Jan 8

Persistence ways(The adversary is trying to maintain their foothold)

Gaining continued access to a computer system or network that has been compromised is known as persistence. It requires bypassing security measures and re-configuring systems so that access is maintained even after users log out or reboot the system. …

Persistence

6 min read

Persistence

6 min read

Dec 30, 2022

GCPGoat(ine) GCP CTF solution Module 1-Path 1(abusing storage buckets permissions, privesc to role/owner)

Hi readers, here we will be solving the GCPGoat module 1(Path 1). We will be going through the first path in this walk-through as shown in the diagram below. Video Walk-through: https://www.youtube.com/watch?v=cM46_c-zxh4 Solving Challenge- Finding storage buckets being used by web app- a. In the previous path (https://www.youtube.com/watch?v=dtLg4Z8bHNk&t=498s), we found a GCP…

Cloud Security

7 min read

GCPGoat(ine) GCP CTF solution Module 1-Path 1(abusing storage buckets permissions, privesc to…

Cloud Security

7 min read

Dec 25, 2022

GCPGoat(ine) GCP CTF solution Module 1-Path 2(SSRF, source code review, privilege escalation)

Hi readers, here we will be deploying and solving GCPGoat module 1 challenge. We will be going through the second path in this walkthrough, as shown in the diagram below. Video Walkthrough: https://www.youtube.com/watch?v=fyCtrM3eCd8 https://www.youtube.com/watch?v=dtLg4Z8bHNk Prerequisites- a. Admin access in the GCP account(You can create a new free tier account) b…

Cloud Security

5 min read

GCPGoat(ine) GCP CTF solution Module 1-Path 2(SSRF, source code review, privilege escalation)

Cloud Security

5 min read

Dec 12, 2022

AWS OIDC — EKS

Hi readers, here we will be looking into how can we allow Kubernetes to perform certain tasks in aws. We will also see how we can further fine-tune access to only specific service accounts within EKS cluster. Setting up scenario- Note: Before proceeding make sure your aws cli profile account and the aws…

AWS

4 min read

AWS

4 min read

Dec 9, 2022

AWS OIDC — Github Actions Abuse

Hi readers, here we will see how someone knowing/guessing role arn created for GitHub actions can escalate privileges. Creating scenario- Let’s assume we want GitHub actions to perform certain operations in our AWS account. For this example, we will be listing s3 buckets using GitHub actions. Steps- Adding GitHub as an Identity…

Aws Security

4 min read

Aws Security

4 min read

Nov 30, 2022

Creating Malicious word documents

Hi readers, here we will be looking into creating malicious word documents with the intent of running system commands using macro functionality. Below is the sample VBA code for automatically opening notepad.exe. Sub AutoOpen() Dim Shell As Object Set Shell = CreateObject("wscript.shell") Shell.Run "notepad" End Sub Steps to add VBA…

Windows

4 min read

Windows

4 min read

Nov 25, 2022

Joining new node to kubernetes cluster

First way- — Note: you need to run all these commands on master/control plane node. Finding token- kubeadm token list “749p22.f2342qewnc6zu1cc” 2. Finding the CA cert hash- openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

Kubernetes

2 min read

Kubernetes

2 min read

Joining new node to kubernetes cluster

First way-

Note: you need to run all these commands on master/control plane node.

Finding token-

kubeadm token list

“749p22.f2342qewnc6zu1cc”

2. Finding the CA cert hash-

openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed 's/^.* //'

Oct 26, 2022

GCPgoat Scenarios

https://gcpgoat.joshuajebaraj.com/ Scenario-1 Attacking Compute Engine Deployment ./create-scenario-1.sh Web Server: 35.194.173.109 2. Enumerating web server and finding ssrf- a. This web app loads websites and shows http responses-

Gcp

5 min read

Gcp

5 min read

Oct 24, 2022

Cloudgoat AWS CTF solution- Scenerio 11 (detection_evasion)

Scenerio 11- detection_evasion git clone https://github.com/RhinoSecurityLabs/cloudgoat.git cd cloudgoat chmod +x cloudgoat.py ./cloudgoat.py config whitelist --auto ./cloudgoat.py create detection_evasion Scenario Resources (High Level) 4 IAM Users 2 EC2 instances 2 SecretsManager secrets A suite of detection mechanisms Scenario Start(s) 4 pairs of IAM Credentials. Scenario Goal(s) The goal of this scenario is to read out the values for both secrets without being…

AWS

6 min read

Cloudgoat AWS CTF solution- Scenerio 11 (detection_evasion)

AWS

6 min read

Oct 24, 2022

Cloudgoat AWS CTF solution- Scenerio 9 (codebuild_secrets)

Scenerio 9- codebuild_secrets git clone https://github.com/RhinoSecurityLabs/cloudgoat.git cd cloudgoat chmod +x cloudgoat.py ./cloudgoat.py config whitelist --auto ./cloudgoat.py create codebuild_secrets Scenario Resources 1 CodeBuild Project 1 Lambda function 1 VPC with: RDS x 1 EC2 x 1 2 IAM Users Scenario Start(s) IAM User “Solo” Scenario Goal(s) A pair of secret strings stored in a secure RDS database.

AWS

6 min read