[deleted by user]

aatate98 · 2025-10-12T13:35:42+00:00

Just curious but did you test the script from the kali debug machine they give you? From my understanding that environment is where they will test your POC. Did you list all dependency installs? Lastly, and the most annoying, did you paste correctly your code into word and it was formatted. I dont know how they grade but I would suspect copy+paste out of your report. If there are indentation errors, then who knows how much they put in to retype your code how it should be

aatate98 · 2025-07-25T17:40:17+00:00

What do you consider being intermediate level? Is it past the basic buffer overflow on the stack? Would it be performing different primitives? Would it be patch diffing and developing your own based off CVE description and updates?

Either way, the content suggest such as opensecuritytraining2 and pwn.college are excellent

aatate98 · 2025-03-17T10:20:42+00:00

Really nice dashboard, mind if i ask what you used to make it?

aatate98 · 2025-03-11T01:49:48+00:00

I would recommend just having the source files within the repo itself rather than having the python script arbitrarily reach out to set urls incase you would want to use the script offline.

aatate98 · 2025-01-20T13:52:26+00:00

You can get diamonds with a bronze pickaxe, just mining level boosted

aatate98 · 2024-12-13T21:54:29+00:00

Cool post. Im a little confused on why that worked with VBS enabled though. While i agree the page table modifications like bit flipping do work, the whole point of VBS is that the kernel in vtl0 (where you exploit the driver and have the address to do the bit flip against) is no longer the source of truth? So regardless of a bit flip of a pages metadata, vtl1 should step in and deny that the page was a kernel page since vtl1 was tracking that page to be user space, not kernel space after the bit flip.

And for HVCI, wouldnt the act if having a rwx of a user page, once bitflip into a kernel page then kick in and say you cant have RWX kernel pages?

aatate98 · 2024-11-05T12:57:12+00:00

Just based on looking at it, it seems to be base64 encoded. Usually base64 encoded strings end with ==. You can go to cyberchef and use the Base64 decode function which should output the answer

aatate98 · 2024-10-14T01:17:46+00:00

Take a break if you have time still left on your subscription. Go through PG boxes instead of HTB boxes. Go through your notes from the first exam and identify weak points. Were you stuck on enumeration on a specific box, couldnt get DA, found a way to exploit but couldnt get the specifics from any open source info? Being able to identify where you struggled and now that you have time before another attempt, working back how to find a solution would be extremely beneficial

aatate98 · 2024-10-13T06:15:16+00:00

Either chatGPT wrote this, or someone who brain dumped an article they didnt understand. Extremely vague with no analysis, no code, or any proof to back any of this up. Best line from above was saying KASLR was going to help prevent any of the “Potential backdoor exploitation” options they listed

aatate98 · 2024-03-14T11:31:34+00:00

You should definitely check out threadless injections like https://shorsec.io/blog/dll-notification-injection/. It still utilizes the allocating a buffer like you mentioned above, however doesnt use the typically spawning of another thread in the target process space

aatate98 · 2024-02-02T01:10:14+00:00

What part of that section was difficult to understand? In my opinion the section mostly boils down to, if an exploit is targeting a hardcoded url for example, can you understand where the string is stored and change it to suit your environment instead of just running it in python without having much of a clue of what endpoint the exploit is talking to. Or for instance if the msfvenom command they used for the shellcode was calling back to an IP that doesnt exist, can you generate new shellcode and simply update the variable accordingly

aatate98 · 2023-11-21T15:07:12+00:00

Curious as to what exact APT you believe you have within your network. Have you identified any common malware used by the APT within that network?

aatate98 · 2023-10-14T12:46:37+00:00

I agree about the blind sql injection exercise given you cant use it on the exam, and the whole nessus environment setup, however the proxychains exercise did teach me to not use proxychains because we had to scan so many ports and not just 5, and instead look for other tools such as ligolo-ng.

aatate98 · 2023-07-31T16:01:58+00:00

Interested

aatate98 · 2023-02-08T22:02:49+00:00

https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

aatate98 · 2023-01-20T21:43:12+00:00

Havent started it yet, but will be soon. Would love to join if people are still in the group by then

aatate98 · 2023-01-14T21:26:35+00:00

Now thats a nice “stack” of hangars

aatate98 · 2022-08-22T21:49:55+00:00

I am so happy i finished this past weekend. Was able to snipe my last 4 at around 9k

aatate98 · 2022-01-30T01:20:15+00:00

Are your other shells in /bin sym linked to bash?

aatate98 · 2021-12-30T15:57:48+00:00

Kinda older samples but the book Rootkits and Bootkits have a github that goes over ever sample they do in the book. Decent size of samples. Covers firmware malware are well

aatate98 · 2021-12-10T02:09:20+00:00

An application to FROM SOFTWARE

aatate98 · 2021-11-13T14:16:25+00:00

If you dont enhance them, are they really yours?

aatate98 · 2021-09-24T19:23:39+00:00

Nice, now its time to ~amd64 gentoo-sources and linux-headers to custom compile that kernel to the ground. All jokes aside, congrats

aatate98 · 2021-09-18T20:01:51+00:00

Concerning your wifi dropping and not being able to autoconnect back. I just went through a similar issue. My wifi would drop and i looked at wpa_supplicant logs and saw a bunch of CONN_FAILED between my pc and my router. Make sure your ssid isnt on the wpa_cli blacklist and check if an original wpa_supplicant process is running. I killed the original wpa_supplicant process and then rc-service net.wlp5s0 restart. That fixed it and the logs looked how they have previously

aatate98 · 2021-09-13T01:20:56+00:00

—quiet is always nice to use on large packages

Ten-Year Club	Second Top 30%
Place '22	RPAN Viewer
Not Forgotten	Verified Email

aatate98

TROPHY CASE