Posts

I recently managed to recreate the Backdoor.Turn TTP with the help of LLMs. I’ll explore the technique in this post, and the reflections of using local LLMs for offensive security. LLMs in Offensive Security Cybersecurity is famously a sensitive topic with AI for good reasons. But like every other pentester out there, when someone tells me I cannot do something, my fingers start to tingle. After a few months of working with various models & harnesses for cybersecurity, I have settled on a modality of working that takes advantage of the various means and models that are available to me. ...

Common Terms of Reference Before I start, some common terms of reference would be helpful so that we are on the same page: Quantisation (Quant, Q) - Mixture of Experts vs Dense (MoE, A3B) - Number of Parameters, Billions (27B, 31B) I previously used to document detailed instructions on how to get things going, but with AI these days, I think the basics are well covered, so I’ll focus more on the nuances between the decisions that I needed to make. ...

Why run local? I’ve been struggling to answer this question for awhile, but I think I finally have some glimpses of the solution. I hope this short summary of my adventures will answer that question. Edit: This was turning out to be much longer than I expected so I decided to break it up into a few series. What is a Local LLM? So instead of using ChatGPT or Claude, you have a model on your own computer that you can query and ask questions and even plug into an agentic workflows and it all works offline. ...

I recently finished the CRTO course (which is extremely great value) and it got me very interested in building red team infrastructure. This interest also comes from an incident where my very nice VPS provider sent me a very polite but firm email that running C2 infrastructure was not allowed on their infrastructure. I’m not an expert in setting up C2 infra, and I’m sure others have way more sophisticated setups than mine, but this is how I’ve chosen to set up my infra. ...

I came across another vulnerable driver while browsing my feed the other day. Following my research last year, I was curious how much of the methodology can be carried over. Vulnerable DriversIn this post I dive into the reverse engineering and abuse of vulnerable kernel drivers and how they are used to kill defensive solutions such as EDRs and AVs, using the example of aswArPot.sys, an anti-rootkit driver from Avast.West Side Electronics·Benjamen Lim The original research was conducted by Northwave Cyber Security: BlackoutReloaded: Exploiting antifraud software of banks to kill Microsoft DefenderBlackoutReloaded: Exploiting antifraud software of banks to kill Microsoft DefenderNorthwave Cyber Security This time I’ve only given myself the name of the driver to start with, and I’m using Binary Ninja instead of Ghidra to explore other reverse engineering tools. ...

New year, new cert. After having completed the OSEP and OSED, I felt that I was ready for a new challenge, so I decided to take on the OSWE to brush up on my web exploitation skills which I felt were a little lacking. OSEP in 2024Overcoming another challenge - the PEN-300 course by Offsec and earning the OSEP certificate!West Side Electronics·Benjamen Lim OSED in 2024Let's go ropping - the EXP-301 course by Offsec and earning the OSED certificate!West Side Electronics·Benjamen Lim And I promptly got distracted by the Hack The Box CWEE. ...

This first appeared in: https://medium.com/csg-govtech/reverse-engineering-a-smartwatch-a7cec52b29c8 Some time ago, I was assigned a consignment of smart watches with geolocating capabilities that were being mothballed after a trial. I was determined to find some use for them and thus began my journey ofreverse engineering a smartwatch! In this article, I will share the reverse engineering process by first highlighting some initial observations on the watch surface and circuitry, before going into detail as to how I reprogrammed the smartwatch,and the final step of patching the firmware so it could be repurposed. ...

The process of red teaming consists of many aspects and after exploring the technicals of malware (although I’m still continuing to explore!), I thought exploring the ingress point would be interesting. Despite the many protections that are in place for users, phishing still appears to be a highly common source of breaches. Your standard phishing page attempts to steal the user’s credentials by presenting a realistic looking login page that will hopefully capture their credentials. However, the challenge with this site is that it will deviate from the actual site in terms of the layout, and would be quite as sites changes their layouts from time to time. Additionally, with the move towards passwordless signins, tokens, and MFAs, capturing passwords is just one part of the puzzle. ...

Imagine that one day, you wake up, start scrolling through your feed, and see this: Researchers Uncover Malware Using BYOVD to Bypass Antivirus ProtectionsMalware exploits Avast driver to bypass antivirus, terminate 142 processes, and disable security protectionsThe Hacker News·The Hacker News Bypass antivirus, terminate 142 processes, disable security protections? Oh no! Sounds like trouble. Reading the original report from Trellix, it seems like the malware abuses aswArPot.sys, a kernel driver from Avast that is an anti-rootkit driver meant to dislodge the most stubborn of malware, but now used as a anti-anti virus tool; talk about a double edged sword. ...

Another one down! OSED is a penetration testing certification with an emphasis on exploit development. It is in the 300 level series of Offensive Security certifications and one of the three certs required to earn the OSCE3 qualification. EXP-301: Windows Exploit Development Course | OffSecLearn to bypass common security mitigations with exploits created from scratch. Earn your OffSec Exploit Developer (OSED) certification.Off·SecOffSec Team Since my background is in reverse engineering firmware and IoT, this certification is closest to my heart. Because I was dealing with assembly frequently, I really liked the precision that it required. You have to know exactly how many bytes to jump in order to make the exploit work, the exact size of your padding to trigger an overflow, or the values required to navigate through various header checks… I thought that was really fun! ...