
That is actually AWESOME.
You know, I'll be very sad if I leave this world and cannot name just one thing i contributed to in a massive way
 
If you keep up this rate of knowledge acquisition, you're certain to have a big impact.
 
J--
thyen again this guy is likely very, very smart
and im a fuckin idiot.
 
Just make sure you never sell out to government fucks.
 
J--
believe me, that is the last thing that would happen :D
 
Good! :P
If you do want to make a real change, consider hardening the Linux slab allocator.
(I think grsec already did something recently with that with their new allocator though)
 
J--
9:04 PM
Man, grsec would be a SUPER cool place to work
 
They're hiring.
 
J--
but tis like not many people
 
Only problem is spender and pipacs are fucking psycho bipolar.
 
J--
i doubt they d hire me.
i dont think they need someone still learning
they need someone who is like.. their level
 
Sure, but it's something to remember for the future.
 
J--
9:05 PM
but they are peiople making a real difference
i like that a lot
i just gotta work harder
 
So do I. I just wish they didn't pull their patches from the public.
 
J--
and i am pretty sure i can achieve it.
 
All because a few companies and individuals were stealing his work.
("stealing" GPLed work)
 
J--
yeah thats pretty annoying.
 
So now it's quite hard to get your hands on the patches if you aren't a company.
 
J--
9:07 PM
ima stop smoking this year i think
its holding me back, for sure.
 
What do you smoke?
damn didn't see it in time
oh well
ah
 
J--
yeah, but its a waste of time,.
the thing is, its the only time i spend with my girlfriend in an entire week.
which is why i still smoke at all. but we can find something else to do, so its whatever.
 
Huh, tried hardened_malloc on a Debian system. Overhead is quite high.
I wonder how much of that is just initialization overhead.
 
J--
speaking of C i found a good blog series on building an OS.
ito go along with osdev obviously.
 
oh?
 
J--
9:10 PM
let me try find it, it seemed very detailed which is nice.
oh no, my mistake. wasn't an OS. it was building a kernel.
 
Well building a kernel is an important part in building an OS.
 
J--
well, yeah :d
 
The early kernel code (stuff that executes as you transition to long mode) is the majority of it.
Once you do that, all you have left is resource management, schedulers, etc.
 
J--
damn, can't find it right now. but it seemed pretty good.
i also found this
 
Eh, not a fan of that.
 
J--
9:12 PM
which seems pretty interesting. and then he links a better version by a professor that has more detail
 
Musl is neat and all, but its not as secure as they claim.
Maybe they're getting better, but last I checked, even glibc was more secure overall.
And security suggestions I've provided (and others have provided) were brushed off.
 
J--
So, probably a stupid question but: what is the difference?
How they actually handle the memory, correct?
 
Well there's a number of differences. For example, glibc has setjmp cookie mangling, musl does not. Glibc has a slightly better malloc (ptmalloc, which still isn't good) vs musl's dlmalloc.
And musl does some things that irritate me like making dlclose() a no-op.
But it is a very lightweight libc and it's a great base for making a hardened libc...
 
J--
Right.
 
Trying to mess with glibc on the other hand is a nightmare. It feels like you have to pass through a hundred functions just to find the actual code that executes the real syscall.
Oh that reminds me. Another thing you can do if you really want to make a change is to work with something like Tor Project, since they need secure code.
 
J--
9:17 PM
Yeah that's a really good point! I always thought about something like that.
I'd just need to become much more proficient in C which I am working on.
Since I am mostly fine with the binex side now. I can do most of the user space stuff effortlessly.
But my knowledge of reading C and knowing why something is wrong is almost non-existent.
Mostly because i've never written much C. I'm a pen-tester after all...
 
Can you do the userspace stuff even with hardening and mitigations in place?
 
J--
Yeah ASLR and NX bypass (on Windows at least) is easy,.
The one skill I need to enhance is actually finding the bugs.
So RE...
 
Not necessarily RE. You can find bugs by reading source code as well.
But you do need to get proficient with gdb or at least r2.
 
J--
Yeah, or that.
So, the actual exploitation, I am fine with.
But the skill I am lacking is the actual finding of the bugs to begin with.
Which this course has a section on, and a massive RE challenge, which is what I am going to work on after I finish these format string challenges.
There's a binary with 15 exploits to find as one of the challenges.
 
Just don't get sucked into IDA Pro.
 
J--
9:21 PM
After I finish the format strings stuff, that's what I am going to work on because I need to improve my RE a lot.
 
Use Ghidra or w/e its name is if r2 is not enough.
 
J--
I quite like IDA. Never used Ghidra much and never used R2 at all.
For this exam I have to use IDA. But I know R2 is very popular. I'll for sure have to learn how to use it.
 
IDA is one of those programs that is closed source and forces you to pay out the ass to use it.
That's probably why the exam wants you to use it.
 
J--
Yeah, luckily you don't need Pro for x86.
 
And they try very hard to track people who "leak" it.
The non-pro version is not nearly as powerful as the full version.
But from what I know, Ghidra is about as powerful, despite its... unsavory origin.
 
J--
9:23 PM
Yeah, I know. But you're not allowed to use Pro for the exam anyways.
Home only.
SO it's okay.
But yeah, a lot people talk about R2, I gotta' learn how to use it.
 
I pretty much only use gdb and objdump lol
 
J--
Yeah, I'll be using those a lot more when I port these windows binex skills to linux binex :D
 
Linux default security is awful. If you want an easy distro to exploit, try Debian.
Old software that only backports sec fixes when someone screams loud enough, minimal compile-time hardening flags, kernel with truly ancient compatibility configs.
 
J--
I have been tracking the hours I spend studying since last week, and since last Monday, I've spent 200ish hours studying.
Which I actually think I could spend more time working.
I am just lazy sometimes.
 
It's an investment.
 
J--
9:27 PM
Oh for sure.
I'd happily work more hours. I don't really have anything better to do.
I have been sleeping more than usual lately though.
Which is fine, I guess. I feel a lot less fucked up all the time that's for sure.
Most days I felt like I was shot.
 
@J-- How did you fit 200 hours in one week?
 
J--
SOrry, monday before *
26th.
i forgot its sunday.
not last monday lul
 
@nobody He spawned another thread. Duh!
2
 
J--
im currently dreaming in rop chains
so dates and times aren't really real
 
lol
I've probably only spent 200 hours studying in my whole life
 
J--
9:30 PM
heh.
 
I think I'll just give up right now. At this rate, I'll never do anything
 
J--
i dont even wish to know how much ive spent
i wasted 12,000 hours+ on CS
so you can catch up.
imagine if i spent that on learning...
wow.
 
O_O
 
J--
In all fairness, I did used to play CS for money. It wasn't a total waste of time.
 
@J-- It doesn't matter what you wasted
 
J--
9:32 PM
Not a lot of money, but a decent amount.
 
All that matters is the time you used
I wasted practically my whole life
 
J--
Most of my friends I played CS with are now playing full-time pro in various games, which makes me sadge sometimes.
But I was never good enough so I got a CCNA instead
lul
@nobody just do what i do and guzzel study drugs
:)
most days i take 400mg of modafinil
it makes you feel like you're gonna invent facebook
its quite hard to be unproductive on those actually
 
I'm scared of all sorts of drugs
 
Drugs are good, mmkay.
 
J--
Fair enough. Modafinil are prescription though.
They're pretty common here. They don't like giving out Adderall or Ritalin to ADHD people so they give them Modafinil instead.
 
9:38 PM
Why?
 
Yeah, buts its like I no longer control my brain, the drugs do. I lose my free will
 
J--
@forest I honestly have no idea. Probably because the UK has a huge drug problem and they really do not want people to resell them. The whole resale thing is the same reason they don't give out codeine much in the UK... Also because Adderall and Ritalin are really expensive in comparison to Modafinil which costs about £0.03p per tablet from India.
 
@nobody Nitpick but you don't have free will in the first place!
But the thing is, drugs modify your cognitive processes .They don't "control" you.
 
@forest Right, I lose my perceived free will :)
 
J--
Yeah, Modafinil especially is designed to increase cognitive function, alertfulness and wakefulness which also aids with focus and restlessness.
But fair enough. I am not about to become a drug pusher. They just help me a lot.
 
9:40 PM
@J-- I've read that it doesn't really work as a nootropic for most people. It just increases attention span.
 
J--
@forest Yeah there's a lot of mixed information about whether it actually does work as a nootropic.
 
@forest I'm installing a closed source patch. How do I trust its not backdoored? :)
 
J--
I think for the most part, you're right. It just seems to increase your attention span. But there's a lot of conflicting studies.
 
@nobody A closed source patch to a closed source brain. :P
 
J--
Everythings backdoored, duh.
 
9:42 PM
The brain's source wasn't developed by humans though. Nature isn't in my threat model
 
J--
Anyways, I am going to get an early night for once.
 
But the brain doesn't have NX. All the data you receive from the environment is treated as code.
2
 
J--
Goodnight.
@forest heh.
 
g'night @J--
 
J--
time to go dream in rop chains.
:D
 
9:43 PM
(And our lack of NX is why we're susceptible to advertisements)
@J-- Sleep tight. Don't like the CFI bite.
 
J--
hehe :D
 
@forest Most of the data I receive is just forwarded to /dev/null. But yeah, the data that escapes it isn't NX'ed
 
It may be that paranoia is evolution's first attempt at implementing NX.
 
Its a pretty poor implementation, since the performance costs are usually quite significant
 
I dunno. I think the problem is that our brains don't use the harvard architecture. It's difficult to avoid rogue data execution when the system is designed with executable data in mind.
Our brains are basically big, ugly JIT compilers. Good luck getting NX working well on that.
 
10:09 PM
3
Q: Should I build my own login functionality?

Martin01478I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and Auth0. But as easy as it is to get started, they all lock you in, make you reliant on their solu...

This question doesn't look opinion based to me. It may suffer from some of the problems Steffan lists but it seems salvageable to me.
 
Certainly salvageable.
But instead of "should I build it", it should be "what are the security implications of building it".
 

« first day (3797 days earlier)      last day (44 days later) »