The DMZ - 2019-11-21 (page 1 of 3)

« first day (3262 days earlier) ← previous day next day → last day (1610 days later) »

5:53 AM

I just went there again and now I finally got my coffee

And yes, paper generators are really neat. It's a shame though that they need to be used to sort out shit conferences

Which makes me wonder: What actually is a "bogus conference"?

6:14 AM

Day 4 / 10 on-site! Almost halfway there

6:27 AM

@schroeder John posted yet another question regarding physical pentests

0

Q: How to keep yourself safe during physical pentests?

Every "How to prepare for a pentest" article I've read is mainly about "What tools should you bring" and "How should you gather information" and such. There's been little discussion about the safety aspect of it. The most I've seen so far is "know who to contact just in case" and "always bring yo...

penetration-test physical red-team safety

I'm voting this off-topic. Personal safety isn't on-topic here afaik

1 hour later…

Anonymous

7:58 AM

I'm inclined to agree @MechMK1

Anonymous

Knowing my luck, your flag will be accepted and mine will be declined.

Anonymous

lul

Anonymous

9:24 AM

Today I found out what happens when you run AquaTone on a Notebook... It nearly lights on fire.

10:00 AM

I completely DISAGREE with this answer. AMD did not cheat on by compromising security for gaining performance (like in the stated case). Much of the AMD code is open source and can be independently analyzed. What intel did is like allowing a login while having only half of the password correct. — Overmind 20 hours ago

lol wut

@ConorMancone I don't mean plugins (although it does apply to them as well). The problem is shared libraries like the libc, libpng, libjpg, imlib2, libnss, libxml, etc. Naturally, browsers are not statically compiled. My point is just that you can't assume that an exploit for Chrome can't be made to work on Firefox as well just because the browsers are different.

Does anyone have the executable used in CVE-2019-1388?

@forest Looking at you there :D

A Windows thing? I know nothing about it.

My sadness is immeasurable and my day is ruined

rip

B I G
O O F

10:10 AM

> The specific flaw exists within the User Account Control (UAC) user interface shown on the secure desktop. By interacting with the user interface, an attacker can launch a highly-privileged web browser on the normal desktop. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM.

The above is [from ZDI](zerodayinitiative.com/advisories/ZDI-19-975. Funny that UAC not only is broken since UIPI is so easy to bypass, but it actually makes things worse by drastically increasing attack surface area!

Yeah, you need a MS-signed executable that has a specific property set in it's cert

And apparently that executable is hard to find.

Oh, then you could probably find one easily. What property is it?

Let me see

Then it's probably not one specific executable, but any executable with said property.

Yes, exactly

1.3.6.1.4.1.311.2.1.10

This is the one. It's MS-specific

10:13 AM

no idea

Does it have to be signed by MS itself, or just with a cert MS trusts?

Good question, I don't know. I assume it works on all certs

Though I don't know how PE are actually signed

Otherwise I'd just self-sign one

Is this for testing or for an actual attack?

Pentest I am doing right now

If it's for testing, you may be able to manually trust a root cert you make yourself.

But that requires admin to do in the first place.

I have that :D

But I still would like to see how it could be done from a low-priv user

10:15 AM

Then you can probably add a cert to the root store, and then use a low-priv user.

Yeah, but my limitation on the admin is that I am not allowed to modify anything (don't ask)

ah

Anonymous

Holy fuck, I closed chat and there's 33 messages.

Anonymous

Yikes.

Yeah, I need help with a pentest once again

10:17 AM

Doubt you'll ever find help with me if it's a Windows pentest. :P

Because CVE-2019-1388 requires an executable signed with a cert with a specific property

I dislike windows

What property is it specifically? Like what is it in x.509 terms?

Anonymous

@MechMK1 It's disappointment by the way :p

Anonymous

My disappointment is immeasurable and my day is ruined.

rip

Anonymous

10:19 AM

I am so bored.

Anonymous

Nothing to do, nothing to hack.

Anonymous

Bored. As. Fuck.

@J.J You own a business yet? :p

Anonymous

You know, I totally forgot about that.

maaan

Anonymous

10:20 AM

Umm, wait. Does it HAVE to be an LLC?

Anonymous

For example, is self employed not good enough?

Anonymous

Because I have to register as self employed in the next 6 months since I started doing bug bounty and I don't fancy having the tax man knocking on my door.

I think it has to be registered in some way. LLC, Gmbh, Inc, etc.

ah maybe that'll work idk

LLC is much better than GmbH

Anonymous

Okay, well, I have to do that soon.

Anonymous

10:21 AM

If I don't, I go to jail.

Anonymous

So, uh, I won't forget this time.

Because for a GmbH you need to have a certain capital to vouch for outstanding debts

For LLC afaik it just needs to be one pound

GmbH needs like 15k or 30k

@J.J That's why anonymous self-employment is fun. :D

Anonymous

I'll do that this weekend.

Anonymous

It doesn't take long to register afaik.

