Captain’s Log: July 2020

Leave a reply

The Good

  • 10k steps rolling on every single day – I have worked in a few jogs a week this month to get the heart rate elevated more regularly. It comes with the obvious benefits for doing so. My resting heart rate has gone down around 6 BPM which isn’t to be sniffed at.
  • Calorie Calculator – I know what helps me to lose weight. My level of activity has been fine but really the key is to stop ingress of breaded or cakey items. In lockdown my cupboards suddenly got flooded with tonnes of food because the uncertainty of delivery slots made us guess what was needed for a week+ at a time. In the general meh mod alcohol went up, food went in, and the natural impact was weight gain. For the last week of July I went back to tracking calories. A process I find so dull it unilaterally stops me snacking.
  • Bid on houses – I have always wanted a house with a garden. I was not fortunate enough to grow up with that and it is something I clearly aspire to. Lockdown certainly made me not want to wait anymore so co-incidentally when the market opened in Scotland again I went to view a property. I bid on it but it went for silly money beyond the valuation (50k or so more). The positives are that we got familiar with the process, someone came and valued our place, and I spent a long weekend cleaning and now love my flat more.
  • DIY in the flat – With a house move unlikely it means I get to focus on the flat some more. I hung some blinds in the kitchen which stops the massive stream of sunlight in the morning taking the sting of the sun out. We have also sought some quotes to finally tackle the horrible part of our flat – the central heating plumbing. Since we will be here for a few more years most likely I don’t want to go into another winter with the kids bedroom being cold. Also finally being able to decorate after this would be amazing.
  • Reading/Audiobooks #1 – I completed White Fragility by Robin DiAngelo over many morning walks in June and early July. The biggest revelation to me was how we allow “racist” to be so narrowly defined. It is conflated to mean “is a bad person” and to mean discrete individual acts of hatred which are both intentional and overt. Really we can deal with those incidents as being perpetrated by assholes. We pat ourselves our backs for not being those guys. While remaining oblivious to the underlying societal problems. Thought provoking read. Well worth an audible credit.
  • Reading/Audiobooks #2 – Several people have recommended the subtle art of not giving a fuck by Mark Manson. It is entertainingly written. It however feels like “bro” science and thus far seems pretty obvious to me. Don’t care about the things you cannot change. Pick your battles. Rather than saying anything new it appears to be a love note to tell you to not bother with any self improvement techniques at all. But look at me. Accusing something of merely being snide by being snide. It has helped more people than I could ever hope to. There has been some bits encouraging me to think about some of my choices. Not an absolute train wreck, but I was not bowled over.
  • Reading/Audiobooks #3 – Randevous with Rama by Arthur C Clarke. A legend of a friend of mine recommended it. I have been entirely captivated by this and it represents a triumphant first fiction book of 2020.
  • Gaming – I completed the Last of Us Part II. It is hard to say you “enjoyed” it unequivocally. Because I think if you are doing it right this game is toying with you the player. The narrative arc has a few fixed set points where you MUST behave in a certain way. In an otherwise open world you simply MUST do some questionable things to proceed. They are not glorified though they are horrific. To survive the post apocalypse you have to develop emotional calluses which first means taking a few bruises. THIS IS AMAZING. Any thrill for vengeance was totally and absolutely wrung out of me before the final act.
  • Gaming #2 – I fired up the original XCOM game from way back in 1994. This game has captivated me most summers since 1994 and I give it a play through in a couple of evenings. It is an absolute classic.
  • Work – A customer project saw me do an architecture review. I really enjoyed it. It has been a while but I was just in love with the full adoption of Devops/Secops/Psyclopses/Containers etc. So many of the tools and technologies required to make something which starts secure are free and relatively easy to use. What a time to be alive?
  • Music – I ordered a new practice amp from Positive Grid before lockdown. It took 4 months to arrive. The product has been fun and I have not had more than an hour to play with it. I can easily see how this would help me improve my playing by giving me automatic backing tracks to learn to solo over. I have put the day back but now it may be the time to learn scales instead of the “by feel” approach I have. Humans implicitly hear the bum notes. So you can cobble together what sounds right without formality. Just eventually I guess I should grow up and learn the instrument!
  • Music #2 – as a satire on the need to run Doom on any device or it hasn’t been “hacked” I did this moments after getting it out the box :D. The tone is a default one on the amp I don’t think I used the app to get that. It makes some gorgeous tones.

The Bad

End of July blues. While the month was running along very positively it hit Thursday 30th and suddenly I was just completely “meh” about life. I didn’t get to sleep on time on Wednesday finally getting about 4h30m sleep according to my tracker. Add into the mix that I was calorie counting and it is probably just a huge energy dip.

