The DMZ

nobody

1:30 AM

@J-- IDK but it seems to me he will never manage to get into an important enough machine to be worth arresting.

Anonymous

10:46 AM

@nobody Hahaha, that's probably true.

forest

7:47 PM

@J-- Yeah they are. The ideal would be to just pirate the classes.

forest

8:22 PM

@J-- Haha probably. +1 in your answer for mentioning using a 3rd party server.

In bash I check my ip its different then I run msfconsole so it go over tor? — dumb guy yesterday

oh dear

Anonymous

@forest The unfortunate thing is that I really want to work in this stuff and based on my initial assessment of the market, if you don't have any CVEs, then you really need something concrete (like a piece of paper). It could take me a while to find a CVE so I just have to suck it up, I guess.

Anonymous

@forest Heh, thanks. I guess we'll never see him again, he's about to EB a government system, probably his local council :D

forest

@J-- If you want to find a CVE in anything, it's not too hard.

Start fuzzing something that's really insecure and find an exploitable bug. Chances are you won't even need to write a PoC if it's pretty clearly exploitable.

I assume you've used AFL before?

Anonymous

@forest Yeah, I actually have some candidates setup to hunt for once I finish this material!

Anonymous

Three programs to be exact

Anonymous

8:25 PM

@forest Yeah, I have.

Anonymous

I just need to finish this material first. I'd like to finish all the challenges since they're super good experience.

Anonymous

I just finished the ASLR bypass challenges. Onto format strings now.

forest

Good luck!

Anonymous

Thanks. I am learning a fucking lot, that's for sure. lmfao.

Anonymous

One of the pieces of software I have picked out I already know will be riddled with bugs.

Anonymous

8:29 PM

Because it doesn't even have ASLR. Not to mention, I managed to take the signature from the binary to get admin on a machine...

Anonymous

lmfao.

forest

wot

Anonymous

lol, yeah.

Anonymous

It ran as admin right, on Windows.

nobody

Signature -> Admin? How?

Anonymous

8:31 PM

So then you can just take the signature off the binary and then# on your own binary.

Anonymous

And then you get it to execute your binary via the program

forest

@J-- So what's your opinion on Windows security?

Anonymous

and because the signature matches, you get admin.

nobody

How do you put the signature on your own bin? wouldn't that invalidate the sig?

Anonymous

github.com/secretsquirrel/SigThief

nobody

8:33 PM

Ah, so the signature was never verified?

Anonymous

@forest So, it doesn't seem that great, at least, not in the user-space level. The kernel space level seems... A lot more difficult. I am still yet to figure out why we hardly see many Windows RCEs, mostly just DoS' for example. If you know, please enlighten me.

Anonymous

@nobody Yeah, that's right.

Anonymous

The software is absolutely garbage. When they're not even doing basic signature verification, you know it's horrible.

Anonymous

I mean, its 2021, there's no excuse to compile without ASLR and NX lmfao.

nobody

Why isn't ASLR and NX the default in compilers?

Anonymous

8:35 PM

It is...

nobody

Shit, so they go out of their way to reduce security

Like, just, wow

Anonymous

That's precisely the reason I decided to pick this software for one of my candidates for CVE hunting. I also checked already, no CVEs so, it's perfect.

Anonymous

@nobody Yeah, precisely..

Anonymous

Pure trash, lmfao.

forest

@J-- RCEs are uncommon for operating systems in general.

Anonymous

8:36 PM

That's a good point.

Anonymous

But in general, NX and ASLR are no where near as strong as I once thought.

Anonymous

I am yet to look at CFG. Not in the course material it doesn't seem so I'll have to read about it on my own.

forest

I think Microsoft is getting ready to make an improved version of CFG by utilizing Intel CET.

Anonymous

Oh cool, I'll have to look into that.

Anonymous

I've been reading some stuff on Rust.

Anonymous

8:39 PM

Found a MSFT article from I think 2017 saying they were moving a lot of stuff to Rust.

nobody

@J-- I wonder if bad userland security is specific to windows though.

forest

What are they moving?

@nobody Nope. Userland security sucks everywhere.

Although disabling ASLR or NX is really never acceptable...

Anonymous

From what I understand they want to move everything they can to Rust. A lot of their new projects especially were starting out with Rust from the get go. They've been using it for years, according to their blog anyways.

Anonymous

Will be interesting to see what the exploit development landscape is like for userspace in like 15 years when there's a lot more stuff on Rust.