Anonymous

10:24 AM

And then I'll send them an email (grsecurity), I am sure that will suffice.

cool

Anonymous

I think I still have your email so.

It's hard getting that kind of shit while staying anonymous.

I'm not willing to deanon my business just for that, you know.

Anonymous

Yeah, I get you.

Anyway it's probably better if you call them instead of email, since they have a tendency to totally ignore emails from time to time, especially if it's gmail.

Anonymous

10:25 AM

Self employed is pretty much, apply, create a name, done.

Anonymous

Ah okay, I'll call them.

Anonymous

Then I just need to remember to do a self-assessment.

Don't tell them about me or they'll think I work for KSPP and ignore you. :P

Anonymous

But I'll just get my mother to do that.

Anonymous

Hhahahhaha, I won't.

10:26 AM

They're paranoid about KSPP and other Linux Foundation guys trying to steal their work.

Anonymous

I'll just tell them I want it for my security company.

ye

Anonymous

And since it get's registered like a company then I am sure they won't care.

They charge more based on how many computers you say you'll install it on.

Anonymous

So I shall tell them.. 1?

Anonymous

10:27 AM

Since I don't need it and I'm assuming you only need it for 1 machine?

I need it for one, yes. A research workstation.

Anonymous

Okay, no problem.

x86_64, latest stable kernel (they ask what arch and what kernel version)

Anonymous

Question: for the payment, do they need it to come from the company?

They also ask about Pro support but Pro support is way more expensive and doesn't give you much extra, unless you know nothing about kernel stuff and need them to do everything.

Anonymous

10:28 AM

Or can you just send them it?

Yeah I think it has to come from the company, but it can be via bank transfer.

Anonymous

Alright.

I'll send you the bitcoins, you pay them in whatever way you see fit.

Since they no longer take btc directly :(

Anonymous

Yeah, that's fine.

Anonymous

With any luck they won't tell me to fuck off :D

10:29 AM

lol yeah

Anonymous

At least I have someone in my family who can do taxes for me.

Anonymous

Those self-assessment forms are ass.

Life is so much better without doing taxes. Less money being used for evil that way.

Anonymous

Unfortunately I don't have an awful lot of choice.

It's too bad.

Anonymous

10:33 AM

Unless of course I go greyhat/blackhat.

Greyhat best hat.

Anonymous

Heh. Well, I just started more whitehat shit since I started bug bounty.

Anonymous

So. Much. Work.

Anonymous

Also, devs write such shitty code and then just stick a WAF in front of stuff its aids

In terms of bureaucracy or the actual pentesting?

Anonymous

10:34 AM

The enumeration.

Yeah most programmers don't know how to write secure code...

Anonymous

They just have so much shit.

Anonymous

I'm on a few programs right now, one of them has 1000 subdomains+

Get used to fuzzing. It'll help you find bugs much more quickly.

Anonymous

It's like... "do you guys do any kind of dns management?"

10:34 AM

At least for binary exploitation. Not quite so much for webdev.

Anonymous

Yeah, I am mostly doing web app stuff now since that's most of my day job now.

Anonymous

OSCP kinda' went to waste... But, it did help me get this role I guess.

No such thing as going to waste.

It helped hone your mind for exploitation.

Anonymous

I want to do the OSCE but I'm sorta' trying to buy a house so I don't have much money to spunk up the wall.

Anonymous

Yeah that's true. I just meant wasted in the sense that I don't do any infrastructure based pen-testing in my current role.

Anonymous

10:36 AM

At least, not yet...

Anonymous

With that said, I kinda' enjoying web more than infrastructure based stuff.

Anonymous

More attack surface, more cool bugs imo.

Anonymous

Less CVE usage, more brain usage.

I don't like web stuff mostly because I don't know web stuff lol

Anonymous

Oh there is so much to learn, it's crazy. I am really awful at it considering I am a full-time pen-tester.

10:38 AM

You learn as you go along. As the years pass, you'll realize just how much you've gathered.

Anonymous

I don't want to do it forever, but I'm having quite a lot of fun with the exploitation side of it. I do want to move into more low-level stuff but I just need funding for a few courses, etc.

Anonymous

I really badly want to go to the CoreLan Exploit Apprentice course but it's like £3000 + flights + hotels + other expenses.

Anonymous

It's kinda' outside of my self funding range. Maximum I could afford to spend on a course right now would be like £2000 total and I'd feel damn sick about that.

Anonymous

But hey /shrug.

hm

These messages will self destruct

10:40 AM

Hello, my first chat room

Hello

do you talk about airdrops here?

Anonymous

Oh, nice, Forest.

Anonymous

And, hello John.

Hello JJJ

I mean only 2 J's

10:42 AM

Airdrops? hm

Like what? Literal air drops?

Anonymous

Did you read that document by Fisher yet, Forest?

I saw crypto in the tags, was just wondering

Anonymous

Was a really interesting read.

Anonymous

Long...

@J.J I didn't read it yet. I'm lazy I guess.

