https://ardemium.nl/posts/ Recent content in Posts on Ardemium Hugo -- gohugo.io en Sun, 03 Nov 2024 09:00:00 +0000 https://ardemium.nl/posts/htb/permx/user/ Sun, 03 Nov 2024 09:00:00 +0000 https://ardemium.nl/posts/htb/permx/user/ Table of Contents Link to heading Table of Contents Reconnaissance T1595.002 - Active Scanning: Vulnerability Scanning Initial Reconnaissance with nmap T1596.004 - Search Open Websites/Domains Subdomain Enumeration with ffuf Initial Access T1190 - Exploit Public-Facing Application Exploit: CVE-2023-4220 Credential Access T1552.001 - Credentials in Files Accessing Configuration Files for Credentials Lateral Movement T1021.001 - Remote Services: SSH SSH Access with Recovered Credentials Conclusion Reconnaissance Link to heading T1595.002 - Active Scanning: Vulnerability Scanning Link to heading Initial Reconnaissance with nmap Link to heading Objective: Discover active services and versions running on the target. https://ardemium.nl/posts/inside_job/ Fri, 01 Nov 2024 00:00:00 +0000 https://ardemium.nl/posts/inside_job/ Case Link to heading Megacorp, a very large company, has recently acquired several SMEs (Small and Medium-sized Enterprises). Being highly risk-averse and serious about their security posture, Megacorp is conducting multiple simultaneous security assessments. Case Task Overview Rules of Engagement Lab Environment Setup Lab Session Guidelines Reconnaissance Initial Enumeration of the Environment User Enumeration Group Enumeration Privilege Information Identifying Non-Default Applications Network Reconnaissance “Using Angry IP Scanner” Identifying Potential Third-Party Services Through the UI Through CMD Scheduled Tasks in “Tasks Migrated” Folder Resource Development Get Sysinternals Suite Privilege Escalation RemoteMouseService (CVE-2021-35448) Unquoted Service Path Insecure Registry Service (Optional) Running ModifyServiceImagePath util File Permission Service DLL Hijack Service DACL Service Scheduled Tasks (pinger) Verify Local Admin Access Defense Evasion Folder Exclusion in Windows Defender UI Folder Exclusion in Windows Defender PowerShell Folder Exclusion in Windows Defender PowerShell through CMD Lateral Movement Get Mimikatz Using Pass-the-Hash (PTH) Attack Transferring Tools Extract the Domain Admin NTLM Hash Use Pass-the-Hash to Access the Domain Controller Dump All Hashes from Active Directory Task Overview Link to heading Your assignment is to assess the insider threat scenario through a red-team exercise. https://ardemium.nl/posts/ctf/2024/crewctf/4es/ Sun, 04 Aug 2024 18:13:31 +0000 https://ardemium.nl/posts/ctf/2024/crewctf/4es/ Difficulty Level: Easy Introduction Link to heading The meet-in-the-middle attack is a powerful cryptanalytic technique used to break encryption schemes by exploiting the structure of multiple encryption layers. This attack is particularly effective when both the plaintext and its corresponding ciphertext are known. In this write-up, we will demonstrate how the meet-in-the-middle attack can be used to break a 4-layer AES encryption scheme encountered in CrewCTF 2024. The victim encryptor script encrypts a plaintext using four layers of AES encryption, each with a different key derived from 3-byte values. https://ardemium.nl/posts/ctf/2024/imaginaryctf/bf/ Mon, 29 Jul 2024 13:08:43 +0000 https://ardemium.nl/posts/ctf/2024/imaginaryctf/bf/ Difficulty Level: Medium URL: https://github.com/ImaginaryCTF/ImaginaryCTF-2024-Challenges-Public/tree/main/Reversing/bf ImaginaryCTF 2024 is a cybersecurity competition that took place from July 19 to July 21. Participants tackled various challenges in areas such as cryptography, web exploitation, forensics, and reversing. Reversing Challenge: BF (100 points) Link to heading Challenge Author: NoobMaster Description: Simple equations… but in BF?!!! Solves: 225 Participants were provided with a Brainfuck (BF) program in bf.txt. Brainfuck is a minimalistic and esoteric programming language