noob2root
The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards.
Gene Spafford
Offensive security · field notes
Everything is
broken.
These are the notes.
Web applications, APIs, cloud and Active Directory. CVE breakdowns, proof-of-concept write-ups, and tools built because the thing I needed did not exist. Written down while it is still fresh.
Start readingTracking
Vulnerabilities worth your time
All entries- CVE-2024-309410.0critical
Backdoor in xz-utils liblzma
A multi-year social engineering campaign planted a backdoor in the xz release tarballs, hooking sshd via liblzma.
xz-utils
- CVE-2023-4966 Exploited9.4critical
CitrixBleed: session token leak in NetScaler ADC
An unauthenticated buffer over-read leaks session tokens from memory, allowing MFA to be bypassed by replaying a hijacked session.
Citrix PoC
- CVE-2022-22965 Exploited9.8critical
Spring4Shell: RCE in Spring Framework
Data binding in Spring MVC on JDK 9+ could be abused to reach class-loader properties and write a web shell, giving remote code execution.
VMware PoC
Writing
Working notes
All posts-
PurpleForest, Part 2: Kerberoasting a Domain That Fights Back
Every kerberoasting tutorial fails on a patched Server 2022 DC. Here is why, what actually works, and which of four detections survives the evasion.
purple-teamactive-directorykerberoastingdetection-engineeringsigmagraylogkerberoshashcatimpacket
-
PurpleForest, Part 1: Building an AD Purple-Team Lab from Zero
Stand up a Windows domain, a Graylog SIEM and Sysmon + Vector telemetry on one Windows host with VMware Workstation, Vagrant and Ansible.
purple-teamactive-directorydetection-engineeringgraylogvectorsysmonansiblevagranthomelab
-
PurpleForest: An Active Directory Lab That Fights Back
Most AD labs teach one half of the job. PurpleForest builds both: a Windows domain to attack, full telemetry through Vector, and Graylog to catch you. Run the attack, read the logs, write the rule, watch it fire, then evade it.
active-directorypurple-teamhomelabdetection-engineeringsiemgraylogvectorsigma
Salvage
Tools I built
8 mine · 34 curated-
PurpleForest
An Active Directory purple-team lab: run the attack, read the logs, write the rule, watch it fire
VagrantAnsibleWindows ServerVectorGraylogSigma
-
ADReaper
Active Directory and Windows privilege-escalation recon, without touching exploitation
PythonLDAP
-
ZScan
Single-file network scanner that runs where nothing can be installed
PythonPowerShell