I recently managed to recreate the Backdoor.Turn TTP with the help of LLMs. I’ll explore the technique in this post, and the reflections of using local LLMs for offensive security. LLMs in Offensive Security Cybersecurity is famously a sensitive topic with AI for good reasons. But like every other pentester out there, when someone tells me I cannot do something, my fingers start to tingle. Capability. There are benchmarks out there that put a model through its paces and comes out with a nice number that tells you which one is better: 82.7%! But what does that mean when it comes to working with these models and accomplishing a task? Does it mean it can only complete 82.7% of every task you throw at it? Or only tasks that have a ranked difficulty of 82.7%? And what does that mean in the context of cybersecurity? The best model in the world means nothing if it constantly declines to do what you want (looking at you Fable). ...

Common Terms of Reference Before I start, some common terms of reference would be helpful so that we are on the same page: Quantisation (Quant, Q) - This measures how ‘compressed’ a model is. It starts at FP (floating point) 16, the original size, to Q8 down to Q1. Mixture of Experts vs Dense (MoE, A3B) - An MoE model loads only experts into memory, which makes it faster. A dense model loads all its parameters into memory, which makes it smarter. Number of Parameters, Billions (27B, 31B) - The more parameters a model has, the more information it can store, and the smarter it becomes. I previously used to document detailed instructions on how to get things going, but with AI these days, I think the basics are well covered, so I’ll focus more on the nuances between the decisions that I needed to make. ...

Why run local? I’ve been struggling to answer this question for awhile, but I think I finally have some glimpses of the solution. I hope this short summary of my adventures will answer that question. Edit: This was turning out to be much longer than I expected so I decided to break it up into a few series. What is a Local LLM? So instead of using ChatGPT or Claude, you have a model on your own computer that you can query and ask questions and even plug into an agentic workflows and it all works offline. ...

I recently finished the CRTO course (which is extremely great value) and it got me very interested in building red team infrastructure. This interest also comes from an incident where my very nice VPS provider sent me a very polite but firm email that running C2 infrastructure was not allowed on their infrastructure. I’m not an expert in setting up C2 infra, and I’m sure others have way more sophisticated setups than mine, but this is how I’ve chosen to set up my infra. ...

I came across another vulnerable driver while browsing my feed the other day. Following my research last year, I was curious how much of the methodology can be carried over. Vulnerable DriversIn this post I dive into the reverse engineering and abuse of vulnerable kernel drivers and how they are used to kill defensive solutions such as EDRs and AVs, using the example of aswArPot.sys, an anti-rootkit driver from Avast.West Side Electronics·Benjamen Lim The original research was conducted by Northwave Cyber Security: BlackoutReloaded: Exploiting antifraud software of banks to kill Microsoft DefenderBlackoutReloaded: Exploiting antifraud software of banks to kill Microsoft DefenderNorthwave Cyber Security This time I’ve only given myself the name of the driver to start with, and I’m using Binary Ninja instead of Ghidra to explore other reverse engineering tools. ...

New year, new cert. After having completed the OSEP and OSED, I felt that I was ready for a new challenge, so I decided to take on the OSWE to brush up on my web exploitation skills which I felt were a little lacking. OSEP in 2024Overcoming another challenge - the PEN-300 course by Offsec and earning the OSEP certificate!West Side Electronics·Benjamen Lim OSED in 2024Let's go ropping - the EXP-301 course by Offsec and earning the OSED certificate!West Side Electronics·Benjamen Lim And I promptly got distracted by the Hack The Box CWEE. ...

This first appeared in: https://medium.com/csg-govtech/reverse-engineering-a-smartwatch-a7cec52b29c8 Some time ago, I was assigned a consignment of smart watches with geolocating capabilities that were being mothballed after a trial. I was determined to find some use for them and thus began my journey ofreverse engineering a smartwatch! In this article, I will share the reverse engineering process by first highlighting some initial observations on the watch surface and circuitry, before going into detail as to how I reprogrammed the smartwatch,and the final step of patching the firmware so it could be repurposed. ...

The process of red teaming consists of many aspects and after exploring the technicals of malware (although I’m still continuing to explore!), I thought exploring the ingress point would be interesting. Despite the many protections that are in place for users, phishing still appears to be a highly common source of breaches. Your standard phishing page attempts to steal the user’s credentials by presenting a realistic looking login page that will hopefully capture their credentials. However, the challenge with this site is that it will deviate from the actual site in terms of the layout, and would be quite as sites changes their layouts from time to time. Additionally, with the move towards passwordless signins, tokens, and MFAs, capturing passwords is just one part of the puzzle. ...

Imagine that one day, you wake up, start scrolling through your feed, and see this: Researchers Uncover Malware Using BYOVD to Bypass Antivirus ProtectionsMalware exploits Avast driver to bypass antivirus, terminate 142 processes, and disable security protectionsThe Hacker News·The Hacker News Bypass antivirus, terminate 142 processes, disable security protections? Oh no! Sounds like trouble. Reading the original report from Trellix, it seems like the malware abuses aswArPot.sys, a kernel driver from Avast that is an anti-rootkit driver meant to dislodge the most stubborn of malware, but now used as a anti-anti virus tool; talk about a double edged sword. ...