known for its simplicity and difficulty. https://ardemium.nl/posts/ctf/2024/hitcon/postevent/ Sun, 14 Jul 2024 15:00:00 +0000 https://ardemium.nl/posts/ctf/2024/hitcon/postevent/ The HITCON Capture the Flag (CTF) 2024 just ended, leaving everyone amazed by the difficulty of the challenges in the 48-hour contest. From July 12th to July 14th, participants faced some of the toughest problems in cybersecurity. Here’s a look at what happened. Event Overview Link to heading Qualifiers Link to heading The HITCON CTF Qualifiers used a Jeopardy-style format. Teams solved different cybersecurity challenges to earn points. The event lasted 48 hours straight, with teams racing to get to the top of the leaderboard. https://ardemium.nl/posts/ctf/2024/downunderctf/parrot-the-emu/ Tue, 09 Jul 2024 18:00:00 +0000 https://ardemium.nl/posts/ctf/2024/downunderctf/parrot-the-emu/ Difficulty Level: Beginner URL: https://github.com/DownUnderCTF/Challenges_2024_Public/tree/main/beginner/parrot-the-emu Introduction Link to heading Server-Side Template Injection (SSTI) is a powerful vulnerability that can lead to severe security issues, including data leakage, remote code execution, and full server compromise. This write-up covers the exploitation of SSTI in a Flask application from DownUnderCTF 2024. Initial Analysis Link to heading Application Structure Link to heading The challenge provided a Flask web application with the following structure: https://ardemium.nl/posts/ctf/2024/downunderctf/number-mashing/ Mon, 08 Jul 2024 18:00:00 +0000 https://ardemium.nl/posts/ctf/2024/downunderctf/number-mashing/ Difficulty Level: Beginner URL: https://github.com/DownUnderCTF/Challenges_2024_Public/tree/main/beginner/number-mashing SHA-256 Hash: f8b5c95e4b9d876abe0e6ca63467ceae84371740296f194cde106257bd62a92a Introduction Link to heading Number Mashing introduces an ARM binary with a Signed/Unsigned Mismatch vulnerability. The binary performs several checks on user inputs before attempting to read a file named “flag.txt”. By bypassing these checks, we can manipulate the program’s logic to read the file and retrieve the flag. Tools Used Link to heading gdb - The GNU Debugger peda-arm - Python Exploit Development Assistance for GDB Ghidra - A software reverse engineering (SRE) suite of tools developed by NSA’s Research Directorate Initial Analysis Link to heading Binary File Information Link to heading First, we check the file type of the binary to understand its properties. https://ardemium.nl/posts/ctf/2024/downunderctf/postevent/ Sun, 07 Jul 2024 09:53:19 +0000 https://ardemium.nl/posts/ctf/2024/downunderctf/postevent/ I’m super excited to share my experience from DownUnderCTF 2024. This was my first Capture the Flag (CTF) event, and I loved it! The event was well-organized, and the beginner challenges were just right in terms of difficulty, making it a fantastic learning experience. What is DownUnderCTF? Link to heading DownUnderCTF is a world-wide Capture The Flag (CTF) competition targeted at Australian and New Zealand secondary and tertiary students. It started as a collaboration between 13 University Cyber Security societies around Australia and has now expanded to include participants from New Zealand. https://ardemium.nl/posts/exploit_education/protostar/stack0/ Sun, 30 Jun 2024 09:53:19 +0000 https://ardemium.nl/posts/exploit_education/protostar/stack0/ Difficulty Level: Easy URL: https://exploit.education/protostar/stack-zero/ SHA-256 Hash: 2af291876fa650172f02b2a85699a10f29f7d3cf325bb70183d4e06e1dacc157 Introduction Link to heading Protostar Stack Zero is a basic buffer overflow challenge designed to teach the fundamentals of stack-based exploitation. The goal is to modify a specific variable by overflowing the buffer. This level introduces the concept of accessing memory outside its allocated region, understanding stack variable layout, and how modifying memory outside the allocated region can affect program execution.