I am not overly concerned since a day of being depressed when you are better at recognising why is probably a sign of progress.

Highlight of the month

Whatever THIS is!

https://www.youtube.com/watch?v=qVtWENXnar8

Did you know that Dr Who has no officially been back in production longer than it was taken off air? The tipping point was July 2020. The Glasgow Dr Who meetup group were looking to celebrate that fact socially distanced so I knocked that monster out in a wonderful 30 minutes or so. Fun but it was way pasta my bedtime to do it.

Overall July was a blast.

Captain’s Log: June 2020

Leave a reply

The Good

  • Moving about – 10k steps achieved again! Every day since Christmas eve 2019. Some days it has been exceptionally difficult. Still.. Clinging on to this one achievement belligerently. I did do a few mornings of light jogging to improve the heart rate zoning so probably better than last month. Otherwise the quality of the movement is pretty low.
  • Content – A blog post! – Like an actual one about technical stuff that is hopefully useful. Mainly about development but shows some of the impact of a pentest report landing and making wild claims about how simple it is to just patch things. I like to try and replicate responding to a report. It helps me make better recommendations which have a dash of empathy when I know it is going to be an absolute pain to implement.
  • Decorating – bought a new TV stand, threw out a tonne of things and made the living room look infinity nicer. Much better for the psyche looking at nice clean walls. Lockdown seems to have prevented me buying accessories for trunking I am looking at. So I will have to wait to finish the basic human level of decoration I want. But as I said infinitely better. Following a philosophy of doing one thing a weekend at the moment.
  • Gaming – Completed Uncharted 4 – Obviously an excellent title. Discovered that there was Uncharted: The Lost Legacy for extra stories which I am working on now. Also a great game. Last of us Part II came in and I am absolutely loving it so far. 5 hours in I realised the last 5 games I have played have all been NaughtyDog. They seem to be cornering the single player story genre.
  • Security Research – I worked for several days on my tools RDPUpload and RDPDownload with the blessing of my employer. Both came out of projects I have worked on but I took the time to formalise them and put them in a blog post. If you see the highlight of the month you can also see I pushed myself to publish it perhaps a bit earlier than they were ready. The official work blog and tool release hasn’t happened yet though.

The Bad

Panic attack. First one since early February. Despite everything that has been going on in the world I have remained amazingly unfazed. It goes on to prove that my particular problem is a lack of sleep. After the kids stopped going to bed before 10pm for a solid couple of weeks I had a sudden panic attack at 2am and couldn’t get to sleep. It had less of an impact than previous bouts, but I was still knackered for a day or two after.

Result: Going to bed for a few nights in a row when the kids did instead of sitting up to get some adult media content time. Not the wholesale changes to lifestyle I was managing at the start of the year. But I have definitely let all the things I was doing go during lockdown.

Highlight of the month

Talking to the beautiful people at Abertay Hacksoc. I had been doing research and making tools to release a blog post for work. When asked to speak to the students on the Monday I said “lets do it!”. It led to a panicked two days trying to make some content and a practical demo. Here is part of the talk via a tweet:

It is so weird presenting via Zoom being unable to gauge reactions. I do hope that this bit raised some smiles though. The full talk went out here:

This is the end of the captain’s log for June 2020.

Upgrading an old Netbeans Project to use maven

1 Reply

In this blog post I discuss how I migrated an old Netbeans project (Specifically ReportCompiler) to retrofit Maven and to integrate OWASP’s dependency check into the build process.

You can get ReportCompiler:

What is the target?

I made ReportCompiler a long time ago (long enough that Java was a sane choice). It is in no way complete and has adorable missing or half implemented thoughts throughout it.

It will import “.nessus” XML files and various other vulnerability scanners too. I use it mostly as a Nessus viewer since my gripes with the UI experience in browser are legion. I have a love affair with it in particular though because it has saved me an unbelievable amount of time over the years even accounting for the initial intense development time.

I do not use it every day like I used to and so the project is only lightly supported by me.

Getting up and running

  • Open up netbeans (I originally designed the GUI in this so it kind of needs to be netbeans unless another GUI editor works just as well?).
  • Create a new “maven” project.
  • Copy the source code from your previous project into the source folder.
  • Deal with any package renaming because of this movement. They will be highlighted in red at the top of every class file.
  • Check import statements for warnings. Each underline here points to a dependency we will need to include using maven now.
  • For each import error copy the package name for example “org.python.util.PythonInterpreter” and google it with the word “maven”. This will find the package that you need to import. For example:
Google Hacks Confirmed!
  • Clicking on the top result will show you the information about the relevant maven package:
Found Jython Package
  • Notice that in this example the latest version was newer as highlighted. Click on the newer version. Then copy and paste the “<dependency>” tag into your projects “pom.xml”.
  • After adding each dependency build the app again and watch that import statement fix itself. Repeat until all the red underlines have vacated your project.

Given the age of ReportCompiler there were a few deprecation warnings around the use of Vectors etc. I did not massively feel the need to redo the code for that since it has Vectors in pretty much every single area of the application. Now I feel the developer pain. Some day the rug will be pulled but for now we are golden. Vectors survive for now.

By the end of this my application compiled and executed. The only thing that did not seem to work was the resources folder including the risk icons. I wrapped the code loading these icons in a “try catch” statement to see a more verbose error message and to ensure the app loaded despite the wonky icons.

Bundling the app and dependencies into a single Jar

To fix the wonky icons I needed to ensure the resources were included inside the Jar file or otherwise copied during the build.  The simplest route I found was to use the “maven-assembly-plugin”. Adding this to the “pom.xml” file resulted in a self-contained single jar file with all resources:

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-assembly-plugin</artifactId>
  <executions>
    <execution>
      <phase>package</phase>
      <goals>
        <goal>single</goal>
      </goals>
      <configuration>
        <archive>
          <manifest>
            <mainClass>
            com.cornerpirate.reportcompiler.GUI.MainWindow                                
            </mainClass>
          </manifest>
        </archive>
        <descriptorRefs>
          <descriptorRef>jar-with-dependencies</descriptorRef>
        </descriptorRefs>
        <finalName>ReportCompiler</finalName>
        <appendAssemblyId>false</appendAssemblyId>
      </configuration>
    </execution>
  </executions>
</plugin>

In my new project the image icons were located under the “src/main/resources” folder. Maven tutorials all say this is where to put them:

resources folder

To access these resources I modified my code to use “getClass().getResource()” as shown:

try {
    this.critical_risk_icon = new ImageIcon(getClass().getResource("/critical-icon.png"));
    this.high_risk_icon = new ImageIcon(getClass().getResource("/high-icon.png"));
    this.medium_risk_icon = new ImageIcon(getClass().getResource("/medium-icon.png"));
    this.low_risk_icon = new ImageIcon(getClass().getResource("/low-icon.png"));
    this.info_risk_icon = new ImageIcon(getClass().getResource("/info-icon.png"));
    this.no_risk_icon = new ImageIcon(getClass().getResource("/none-icon.png"));
    this.computer_icon = new ImageIcon(getClass().getResource("/computer-icon.png"));
    this.show_highlights = showHighlights;
} catch (Exception ex) {
    ex.printStackTrace();
}

Terrific. Now the risk icons were loading beautifully.

Integrating OWASP’s Dependency Check

The reason I was moving to maven was to add sanity into the dependency management. The version of ReportCompiler to date was stuck with whatever jar files I downloaded back when I wrote the project. I consoled myself with the fact that none of the code is remotely accessible which reduced the threat profile.

But here was a Pentester clearly not practising what they preach. Yelling “patch all the things” by day while my barn was on fire. This gave me an opportunity to experience life from the other side of the fence for a bit. Which we should all practice regularly.

OWASP’s Dependency Check does an excellent job of listing known vulnerabilities in dependencies. I have tried it out in a few different contexts over the years and wholeheartedly recommend it to customers. It will not solve security problems on its own. But it will highlight easily fixable weaknesses from third party libraries.

I added this to my “pom.xml” to add it into my build process:

<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>5.3.2</version>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
</plugin>

The goal was set to “check”. In this configuration dependency-check runs when the application is built and an HTML report will be created in the target folder next to my jar file. You can set the build to halt if risks over a certain CVSS score appear which I would recommend for an actively maintained project which is mission critical.

Below is an example report kicked out during a build with some CVE’s to show:

Dependency-Check Report Containing 55 known vulnerabilities

I went through all my maven dependencies and ensured the most recent releases were included (or so I thought). By running “clean and build” again the vulnerabilities related to Apache POI disappeared. Partial success!

My “pom.xml” did not point specifically to any of the remaining vulnerable libraries meaning that they were most likely “dependencies of my dependencies”. I shook my fist at the sky and cried out about how the supply chain will always get you.

I found that netbeans will draw a handy dependency graph. In “Project” view expand the “Project Files” folder and click on “pom.xml” and then on the tab labelled “Graph” along the top to see this:

Image
Netbeans POM.xml dependencies graph

I could now throw shade at “docx4j” 6.1.2 which was build with Apache Commons Compress version 1.12 when version 1.20 is available. On looking into this 6.1.2 was nowhere near the latest version of “docx4j”! There were newer ones with slightly different names available. Hot swapping that out solved the “apache-commons-compress” related CVEs.

The most recent maven release of “docx4j” (version notes for 11.1.8) was compiled with several outdated dependencies. Unfortunately “jackson-databind-2.9.9” was included and vulnerable to 26 known CVEs. There was no danger of fixing this soon and it would most likely require opening a ticket on the docx4j project.

Drilling into the others I found that “jexcelapi” had a vulnerable version of “log4j” as shown in the graph below:

Log4j 1.2.14 baked into jexcelapi

Looking into it the project for “jexcelapi” was no longer supported since it was last released in 2009. A prime candidate for being entirely replaced. A quick google found that Apache POI is the new hotness. I cutout the old library and went for something that was supported.

At the end of this process I had tried my best but ended up with vulnerabilities via docx4j’s jackson-databind dependency. C’est la vie.

Fixing vulnerable Dependencies is Hard

After thinking about it I can see four ways to proceed with fixing all known CVEs in my dependency chain:

  • Do I really have the most recent release of my dependency? Look up the actual project’s page and see if there is a later release.
  • Can I contact the maintainer and get them to update their public build with the newer dependency baked in? This would fix the issue and eventually filter back into the maven ecosystem. Probably need to do that for docx4j.
  • Do I need that dependency? If it is a minor feature and you are all up to date maybe you can remove the feature or implement it another way. As per jexcelapi.
  • Can I build my own version which is secure (recompiling with the latest libraries)? However, this instantly breaks the mavenness of the dependencies

Now I imagine what it is like when a Pentest report lands heartlessly saying “update your dependencies”. It is clear that this is still a tricky problem in 2020.

This is the end

That was the end of the process. The application compiled and had the same bugs it had before but now had more up-to-date dependency management. Folks may now be more inclined to contribute to the project, and I am more inclined to support it.

Hopefully you found something of value in the tale.

Captain’s Log: May 2020

Leave a reply

The Good

  • Activity – 10k steps… every day.. Going all the way back to Christmas Eve 2019. I have brought an old treadmill back into service during lockdown. I go outside for a decent walk a couple of times a week.
  • Uncharted Games – the remastered 1-3 and 4 have all been given out for “free” with PS Plus over the last few months. I have waded my way through 1-3 and am onto 4. They tell really fun stories even if I find the shooting a bit repetitive at times. The puzzles are often worth it.
  • Life on Mars/Ashes to Ashes – if you have not seen LOM/A2A before then I envy you because you have a hell of a ride to go on. I encourage you to do so.
  • Security Research #1 – Work gave my team an opportunity to take on security research against some open source projects. We had a lot of fun and found a tonne of vulns that we are in the process of disclosing.
  • Security Research #2 – I had time to implement a process for data exfiltration using QR codes (RDPDownload). This is the opposite of my RDPUpload tool that I made a few years ago. While not a brand new technique I enjoy building exfiltration tools to see the trade offs involved and yes this worked on a genuine project. I am working on releasing that tool this month.
  • Decoration – Given lockdown makes me stare at my walls I realised I am not in-love with my flat anymore. I have gone on a programme of doing a minor bit of decorating every night for two weeks. Filling holes here. Sanding and painting there. While I am no expert at this the results are sufficient to mean my eye isn’t drawn to various defects that were driving me mental. The benefits of this for mental health has been huge.
  • Audiobooks – I was unable to get through any in May 😦

The Bad

In 2019 I was immobilised for months and was unable to get out of the house. I gained a lot of weight as a result and felt like crap. Indeed the whole point behind this “Captain’s Log” series was to show the positive steps I was taking to avoid a repeat of that period of my life and to get physically and mentally fitter.

Under lockdown my mental health has remained robust. By the end of May I decided to weigh in to discover indeed I had put on all the weight I had lost pre-lockdown. Not shocked but it is also a little annoying.

Kids out of their routine == Cranky days, late nights, and early waking.

When you are not sleeping right then weight gain is basically inevitable. Fortunately, the kids have started to sleep more regularly in the last week. So light at the end of the tunnel.

Highlight of the month

I think the decorating has really been the highlight. While there is still absolutely tonnes to do. It feels positive like I have stopped treading water and gone on to exert control over my domain. Plus I guess it provides a bunch of exercise to get it done which helps generally with everything.

Captain’s Log: April 2020

Leave a reply

The Good

  • I managed to continue to walk 10k steps every single day in April. It is hard going given the lockdown and most days I do them entirely indoors. It is like the last feature of my exceedingly healthy start to 2020 that I am maintaining.
  • I got a security related blog post out the door: https://cornerpirate.com/2020/04/14/uploading-file-when-all-else-fails/
    • I needed to use RDPUpload in April and took an evening to patch it for Python3 and introduce some new functions. An equivalent tool to exfil through locked down remote environments was also made but not public facing yet. It felt great to get a bit of on message content out again 😀
  • My work runs a regular Hackathon event where we share skills and do some collaborative research. It went great and let me help out with a bunch of potential CVEs that could take sometime to get disclosed. I do love this stuff as it is things I never really did elsewhere.
  • Music has been the saving grace of my lockdown. It lifts the spirit like nothing else.
    • Keyboard – I bought one before Christmas 2019 and struggled to get time on it until the lockdown. I was able to practice chord shapes and play a bunch of songs out of a chord song book in early April. Even getting as far as coordinating left and right hands together to sort of double up the chords for a richer sound. To be clear; I have no idea what I am doing but it is fun to try!
    • Guitar – I taught myself to play around 20 years ago but finding time to keep up has been a struggle since having kids. In 2018-2019 I started to get into home recording and I have seen myself practising those skills in the lockdown.
    • MPD218 & Ableton – This cheeky wee bit of kit lets you assign sounds to buttons and manipulate them. I had given Ableton software a brief go in 2019 but it didn’t make a whole lot of sense. With the arrival of the MPD I sat through a bunch of Ableton tutorials and made a simple dancy track. My intention is to figure out how to make drum tracks on this setup which I have never done before.
  • My friend was making a video to demonstrate CVE-2020-7055 (an RCE in the WordPress Elementor plugin). It was a bit stark at 3 minutes of silence so I battered out something that felt appropriate over lunch. In the end I gave it to someone else in my team to make something more professional sounding which went on the final video. But I have been listening to what I made on loop for a bit and it isn’t as shit as I initially thought!
  • Glasgow Defcon (DC44141) went online for the first time via Twitch. With talks from @ZephyrFish (an intro to Red Teaming) and @InfoSec_Paul_M (on blue team phishing detection techniques). While on the stream someone said “toss a coin to sysadmin” so that inspired this 😀
  • The DC44141 meetup had the pub vibe via an open Discord chat room after the talks. Featuring lots of lovely people.
  • Brooklyn 99 season 6 on Netflix arrived and was consumed to much joy.
  • A feature length Red Dwarf episode arrived and was absolutely a joy to behold. I truly appreciate having spent so long of my life in the company of those characters.
  • I played counter strike: GO more often with great people and had a good time. I feel like I suck a lot less than last month. The game is free on Steam if you want to get hold of it. I have a dedicated server and share the details if you DM on Twitter to @cornerpirate.
  • I started Half Life 2 Updated which I think is free on Steam. I loved HL2 obviously. This updated version seems to have different or more immersive music and I was in absolute tears of joy about how amazing the feat of engineering that is. They introduced GRAVITY for the first real time into games and had an absolute blast making puzzles. It is inconceivable now that games were not like this before. Truly brilliant and if you haven’t played it in over a decade like me, if not now when?

This month’s audiobooks

  • How to talk so little kids will listen by Joanna Faber & Julie King. I had not completely finished this in March and eventually got through this by mid April. It was a great book with tonnes of advice for communicating with kids clearly. Sadly the lockdown has regressed most peoples behaviour because we are trapped in pretty tight quarters. Still several of the techniques have reduced the impact of that.
  • Amazon Web Service by Paul B Richie. I am looking to learn more about AWS and Azure to have more rounded knowledge in those fields. I know bits and pieces but am seeking a few more jigsaw pieces. I am going to be honest. I haven’t gotten far into this and the initial chapter was like listening to someone reading a dictionary rather than inspiring the listener. Ok ok.. I also selected this book in particular because the author is almost my name sake. It might not be fit for the purpose I had in mind.

The Bad

The amount of crud I am eating is essentially putting on the weight I lost at the start of the year. Now that I am getting towards adjusted to the new lockdown reality I have been able to start reigning that in.

Highlight of the month

This has put a smile on my face. I needed to go and collect medicine. When I wrote in to say I was going AFK. An amazing colleague said “A QUEST!” just before I went out the door I recorded a few bits of the walk.

