Mark Baggett

Approximately 1 year ago today, Tim Tomes and I did a presentation on Volume Shadow Copies (VSC) at Hack3rCon II. Hack3rCon^3 just wrapped up, and I’ve officially been shamed into finally publishing the details of the research. Many of the faithful PDC readers will know most of these details, as some of them were included […]

ETW (Event Tracing for Windows) is pretty awesome. You can do all kinds of crazy cool stuff with it. For example, imagine you’ve just exploited your target to find the CFO is using IE to browse to the companies internal ERP (Enterprise Resource Planning) system. Showing the executives that you’ve got access to the financials […]

Someone stopped me in the hall this morning to ask about the talk Tim Tomes and I gave recently at Hackercon called “Lurking in the Shadows”. In that talk Tim and I discuss hiding Malware in Volume Shadow Copies and executing directly from the Volume Shadow Copies. http://www.irongeek.com/i.php?page=videos/hack3rcon2/tim-tomes-and-mark-baggett-lurking-in-the-shadows In our talk we also discuss Matt […]

A seldom used but sometimes useful method of enumerating hosts in a target network is the use of incrementatal zone transfers. Lets say that target system personnel have foolishly decided to prevent DNS Zone transfers by blocking TCP port 53 instead of configuring a list of servers allowed to do zone transfers on the DNS. […]

You have remote command execution on a linux web server. Your normal tricks for getting a shell don’t work but you know that the system has a fully functional python interpreter. In order to make your attack work you need to put the entire attack into a single command line passed to a python interpreter […]

If you haven’t done so already, you need to check out Evil Core. Evil Core is an interesting evolution in bootkit malware. Existing bootkits such as Kon-boot and Stoned Vienna modify the Operating System during the boot process by hooking the BIOS interrupt responsible for reading the OS Kernel from the disk. The kernel is […]

Sometimes people dismiss privilege escalation exploits and don’t give them the same priority as remote exploits.  Certain software companies won’t even classify privilege escalation as “HIGH PRIORITY”.    I wanted to share a story about how a single privilege exploit can result in the downfall of the entire network.   Doug Burks and recently I […]

IDLE scans allow an attacker to scan a victim and frame an inactive host on the internet. The attacker doesn’t transmit packets directly to the victim, but instead uses the idle zombie to measure the victim’s response to a spoofed packet. NMAP currently does this with the -sI command line option. There is a very […]

Subtitle: Don’t second guess Josh Wright & Scapy rocks Tim Tomes (https://lanmaster53.com/) and I were asked to do a penetration test on a network with some 802.1X protection. I had a good bit going on at the time and Tim got to do all the hands on fun stuff (No.. I’m not bitter). We talked […]

This week Doug Burks and I needed to decrypt a few gigabytes of SSL traffic to find a TCP stream that contained a key word. We learned a bit along the way so I’m passing it along here. First, full packet capture rocks. You are capturing EVERY packet that goes in and out of your […]