https://crmullins.com/ Recent content on CRMullins blog Hugo -- gohugo.io en-us Thu, 04 Jul 2024 00:00:00 +0000 https://crmullins.com/ropemporium-write4/ Thu, 04 Jul 2024 00:00:00 +0000 https://crmullins.com/ropemporium-write4/ Table Of Contents intro exploration recap: what we have so far finding a writeable address writing into r14, r15, and rdi (let’s use ropper) final rop chain exploit intro Happy July 4th. This is going to be a writeup of the ropemporium: write4 challenge so if you don’t want spoilers for that, read another post. This challenge is where it starts to get interesting. The goal is the same (to print out the flag. https://crmullins.com/ropemporium-callme/ Thu, 08 Feb 2024 12:43:20 -0500 https://crmullins.com/ropemporium-callme/ Table Of Contents intro investigation solution bash python intro In ropemporium: split and callme writeup we went through the split problem. This callme challenge uses the same principles in a slightly more complicated configuration, and I know I said I’d do both in that post but it was getting long. Sorry. My blog, my rules. In the description we’re told we need to make the following calls in the following order to print the flag: https://crmullins.com/openssh-rce-part-1/ Wed, 27 Dec 2023 12:43:20 -0500 https://crmullins.com/openssh-rce-part-1/ Table Of Contents intro to the vulnerability forwarded ssh agent ssh agents, smart cards, and prior art CVE-2016-10009 mechanism of the vulnerability return-oriented programming use-after-free bigger picture surprising behaviors executable stack praxis nodelete signal handler interpreting signal masks This is part 1 in a series where I am going to break down the Qualys security advisory for CVE-2023-38408. It’s a fascinating read on its own, and fairly accessible – the Qualys team is impressive for this as well as their ingenuity and determination making this idea work. https://crmullins.com/ropemporium-split-callme/ Sun, 19 Feb 2023 12:43:20 -0500 https://crmullins.com/ropemporium-split-callme/ Table Of Contents intro buffer overflow little endian analyzing the split binary ROP chain finding ROP gadgets the plan payload It sounds kinda weird when you say it like that.. This is going to be an analysis of the ROP Emporium split puzzle solution along with callme, for the x86_64 platform. I prefer to rely mostly on unix tools you’d find available on any box, simply because they’re the most re-usable for any other work you do. https://crmullins.com/lfs/ Wed, 28 Dec 2022 12:43:20 -0500 https://crmullins.com/lfs/ Table Of Contents why LFS? why use a VM (or QEMU specifically) backups safety clutter how install ubuntu run the vm resize your partition installing linux from scratch the process rebooting your host mount the lfs partition mount the virtual filesystems gcc first-pass fix gcc final pass testing configuring the network Happy valentines day. Linux From Scratch (LFS) is a series of projects showing you how to build your own linux system. https://crmullins.com/systemd/ Tue, 27 Oct 2020 12:43:20 -0500 https://crmullins.com/systemd/ Systemd is the neat little init system that most popular linux distributions rely on at this point. I know it’s controversial, but I don’t really want to get into systemd vs sysvinit, or who got banned from the linux kernel for what – systemd is here to stay, so we should learn how to use it. systmctl First things first lets start with the basics: systemctl start dhcpcd.service This will start the dhcpcd service. https://crmullins.com/about/ Mon, 01 Jan 0001 00:00:00 +0000 https://crmullins.com/about/ I’m a software engineer living in the PNW. When I’m not in front of a keyboard, I enjoy combat sports, chess, and hanging around with my wife and greyhounds.