Matthew Daniels

hi. :)

nobody

8:40 PM

@MatthewDaniels hello

Matthew Daniels

just checking around rooms.

I'm new and I want to look around, see what I can talk about.

what exactly is this information security? tech?

nobody

@MatthewDaniels Basically securing computers

forest

@J-- The real issue is when you start mixing binaries and having something half-C and half-Rust.

Matthew Daniels

ah, okay.

bye. :)

forest

The problem with that is a C vulnerability may be usable to attack the Rust code which may not have as many security features (e.g. C to cause a buffer overflow in Rust code because Rust doesn't need a whole bunch of anti-buffer overflow features since it is more or less immune).

Anonymous

8:44 PM

Hmm, that's really an interesting concept.

Anonymous

From what I understand, Rust also somewhat solves the problem of race conditions, right? As well as being very memory safe.

nobody

What happens when everything starts using Rust? We go out of business?

Anonymous

No, definitely not.

Anonymous

There's always bugs, in everything.

nobody

Well, will binex still be a thing?

Anonymous

8:45 PM

Exploit development for user-space applications will be drastically different though, I expect.

nobody

What would the exploits be based on? Just logical errors?

forest

@J-- It doesn't "solve" it, but writing concurrent code is way easier in Rust.

Anonymous

Yeah, I would assume mostly only logical errors at that point. But I don't think we need to worry about Windows itself going entirely to Rust or Linux. So we're probably fine.

Anonymous

But yeah, from what I understand, Rust solves a lot of the current userspace binex problems. Memory corruption specifically.

forest

Well I doubt Windows or Linux will be replacing their kernel with Rust any time soon.

Anonymous

8:47 PM

Yeah, exactly.

Anonymous

They won't.

Anonymous

But user space will change a lot, for sure.

Anonymous

I mean, Rust has only been around since 2011, it already has a lot of traction because of the whole memory safety thing.

Anonymous

@forest Right, makes sense.

forest

I'm hopeful that we'll be able to solve this with better compilers, but that's mostly because I'm grumpy and don't like change, and Rust has ugly syntax.

Anonymous

8:48 PM

Good thing I want to go into kernel exploitation right

forest

yeah lol

Anonymous

wont make myself redundant

Anonymous

lmfao

Anonymous

Speaking of which, I have my C book now. So I can start learning more C.

Anonymous

I noticed earlier today.

nobody

8:51 PM

I was wondering, could it be possible to make C memory safe?

Anonymous

That I can basically make ROP chains without even thinking about it anymore.

Anonymous

I was just picking gadgets seemingly out of thin air

Anonymous

without a compiler

forest

@nobody Pure C? No, but you can write code that is memory-safe.

Anonymous

and they were working.

Anonymous

8:51 PM

so thats fun.

Anonymous

@nobody As forest said, the whole idea is that you write memory-safe code. The reason for Rust even existing is so that you get most of the control of something like C but without needing to actually write memory safe code or spend time thinking about memory safe code.

Anonymous

Its a cool solution for sure.

nobody

Yeah I was wondering if a compiler that deviates from the C standard can prevent memory corruption

Anonymous

I don't known an awful lot about it. But it's on my list to read about more because it does seem super cool.

nobody

So you don't have to depend on devs for secure code (cause that's never gonna happen)

Anonymous

8:53 PM

Yeah, that's basically what Rust is.

Anonymous

I mean, there's more to it than that.

Anonymous

But at a high level, it does exactly that. By having a compiler designed for memory-safety without you needing to write the code to do that yourself.

nobody

But Rust is a different language

forest

How much Rust do you know?

@nobody Yeah, you need to change the language a lot to make it memory-safe.

nobody

You can't take existing C code and compile it as rust

forest

8:54 PM

So much so that it's a totally new language.

Anonymous

Oh none. I would like to learn though. But, I have more important things on the list for now.

Anonymous

I've just been reading about Rust the last few days because someone mentioned it to me.

forest

ah

Anonymous

Since I want to do kernel exploitation, it isn't so important to me right now. As you say, nobody is porting their kernel to Rust anytime soon.

forest

@J-- You're making me jealous. I never learned much binex. :P

Anonymous

8:56 PM

Well, now you know how I feel any time I talk to you, forest.

forest

lol

Anonymous

Although, I don't get jealous just... Fascinated.

Anonymous

You're like my information security dad lul

forest

@J-- Want to know a great way to learn kernel exploitation? Backport (forwardport?) a vulnerability from an old kernel into a new kernel, and try to attack it with the new kernel's mitigations in place. E.g. try to attack the keyctl() refcount overflow bug by porting the vulnerable code to a modern kernel with refcount protection (or better yet, a PaX kernel with PAX_REFCOUNT).

Anonymous

Got a question? Ask forest, he always knows.

Anonymous

8:58 PM

@forest Oh that's a super cool idea. That sounds like a lot of fun for sure.

Anonymous

My plan right now is, finish this course, pass this exam, learn more C, find some cool bugs, learn more about kernels, learn more about C, find some cool bugs in kernel.

Anonymous

profit?

forest

Lots of profit.

Anonymous

Heh, hopefully :D

Anonymous

Although, I don't much care about the profit anymore. I don't really need more money.

forest

8:59 PM

Also, if you want some easy kernel exploits, go after OpenBSD. :D

Anonymous

If I could trade money for knowledge, I would for sure.

forest

You can.

Anonymous

@forest Yeah, I actually have seen a lot of OpenBSD exploits any time I go on exploitdb, etc. Since I started even pen-testing I see them appear a lot.

forest

Money/resources/information or whatever.

Anonymous

@forest Heh, yes I know. That's why I bought this course.

Anonymous

9:00 PM

I wish there was someone to learn kernel exploitation in linux from though, there's no training like that.

forest

@J-- Yup, because OpenBSD's actual code is really insecure.

Anonymous

i'd like someone really well known to offer something even just... uh, one-one.

Anonymous

or whatever.

forest

@J-- Look for people who have contact with e.g. Solar Designer.

He hangs out with kernel exploit folks.

Anonymous

didnt this guy basically invent ret2libc

Anonymous

9:01 PM

and heap buffer overflows

Anonymous

im sure someone told me that once

forest

yes

Anonymous

Yeah, thought so.

forest

Back in the days when people were learning that there is more to exploitation than linear overflows.

Anonymous

Man, what a fucking awesome thing to say you did.

Anonymous

9:02 PM

That is actually AWESOME.

Anonymous

You know, I'll be very sad if I leave this world and cannot name just one thing i contributed to in a massive way

forest

If you keep up this rate of knowledge acquisition, you're certain to have a big impact.

Anonymous

thyen again this guy is likely very, very smart

Anonymous

and im a fuckin idiot.

forest

Just make sure you never sell out to government fucks.

Anonymous

9:03 PM

believe me, that is the last thing that would happen :D

forest

Good! :P

If you do want to make a real change, consider hardening the Linux slab allocator.

(I think grsec already did something recently with that with their new allocator though)

Anonymous

Man, grsec would be a SUPER cool place to work

forest

They're hiring.

Anonymous

but tis like not many people

forest

Only problem is spender and pipacs are fucking psycho bipolar.

Anonymous

9:05 PM

i doubt they d hire me.

Anonymous

i dont think they need someone still learning

Anonymous

they need someone who is like.. their level

forest

Sure, but it's something to remember for the future.

Anonymous

but they are peiople making a real difference

Anonymous

i like that a lot

Anonymous

9:06 PM

i just gotta work harder

forest

So do I. I just wish they didn't pull their patches from the public.

Anonymous

and i am pretty sure i can achieve it.

forest

All because a few companies and individuals were stealing his work.

("stealing" GPLed work)

Anonymous

yeah thats pretty annoying.

forest

So now it's quite hard to get your hands on the patches if you aren't a company.

Anonymous

9:07 PM

ima stop smoking this year i think

Anonymous

its holding me back, for sure.

forest

What do you smoke?

damn didn't see it in time

oh well

ah

Anonymous

yeah, but its a waste of time,.

Anonymous

the thing is, its the only time i spend with my girlfriend in an entire week.

Anonymous

which is why i still smoke at all. but we can find something else to do, so its whatever.

forest

9:09 PM

Huh, tried hardened_malloc on a Debian system. Overhead is quite high.

I wonder how much of that is just initialization overhead.

Anonymous

speaking of C i found a good blog series on building an OS.

Anonymous

ito go along with osdev obviously.

forest

oh?

Anonymous

let me try find it, it seemed very detailed which is nice.

Anonymous

oh no, my mistake. wasn't an OS. it was building a kernel.

forest

9:11 PM

Well building a kernel is an important part in building an OS.

Anonymous

well, yeah :d

forest

The early kernel code (stuff that executes as you transition to long mode) is the majority of it.

Once you do that, all you have left is resource management, schedulers, etc.

Anonymous

damn, can't find it right now. but it seemed pretty good.

Anonymous

i also found this

Anonymous

danluu.com/malloc-tutorial

forest

9:12 PM

Eh, not a fan of that.

Anonymous

which seems pretty interesting. and then he links a better version by a professor that has more detail

forest

Musl is neat and all, but its not as secure as they claim.

Maybe they're getting better, but last I checked, even glibc was more secure overall.

And security suggestions I've provided (and others have provided) were brushed off.

Anonymous

So, probably a stupid question but: what is the difference?

Anonymous

How they actually handle the memory, correct?

forest

Well there's a number of differences. For example, glibc has setjmp cookie mangling, musl does not. Glibc has a slightly better malloc (ptmalloc, which still isn't good) vs musl's dlmalloc.

And musl does some things that irritate me like making dlclose() a no-op.

But it is a very lightweight libc and it's a great base for making a hardened libc...

Anonymous

9:15 PM

Right.

forest

Trying to mess with glibc on the other hand is a nightmare. It feels like you have to pass through a hundred functions just to find the actual code that executes the real syscall.

Oh that reminds me. Another thing you can do if you really want to make a change is to work with something like Tor Project, since they need secure code.

Anonymous

Yeah that's a really good point! I always thought about something like that.

Anonymous

I'd just need to become much more proficient in C which I am working on.

Anonymous

Since I am mostly fine with the binex side now. I can do most of the user space stuff effortlessly.

Anonymous

But my knowledge of reading C and knowing why something is wrong is almost non-existent.

Anonymous

9:18 PM

Mostly because i've never written much C. I'm a pen-tester after all...

forest

Can you do the userspace stuff even with hardening and mitigations in place?

Anonymous

Yeah ASLR and NX bypass (on Windows at least) is easy,.

Anonymous

The one skill I need to enhance is actually finding the bugs.

Anonymous

So RE...

forest

Not necessarily RE. You can find bugs by reading source code as well.

But you do need to get proficient with gdb or at least r2.

Anonymous

9:19 PM

Yeah, or that.

Anonymous

So, the actual exploitation, I am fine with.

Anonymous

But the skill I am lacking is the actual finding of the bugs to begin with.

Anonymous

Which this course has a section on, and a massive RE challenge, which is what I am going to work on after I finish these format string challenges.

Anonymous

There's a binary with 15 exploits to find as one of the challenges.

forest

Just don't get sucked into IDA Pro.

Anonymous

9:21 PM

After I finish the format strings stuff, that's what I am going to work on because I need to improve my RE a lot.

forest

Use Ghidra or w/e its name is if r2 is not enough.

Anonymous

I quite like IDA. Never used Ghidra much and never used R2 at all.

Anonymous

For this exam I have to use IDA. But I know R2 is very popular. I'll for sure have to learn how to use it.

forest

IDA is one of those programs that is closed source and forces you to pay out the ass to use it.

That's probably why the exam wants you to use it.

Anonymous

Yeah, luckily you don't need Pro for x86.

forest

9:22 PM

And they try very hard to track people who "leak" it.

The non-pro version is not nearly as powerful as the full version.

But from what I know, Ghidra is about as powerful, despite its... unsavory origin.

Anonymous

Yeah, I know. But you're not allowed to use Pro for the exam anyways.

Anonymous

Home only.

Anonymous

SO it's okay.

Anonymous

But yeah, a lot people talk about R2, I gotta' learn how to use it.

forest

I pretty much only use gdb and objdump lol

Anonymous

9:24 PM

Yeah, I'll be using those a lot more when I port these windows binex skills to linux binex :D

forest

Linux default security is awful. If you want an easy distro to exploit, try Debian.

Old software that only backports sec fixes when someone screams loud enough, minimal compile-time hardening flags, kernel with truly ancient compatibility configs.

Anonymous

I have been tracking the hours I spend studying since last week, and since last Monday, I've spent 200ish hours studying.

Anonymous

Which I actually think I could spend more time working.

Anonymous

I am just lazy sometimes.

forest

It's an investment.

Anonymous

9:27 PM

Oh for sure.

Anonymous

I'd happily work more hours. I don't really have anything better to do.

Anonymous

I have been sleeping more than usual lately though.

Anonymous

Which is fine, I guess. I feel a lot less fucked up all the time that's for sure.

Anonymous

Most days I felt like I was shot.

nobody

@J-- How did you fit 200 hours in one week?

Anonymous

9:28 PM

SOrry, monday before *

Anonymous

26th.