10:43 AM

Cryptocurrency airdrops, free crypto for new blockchains and what not

@JohnHarvey Oh, some cryptocurrency? We don't really do that here.

Most of those are pretty scammy fwiw.

yea, they can be

Anonymous

It's pretty interesting. I had to break half way through because I felt like I was reading for hours.

Anonymous

But it was damn interesting. Her take on the world is super interesting too.

Anonymous

I need to find something to do right now, I am so fucking bored. I should have brought my personal laptop to work with me.

Anonymous

10:45 AM

I don't have any of my files :(

A lot of people who get deep into underground geopolitics have interesting ideas.

okay y'all, just passing through, heading out

aight, ttyl john

Anonymous

Bye!

Anonymous

Yeah, for sure.

Anonymous

10:46 AM

What I find hilarious is people on Twitter are calling her out for "not being a woman".

wait what

Anonymous

With ridiculous comments like "I am sure Fisher claiming to be a woman is nothing more than just a publicity stunt"

Some kind of transphobia or something?

oh wow

Anonymous

I just think they don't believe a woman would do such a hack, I guess.

There are some very smart female hackers out there. :/

Anonymous

10:46 AM

I know plenty of female hackers very capable of doing such a thing.

Anonymous

Exactly.

Most are guys but that doesn't mean they all are.

The person who coined "rootkit" is female.

Anonymous

Yeah, it was ridiculous. I had such a desire to ask them why they thought it couldn't possibly be a woman but I didn't bother.

Or maybe that was bootkit... But yeah.

Well they're probably just trolls.

Anonymous

Just because if I did ask them why, I know how that conversation ends.

10:47 AM

And hell even if isn't a woman, most likely that'd be for opsec reasons, not a PR stunt.

Not great opsec anyway since stylometry can usually differentiate genders in text.

Anonymous

I imagine a percentage were trolls, but there were some people who were really quite serious lol.

Well, they need to hang around the hacker community more often.

Real hackers welcome anyone who can hack, male or female.

Anonymous

Eh, I don't really care if it is or is not a woman, although I am pretty sure that they would not say they are not if they were not.

Ever read "The Mentor" on Phrack?

Anonymous

It rings a bell but I'm not sure I've read it.

Anonymous

10:49 AM

Can I Google that at work?

Anonymous

lol.

phrack.org/issues/7/3.html

"The Conscience of a Hacker", usually known now as "Hacker's Manifesto".

By The Mentor. An old and beautifully written manifesto about hacking.

It's short, but sweet.

Anonymous

I'll have to give it a read.

==Phrack Inc.==

Volume One, Issue 7, Phile 3 of 10

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
The following was written shortly after my arrest...

\/\The Conscience of a Hacker/\/

by

+++The Mentor+++

Written on January 8, 1986
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Another one got caught today, it's all over the papers. "Teenager
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
Damn kids. They're all alike.

There ya go if you don't want to load the Phrack website.

(Some formatting, particularly tabs, broken in the above copy-paste)

Anonymous

Wow.

Anonymous

10:52 AM

That is some powerful text.

It really is. Famous in hacker lore.

Anonymous

I love this sentence.

Anonymous

"You build atomic bombs, you wage wars, you murder, cheat, and lie to us
and try to make us believe it's for our own good, yet we're the criminals."

"Yes, I am a criminal. My crime is that of curiosity. My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
for."

It's a beautiful piece of text that really highlights the hacker mentality.

And that was written in the 80s.

Anonymous

I'm waiting for Tom to come in here... I can already imagine what he would say.

10:55 AM

Yet it's still powerfully relevant to so many modern day hackers.

Why, what would he say?

Anonymous

"why are you guys quoting this nonsense?" - Tom. K, 2019.

Anonymous

:D

Anonymous

Something like that, lol.

Does he not like this kind of stuff?

It's part of hacker blood. Can't be a hacker if you don't grok hacker culture.

Anonymous

Based on all the other conversations we've had with him on politics in here over the last two years, no.

10:56 AM

huh

Anonymous

It was more of a tongue in cheek joke though, maybe he does like this stuff, I cannot speak for him exactly but it was funny to imagine his reaction in my head.

Another good read that shows where some of my anti-government mentality comes from is in my profile (also from Phrack). A wall of text and it is in dire need of whitespace, but it's an insight into the hackers that stab others in the back (the pro-government blackhats), even at the expense of their brethren. It's an enlightening read, and good enough that Phrack Staff accepted it.

It sort of shows how the hacker community split in the recent two decades.

Anonymous

That's pretty neat. I could've written one but someone has already done it well so that's a plus.

Anonymous

Heh, just found a cool script that automatically searches for subdomains (from a list) on GitHub.

(I didn't write it, but it was influential in forming my anti-government sentiments)

It, and things like it.

Anonymous

10:59 AM

Oh the pro-government blackhats are awful people.

« first day (3262 days earlier) ← previous day next day → last day (1610 days later) »

Transcript for

Nov '1921

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile