rufflabs.com

BreakICT 2022 CTF Walkthrough (Part 2)

Sep 6, 2023 · 9 min read · writeup ctf walkthrough ·

Part 2 of 2 of a series of walkthroughs for the BreakICT CTF at OzSec 2022. Here I post the remaining challenges walkthroughs, including the ones I did not complete during the CTF itself, but were available after the CTF ended.

Fixing Kernel Panic in Ubuntu Packer Builds

Mar 24, 2023 · 3 min read · ·

Share on:

When building an Ubuntu image using Packer I was building out my own .pkr.hcl template file. Everything seemed to be fine, except I could never get the build to boot into the cloud-init and start installing the operating system. This post discusses the kernel panic and how to solve it.

Certified CyberDefender Review

Mar 16, 2023 · 4 min read · review ·

Share on:

A review of the Certified CyberDefender (CCD) course and certification exam from cyberdefenders.org.

Installing pip for Python2

Nov 23, 2022 · 1 min read · ·

Share on:

While Python2 is end of life and should not be used, there are some tools and scripts out there that are not compatible with Python3. This guide shows how to get pip installed for Python2.

BreakICT 2022 CTF Walkthrough (Part 1)

Oct 21, 2022 · 4 min read · ctf writeup walkthrough ·

Share on:

Part 1 of a series of walkthroughs for the BreakICT CTF at OzSec 2022. Today we take on four of the challenges ranging from web discovery to identifying and decoding messages.

Anatomy of a Reverse Shell: nc named pipe

May 21, 2022 · 8 min read · RevShell PenTest Docker Lab ·

Share on:

Anatomy of a Reverse Shell: nc named pipe

Breaking down the cryptic reverse shell using nc and named pipes. How the reverse shell works, and a hands-on docker lab to test out reverse shells.

LetsDefend Walkthrough SOC164 Suspicious MSHTA Behavior

Mar 24, 2022 · 8 min read · letsdefend writeup ·

Share on:

LetsDefend Walkthrough SOC164 Suspicious MSHTA Behavior

Today's LetsDefend walkthrough will be investigating Event ID 114 - Suspicious MSHTA Behavior. Where an alert is raised due to mshta.exe executing a .hta script file that is considered low reputation.

Remediating Nessus Plugin ID 139239 "Windows Security Feature Bypass in Secure Boot (BootHole)"

Mar 8, 2022 · 11 min read · Nessus CVE-2020-10713 HowTo BootHole ·

Share on:

How do you remediate BootHole as identified by Nessus Plugin ID 139239 in Windows systems? Here we will be discussing this vulnerability and how to properly remediate it from your Windows hosts.