Anonymous

i forgot its sunday.

Anonymous

not last monday lul

forest

@nobody He spawned another thread. Duh!

Anonymous

im currently dreaming in rop chains

Anonymous

9:29 PM

so dates and times aren't really real

nobody

lol

I've probably only spent 200 hours studying in my whole life

Anonymous

heh.

nobody

I think I'll just give up right now. At this rate, I'll never do anything

Anonymous

i dont even wish to know how much ive spent

Anonymous

i wasted 12,000 hours+ on CS

Anonymous

9:30 PM

so you can catch up.

Anonymous

imagine if i spent that on learning...

Anonymous

wow.

forest

O_O

Anonymous

In all fairness, I did used to play CS for money. It wasn't a total waste of time.

nobody

@J-- It doesn't matter what you wasted

Anonymous

9:32 PM

Not a lot of money, but a decent amount.

nobody

All that matters is the time you used

I wasted practically my whole life

Anonymous

Most of my friends I played CS with are now playing full-time pro in various games, which makes me sadge sometimes.

Anonymous

But I was never good enough so I got a CCNA instead

Anonymous

lul

Anonymous

@nobody just do what i do and guzzel study drugs

Anonymous

9:35 PM

:)

Anonymous

most days i take 400mg of modafinil

Anonymous

it makes you feel like you're gonna invent facebook

Anonymous

its quite hard to be unproductive on those actually

nobody

I'm scared of all sorts of drugs

forest

Drugs are good, mmkay.

Anonymous

9:37 PM

Fair enough. Modafinil are prescription though.

Anonymous

They're pretty common here. They don't like giving out Adderall or Ritalin to ADHD people so they give them Modafinil instead.

forest

Why?

nobody

Yeah, buts its like I no longer control my brain, the drugs do. I lose my free will

Anonymous

@forest I honestly have no idea. Probably because the UK has a huge drug problem and they really do not want people to resell them. The whole resale thing is the same reason they don't give out codeine much in the UK... Also because Adderall and Ritalin are really expensive in comparison to Modafinil which costs about £0.03p per tablet from India.

forest

@nobody Nitpick but you don't have free will in the first place!

But the thing is, drugs modify your cognitive processes .They don't "control" you.

nobody

9:40 PM

@forest Right, I lose my perceived free will :)

Anonymous

Yeah, Modafinil especially is designed to increase cognitive function, alertfulness and wakefulness which also aids with focus and restlessness.

Anonymous

But fair enough. I am not about to become a drug pusher. They just help me a lot.

forest

@J-- I've read that it doesn't really work as a nootropic for most people. It just increases attention span.

Anonymous

@forest Yeah there's a lot of mixed information about whether it actually does work as a nootropic.

nobody

@forest I'm installing a closed source patch. How do I trust its not backdoored? :)

Anonymous

9:41 PM

I think for the most part, you're right. It just seems to increase your attention span. But there's a lot of conflicting studies.

forest

@nobody A closed source patch to a closed source brain. :P

Anonymous

Everythings backdoored, duh.

nobody

The brain's source wasn't developed by humans though. Nature isn't in my threat model

Anonymous

Anyways, I am going to get an early night for once.

forest

But the brain doesn't have NX. All the data you receive from the environment is treated as code.

Anonymous

9:43 PM

Goodnight.

Anonymous

@forest heh.

forest

g'night @J--

Anonymous

time to go dream in rop chains.

Anonymous

:D

forest

(And our lack of NX is why we're susceptible to advertisements)

@J-- Sleep tight. Don't like the CFI bite.

Anonymous

9:44 PM

hehe :D

nobody

@forest Most of the data I receive is just forwarded to /dev/null. But yeah, the data that escapes it isn't NX'ed

forest

It may be that paranoia is evolution's first attempt at implementing NX.

nobody

Its a pretty poor implementation, since the performance costs are usually quite significant

forest

I dunno. I think the problem is that our brains don't use the harvard architecture. It's difficult to avoid rogue data execution when the system is designed with executable data in mind.

Our brains are basically big, ugly JIT compilers. Good luck getting NX working well on that.

nobody

10:09 PM

3

Q: Should I build my own login functionality?

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and Auth0. But as easy as it is to get started, they all lock you in, make you reliant on their solu...

This question doesn't look opinion based to me. It may suffer from some of the problems Steffan lists but it seems salvageable to me.

forest

Certainly salvageable.

But instead of "should I build it", it should be "what are the security implications of building it".

Transcript for