Archive for category /dev/urandom

Defying Analysis With Sparse Malware

If you’re writing tools for red teaming or pentesting, the main point of your backdoors, or implants as people are starting to call them, is to enable remote control of a system without being detected. If that fails, and your backdoor is found, the next best option is to avoid analysis so any of your […]

No Comments

Installing Linux on a Live Windows System

As you may know, I run the Red Team for the Collegiate Cyber Defense Competition (CCDC) in the southwest region. One of the more interesting things I put together for the regional competitions this year was a way to install Linux remotely over a command-line interface (such as meterpreter). I actually originally wrote it for […]

4 Comments

Adding Easy SSL Client Authentication To Any Webapp

Let’s face it, if you are using passwords on your web site or application, you are part of the problem. It doesn’t matter if you’re using bcrypt or scrypt, or all the salt in the world, you’re still perpetuating these 11 password problems and pains. But client certificate authentication and even issuance is actually easy with modern browsers. Want to see how easy it can be? Check out the example below.

, , , , , , , , , , ,

27 Comments

The Infosec Revival – DerbyCon 2013

DerbyCon this year was awesome as usual. I presented “The Infosec Revival: Why owning a typical network is so easy, and how to build a secure one.” The video is here on Youtube: Or you can check out the slides here: The RDP video is here: And the VM isolation video is here: I should […]

, , , ,

2 Comments

Secure random password generation

Ideally you never use a password, but sometimes, you have to anyway. One very common scenario is in signing up for a web application. Such passwords can be stored on the server, hashed with a fast algorithm such as MD5, and over which you have no control. You do not want your password to be […]

1 Comment

Economics in One Lesson

This is off the security topic, but I was really excited to find this online, so deal with it. Everyone who votes needs to understand this. We have all heard the fallacies before, and it’s hard not to disagree. When people need jobs, why can’t the government create jobs with public works projects? Don’t all […]

1 Comment

Authenticated Remote Code Execution Methods in Windows

All of the below are supported ways of remotely executing code that are built-in to Windows. If psexec isn’t working since a service is not running or ports are blocked, you can try all these other options; defenders who want to detect intruders moving through the network need to detect all of these; incident responders might want to look for evidence of these…

, , , ,

3 Comments

Running Code From A Non-Elevated Account At Any Time

You may have found yourself in a situation where you have access to a system through a limited user account, or could not or did not want to bypass UAC (AlwaysOn setting for example) and you needed to continue running code even when the account logged off and/or the system rebooted (and even if you […]

, , ,

3 Comments

Attack Test

Well, the Mayan Apocalypse came and went, and since we’re all still here, it’s time to get back to computer security. It shouldn’t be a surprise that the most likely way you’ll get exploited is through your browser, so you should routinely check for vulnerabilities there. I was inspired by some of the free browser […]

No Comments

Vulnerable systems setup

I frequently get asked how to set up a test lab to practice hacking on… So I looked through some release timelines and oldversion.com postings to figure out which versions of your favorite browser, plugins, and PDF reader would be installed if you had up-to-date versions of each on January 1st of the past three years, and where you can get them from. Enjoy.

No Comments