When I got home I strung them together and threw some music on it. There is now a channel in youtube “Fun with cornerpirate” which maintains a list of two quests so far:

The audio of me speaking is particularly bad because of the wind. When I filtered it out in Audacity using noise reduction it left my voice sounding shrill.. Lesson learned even if it is spur of the moment take out the better microphone which has the fuzzy stuff on it.

I now have the right mic but the wrong app was the lesson from episode two.

Uploading files when all else fails: rdpupload

1 Reply

The short version:

  • A tool which works in Linux and Windows which will “upload” a file to an RDP or other remote session where copy and paste or drag and drop are disabled.

Get the tool here:

Details

This is a very old technique. All I have done is have a stab at making my own tool for doing this. I meet aspiring hackers who say they want to jump into coding, but don’t have any “ideas”. They seem unimpressed when I say write a port scanner.

If that is you then I say to you: re-invent the damn wheel!

Sometimes the wheel needs upgrading you know? Many of the tools we have now as the “goto” for something are about 17th in newness of technique. Any tool can be toppled by a better successor.

But world domination is not the goal. Implementing your own versions of old ideas is actually just for getting your skills in for the day you invent an entirely new wheel. It also teaches you how a thing works which is brilliant. At a job interview you will stand out if you actually know what the top tool does under the hood.

What I learned on this one

To make rdpupload I have learned:

  • argparse better (I have used this before)
  • how to simulate key presses in python
  • how to do a progress bar in a CLI
  • how to zip a file using python
  • how to play an mp3 in python (though it didn’t work on Windows, yolo).

But most importantly I learned how a file upload may work by typing it, along with how to decode that on the server side easily.

Technique Used

The following summarises the techniques used:

Attacker Side:

  1. Zip the file you want to upload (might save some characters depending on the file).
  2. Base64 encode that file (so every character we are going to use is available on a standard English Keyboard).
  3. Split the encoded file into chunks of size 256 characters (arbitrary length choice here).
  4. Spoof a keyboard typing each block of 256 characters until it is completed.
  5. Display a progress bar and optionally play the sound of a typewriter hammering away while the “upload” happens.

Victim Side:

  1. Place the cursor into “Notepad” within an RDP session.
  2. When the “upload” is complete save that as a “.txt” file.
  3. Open a command prompt and use “certutil.exe” to decode the base64 encoded file. The syntax for that is shown below.
  4. Use the zip feature of Windows to unpack the zip file.
  5. Profit.

The decoder on the server side relies on “certutil.exe”. Unless I am wrong this is available from Server 2003 upwards so is pretty useful for most use cases.


Syntax: certutil -decode &amp;amp;lt;inputfile&amp;amp;gt; &amp;amp;lt;outputfile&amp;amp;gt;

Example: certutil -decode nc.txt nc.zip




The decode command is also spat out on the Kali side for convenience once the upload is complete.

Captain's Log: March 2020

Leave a reply

The good

  • I did a talk at Glasgow Defcon (@dc44141) called “Intro(ish) to SQL Injection”. Following on from the actual intro in February this recapped a bit, but went into demos for Blind SQL Injection and then getting a webshell. It went well and as always there is a noticeable bounce in happiness having survived a public speaking gig. You should definitely do it the positives massively outweigh the ph34r. Video of the content captured after the event here:
  • After my talk I spoke to lots of people at the end but didn’t quite catch all the Twitter handles. Seems the kids these days communicate via Instantgrams which I thought was how they ordered weed? Lovely conversations with: @zenrhe, @TIA568B, @ScottMcGready, and @ddsgerard.
  • Delivered my first project to a customer in months (having been involved in various non-front line projects). It is natural to see a bit of ring-rustiness in these situations. When the account manager called up our brand new customer they took the time to say “It is honestly the best penetration testing report I have ever seen”. I blushed very hard but am trying to remember that is more of an indictment of the industry average skill at writing down what they did than anything.
  • I needed to Google something to remember how to do it. The page I found named me in the article. This is good because someone found the drivel I shared valuable enough to pass it on. Shout out to every reader; write your thoughts and share them on a blog. You help yourself and others and your contribution is welcome!
  • Making music and things again. I bought a piano chord song book and am learning chords. I might get out of the lockdown able to play a brand new instrument!
  • As well as getting a guitar out more regularly for things like a warning about default passwords :
  • And ofcourse a covid-19 smells like teen spirit arrangement made in a lunchtime:

Getting Going again!

  • Counter Strike:GO – I have procured a dedicated server protected by a password. If you want to come and play on a clean server where people are told to play the objectives and say “gg” (or gtfo) then I can hook you up with the details. DM me on twitter @cornerpirate.

Audiobooks

  • This months audio books were:
    • What you need to know about business by Roger Trapp. Part of being a penetration tester means I periodically refresh my understanding of businesses and how they operate. I want to ensure that I am using the right language for that audience, and to stick my finger on the right wound to stem the blood when prioritising fixes. You will find a lot of good entry level things in this audio book. Not the best book on the topic I have read but I am really bad at book titles and names so I am no use to tell you what those were :D.
    • How to talk so little kids will listen by Joanna Faber & Julie King. Part of being a parent is needing to get things done in the face of resistance. With the impending home schooling requirement (I wrote this before #Lockdown) I felt it was useful to delve into this book deeper than I had managed with the real physical book. The essential message is absolutely applicable to everyone you want to speak to. Going to scream the key learning so far:
      • LISTEN TO AND ACKNOWLEDGE THE FEELING OF THE OTHER PERSON.
      • DO NOT TRY AND IMMEDIATELY OFFER SOLUTIONS, LET THEM EXPRESS THEMSELVES.
      • MODEL HOW BY EXPRESSING YOURSELF.
      • AVOID GIVING DIRECTIVES. TRY GIVING FACTS AND STATING WHAT YOU ARE FEELING.
      • … there are many more. I have been mixing things from this and the CBT knowledge from last month in talking to my wilful eldest child. While they are not perfect in any way they are now getting far more responsibilities which they are thriving on. Having previously been unable to listen to any instructions, it is now much more harmonious between us. We can genuinely get the time lost on tampers and turn that into playful fun time. A revolution in our relationship while not entirely down to this book it is a definite place to look and start your journey.

The bad

Panic Attack – (written pre #lockdown). The flying duck is a local nightclub. It is fantastic and serves a lot of Vegan food too if you like that sort of thing. It is also apparently a nightmare in box with my name on the card. Who knew? I have been there three times before and it has not been a problem. But those times were before all the sleep deprivation and onset of panic attacks. I would still recommend the place to others because it is a fine establishment. In saying that lets delve into my experience:

  • Before going to DC44141 to talk I took a taxi in to have something to eat. This was not planned. Maybe my brain did not have time to prepare for this to be happening so it decided to remind me.
  • I had not had much sleep over the previous 48 hours and had been working pretty hard on a customer engagement too. Basically my stress was probably a lot higher than it had been in Jan-Feb for those reasons.
  • As I walked down the 20 ish steps to the basement bar I was overwhelmed. It was a sensory overload. Sudden suffocating air of deep fat frying. The smell triggering flashbacks to a trauma. Many moons ago I had such a vigorous bout of heartburn it felt like I was about to die.
  • The lack of natural light bringing on a touch of claustrophobia perhaps didn’t help.
  • The clincher was the music. It was.. and how to be polite.. utter pish. It was the worst excesses of trying to be laid back jazz while actually being discordant. Purposefully off any sense of rhythm. With some bastard seemingly playing a trumpet with an air horn at any moment when you might have found solace.
  • In my mind I equate what I experienced with footage of people being tortured with white-noise.
  • I stuck it out and we ate a meal. I couldn’t really eat but needed a little something.

I am laughing about it now because of how utterly ridiculous the whole thing was. I have been doing the correct things in 2020 to reduce the occurrences and diminish the impact of these. But here I am freely admitting to the sort of party that goes on inside my mind sometimes.

The positives from this situation are: nothing bad happened, my ability to sit in it and stew instead of running away are showing tolerance going up, and I was able to perform after it instead of literally losing a days work after like previous incidents.

Oh and it gave me a fun opening to the talk where I just ranted about the experience. It felt like rocking an open mic night. The folks who usually leave the GCU union when you start your talk all hung around for the 3 minutes of ad-libbing. A possible future career in observational comedy about panic attacks is worth exploring!

Coronavirus Panic #1: so that is all going nuts outside yeah? I am writing this bit in the middle of March (Monday 16th). As yet the UK has done the square total of nothing to prepare it seems. Panic buying has hit home, and yet the schools are all open on the most part.

While I can freak out about going into a basement it turns out I am not overly concerned by a pandemic which is actually a dreadful thing which is entirely outside of my control. I am focusing on my goals and ensuring I have entertainment and a little food in hand in case of a lockdown.

Coronavirus Panic #2: having lived the homeschooling life for a week and a half I think we will be ok. My partner has stepped up to the plate and is doing wonderful things. I love them beyond words.

Highlight of the month

I think the highlight is somehow miraculously managing 10k steps a day despite being locked in doors with motivation waning. Keeping this up is like a little note to trying to remain positive.

Honestly this month feels like it took 2 decades didn’t it? The captain’s log is more disjointed than usual. There are bits from clearly different eons. The things I was doing to tackle my physical and mental health challenges in 2020 were all paying out and contributing to a happy cornerpirate. I have not burned through the reserves yet. However, when a big part was going OUTSIDE to listen to audiobooks and get exercise/sunlight at three points in the day. You can probably assume something is going to give soon since they basically outlawed my coping strategy.

Time for a new strategy!

Teaching Moments

Leave a reply

Hello all,

2019 was a total washout. 2020 cornerpirate started doing things differently. By taking positive actions (as you can see from the “Captain’s Log” monthly series). A summary where I track the good and the bad that happened in a month.

The departure from the cyber security focus of this blog was a decision I wrestled with, but I simply needed to vent that stuff somewhere to make myself accountable to erm.. well, myself really.

Part of my positive actions schtick meant I saw a need for a speaker for Glasgow Defcon (DC44141) in February and grabbed it. This was me getting off the bench and trying to pass on knowledge to anyone who wanted to listen.

This has resulted in the TeachingMoments repository over on GitHub. Nothing unique about it. Just another voice in the whole wide Cyber Security community trying to help. Free of charge and available for you to play with.

Motivated and on the ball for 2020.

Take care, and share whatever you know.

Captain’s Log: February 2020

Leave a reply

In keeping with noting down the good and the bad briefly each month here is February.

The good

  • Managed the 10k steps a day challenge for another month. Some days it was hard and other days I was way way over the minimum. Energy levels returning. It was particularly challenging given the run of epic storms battering the country limiting outside time but we got that done folks.
  • Integrating a little weight lifting and pushups (standing up vs a wall for now) into the mix which have a major effect for me personally when burning calories. Trying to make that habitual as well. Picked up a kettlebell towards the end of the month and it really kicked my ass. Primo bit of kit that and I would highly recommend.
  • Prepared a talk called “Intro to SQL Injection” for Glasgow Defcon. With January having gone great, I saw that there was no speaker booked and figured why not challenge myself to pull something together over a weekend. Vulnerable LAMP stack created, application and slides pulled together without fuss.
  • Delivered said talk. Despite a few niggles about the venue layout and the microphone it seemed to go down well. Met some new legends (EHBEHCEH, KathrynMcBain, and laughingFalkor), and saw some returning legends for the first time in ages (wintervirus). Nobody seemed offended if I go for more advanced SQLi next month. So committed to doing round2 in March!
  • Went on holiday to a log cabin and had a genuinely relaxing time (despite the best efforts of storm Ciara making it a little leaky).
  • A colleague had a big test and not enough time to fully smash everything so gave me an absolute open goal of an RCE to play with. Not entirely trivial to get working but I managed to get a webshell, then reverse shell out of it at least and get some good onward findings. Felt good 😀
  • Prepared a talk called “Intro(ish) to SQL Injection” for AbertayHackers after having my presence demanded by Casual_Unknown and akhanhack following what I call my triumphant talk at G3C in 2019. Triumphant because I went for joy, and folks came out smiling. Unfortunately see The Bad section below 😦
  • I have used a FitBit to track my sleeping pattern in 2020. Fortunately or unfortunately I have no data from 2019 when all I can tell you is “living permanently awake and on high alert” which was unhealthy. By now I have a graph showing sleep quality if not duration improving. In a world of incremental gains I am saying this is definitely the most positive change to see. It is very likely the result of appropriate hydration in the daytime, and the moderate exercise.
  • Continuing to utilise childcare to get more time with my partner. As the kids get more independent it is absolutely vital to stop the vicious holding pattern we had established where a parent was always on duty.
  • Finally, over in Audiobook land I listened to almost all of Cognitive Behavioral Therapy: Techniques for Retraining Your Brain. I say book. It is clearly a series of lectures with indicative interviews with patients recorded for you to listen in on. It is helping me have the language and critical thinking required to take 2020 Pirate to a better place.

The bad

  • Cancelling for said “Intro(ish) to SQL Injection” talk the morning off. Woke up. Kid was sick and my partner was sick. It made me feel absolutely awful to cancel something.
    • In raking though the positives at least more of the content for DC44141 in March had been completed earlier than I would have.
    • At least I wasn’t cancelling because I had some mad panic attack or anything.

Highlight of the month

  • My kids are getting a much better version of their dad. While I have always been present and have tried my best. They are getting a more energetic, less sleep deprived version. I am importantly far less shouty than 2019’s immobile and permanently in pain shitshow of a father.