Posts

  • 35C3 CTF Writeups

    CCL logo

    This weekend was held the 35th Chaos Communication Congress (35C3) as long as its excellent CTF. Hopefully, a Junior CTF was also proposed, which was way more accessible than the main CTF (at least for me :wink:). In this post, you’ll find concise writeups of most of the challenges my team and I solved from both CTFs.

    Read more
  • Upgrading to a fully interactive reverse shell

    Let’s say you’re in the middle of a hacking challenge or pentesting assessment and you finally manage to get a reverse shell on your target. This short article will explain you how to obtain a fully interactive version of your reverse shell, that will allow commands like su, vi, nano, ssh, etc… but also CTRL+C and tab completion.

    Read more
  • HackTheBox: Hawk writeup

    Hawk has been retired from HackTheBox active machines so here is my writeup explaining how I rooted this machine.

    Hawk box

    In this article, we will crack a salted OpenSSL encrypted file, upload a reverse shell to an instance of Drupal 7 CMS. Then, we will use a SSH port-forwarding trick to access a H2 database console disallowing remote connections and exploit this app to get root on the machine. Enjoy your reading!

    Read more
  • Linux Privilege Escalation: Abusing shared libraries

    Linux applications often use dynamically linked shared object libraries. These libraries allow code flexibility but they have their drawbacks… In this article, we will study the weaknesses of shared libraries and how to exploit them in many different ways. Each exploit will be illustrated by a concrete example, which should make you understand how to reproduce it. I’ll give recommendations on how to protect your system against it in the final part of the article.

    Read more
  • HackTheBox: Bounty writeup - Metasploit basics

    Hack The Box is an online platform that allows you to test your pentesting skills on virtual machines intentionally left vulnerable. It is a great place to learn and the community is very helpful so I warmly recommend you to check this site out.

    Bounty box

    This machine was pretty easy so I’m going to take this opportunity to explain you the basics of the Metasploit framework.

    Read more
  • HackTheBox: DevOops writeup

    Hack The Box is an online platform that allows you to test your pentesting skills on virtual machines intentionally left vulnerable. It is a great place to learn and the community is very helpful so I warmly recommend you to check this site out.

    DevOops box

    In this article, I’ll detail every step I’ve gone through in order to root the DevOops box, from the reconnaissance phase to the privilege escalation.

    Read more
  • Steganography Tutorial: Least Significant Bit (LSB)

    This article details a common steganography method known as the Least Significant Bit. This technique is very efficient because of its simplicity and its ability to be undetectable to the naked eye. After reading this, you’ll be able to hide a message inside a picture using this technique, but also to detect any dissimulated message.

    Read more
  • Basic Steganography: Vous n'avez pas les bases - NDH16

    A steganographic challenge showing the essential tools for PNG analysis and manipulating encoding bases.

    Read more
  • XML External Entities: Wonkachall-step1 - NDH16

    This challenge covers one of the most efficient and popular attack against web servers. It is also the first of a series of 6 challenges from the NDH16 public CTF.

    Read more
  • Data exfiltration with PING: ICMP - NDH16

    An interesting forensic challenge covering a famous method of data exfiltration…

    Read more
  • PCAPNG Forensics: Decode - NDH16

    A warm-up forensic challenge proposed by NDH16…

    Read more
  • A very fine cipher: Warmup - AngstromCTF

    Here comes the first Cryptographic challenge! We’ll start with an easy one but nonetheless useful. We will establish the mathematical foundations needed for understanding more complicated codes such as RSA…

    Read more
  • Introduction to Buffer Overflows: CookieJar - AngstromCTF

    For my first article on this blog, I’ll present you my write-up of “CookieJar” from the AngstromCTF. This challenge was accessible and very straight-forward, which constitutes the prefect opportunity to introduce Buffer Overflows

    Read more

subscribe via RSS