Skip to content

Fix Pelican links #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 16, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions content/2013-06-20-I_feel_lucky.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "I feel lucky - or why I wrote a FreeBSD 1-day in one day"
authors = ["hugsy"]
date = 2013-06-20T00:00:00Z
updated = 2013-06-20T00:00:00Z
aliases = ["/posts/2013/06/20/i-feel-lucky.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2013-12-23-read_write_process_memory_on_linux.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Using new syscalls for read/write arbitrary memory on Linux."
authors = ["hugsy"]
date = 2013-12-23T00:00:00Z
updated = 2013-12-23T00:00:00Z
aliases = ["/posts/2013/12/23/read-write-process-memory-on-linux.html"]

[taxonomies]
tags = ["linux", "kernel", "seccomp"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-03-07-bkpctf-2016-simple-calc-writeup.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "BKPCTF 2016 - Simple Calc"
date = 2016-03-07T22:51:04Z
updated = 2016-03-07T22:51:04Z
authors = ["hugsy"]
aliases = ["/posts/2016/03/07/bkpctf-2016-simple-calc-writeup.html"]

[taxonomies]
tags = ["pwn", "gef", "ida", "bkpctf-2016", "x86"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-03-08-bkpctf-2016-complex-calc.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "BKPCTF 2016 - Complex Calc"
authors = ["hugsy"]
date = 2016-03-08T00:00:00Z
updated = 2016-03-08T00:00:00Z
aliases = ["/posts/2016/03/08/bkpctf-2016-complex-calc.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-03-14-0ctf-2016-warmup-write-up.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "0ctf 2016 - Warmup write-up"
authors = ["hugsy"]
date = 2016-03-14T00:00:00Z
updated = 2016-03-14T00:00:00Z
aliases = ["/posts/2016/03/14/0ctf-2016-warmup-write-up.html"]

[taxonomies]
tags = ["pwn", "gef", "ida", "0ctf-2016", "x86"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-03-22-bctf-16-ruin.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = " BCTF 2016 - Ruin"
authors = ["hugsy"]
date = 2016-03-21T22:51:04Z
updated = 2016-03-21T22:51:04Z
aliases = ["/posts/2016/03/22/bctf-16-ruin.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-03-28-volgactf-2016-web-of-science.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "VolgaCTF 2016 - Web of Science"
authors = ["hugsy"]
date = 2016-03-28T00:00:00Z
updated = 2016-03-28T00:00:00Z
aliases = ["/posts/2016/03/28/volgactf-2016-web-of-science.html"]

["taxonomies"]
tags = ["pwn","volgactf-2016","x86"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-04-01-hitb-teaser-2016-bakery.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "HITB 2016 - Bakery write-up"
authors = ["hugsy"]
date = 2016-04-01T00:00:00Z
updated = 2016-04-01T00:00:00Z
aliases = ["/posts/2016/04/01/hitb-teaser-2016-bakery.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-05-09-asis-ctf-2016-feap.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "ASIS CTF 2016 - feap write-up"
authors = ["hugsy"]
date = 2016-05-09T00:00:00Z
updated = 2016-05-09T00:00:00Z
aliases = ["/posts/2016/05/09/asis-ctf-2016-feap.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-05-23-defcon-ctf-2016-feedme.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "DEFCON CTF 2016 - feedme"
authors = ["hugsy"]
date = 2016-05-23T00:00:00Z
updated = 2016-05-23T00:00:00Z
aliases = ["/posts/2016/05/23/defcon-ctf-2016-feedme.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-05-24-defcon-ctf-2016-heapfun4u.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "DEFCON CTF 2016 - heapfun4u"
authors = ["hugsy"]
date = 2016-05-24T00:00:00Z
updated = 2016-05-24T00:00:00Z
aliases = ["/posts/2016/05/24/defcon-ctf-2016-heapfun4u.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-06-13-armpwn-challenge.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "ARMPWN challenge write-up"
authors = ["hugsy"]
date = 2016-06-13T12:21:05Z
updated = 2016-06-13T12:21:05Z
aliases = ["/posts/2016/06/13/armpwn-challenge.html"]

[taxonomies]
categories = ["ctf", "research"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-08-27-ruxmon-16-making-gdb-great-again.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Ruxmon 08/2016 - Making GDB great again"
authors = ["hugsy"]
date = 2016-08-27T11:52:34Z
updated = 2016-08-27T11:52:34Z
aliases = ["/posts/2016/08/27/ruxmon-16-making-gdb-great-again.html"]

[taxonomies]
categories = ["talk"]
Expand Down
1 change: 1 addition & 0 deletions content/2016-09-06-twctf-2016-reverse-box-writeup.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "TWCTF 2016 - reverse_box writeup"
authors = ["hugsy"]
date = 2016-09-06T00:00:00Z
updated = 2016-09-06T00:00:00Z
aliases = ["/posts/2016/09/06/twctf-2016-reverse-box-writeup.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2017-01-24-armpwn-redux-canary-reloaded.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "ARMPWN redux: canary reloaded"
authors = ["hugsy"]
date = 2017-01-24T00:00:00Z
updated = 2017-01-24T00:00:00Z
aliases = ["/posts/2017/01/24/armpwn-redux-canary-reloaded.html"]

[taxonomies]
tags = ["linux","pwn","arm","ssp","armpwn"]
Expand Down
1 change: 1 addition & 0 deletions content/2017-01-26-insomni-hack-ctf-2017-bender-safe.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Insomni'Hack CTF 2017: bender_safer"
authors = ["hugsy"]
date = 2017-01-26T00:00:00Z
updated = 2017-01-26T00:00:00Z
aliases = ["/posts/2017/01/26/insomni-hack-ctf-2017-bender-safe.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
1 change: 1 addition & 0 deletions content/2017-06-25-qemu-images-to-play-with.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Some Qemu images to play with"
authors = ["hugsy"]
date = 2017-06-25T00:00:00Z
updated = 2017-06-25T00:00:00Z
aliases = ["/posts/2017/06/25/qemu-images-to-play-with.html"]

[taxonomies]
categories = ["misc"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Building a Debian Stretch QEMU image for MIPSel"
authors = ["hugsy"]
date = 2017-07-14T00:00:00Z
updated = 2017-07-14T00:00:00Z
aliases = ["/posts/2017/07/14/building-a-debian-stretch-qemu-image-for-mipsel.html"]

[taxonomies]
tags = ["howto","qemu","mipsel","mips64el"]
Expand Down
1 change: 1 addition & 0 deletions content/2017-08-01-gef-at-black-hat-arsenal-us-2017.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "GEF at Black Hat Arsenal US 2017"
authors = ["hugsy"]
date = 2017-08-01T00:00:00Z
updated = 2017-08-01T00:00:00Z
aliases = ["/posts/2017/08/01/gef-at-black-hat-arsenal-us-2017.html"]

[taxonomies]
categories = ["talk"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Setting up a Windows VM lab for kernel debugging"
authors = ["hugsy"]
date = 2017-08-07T00:00:00Z
updated = 2017-08-07T00:00:00Z
aliases = ["/posts/2017/08/07/setting-up-a-windows-vm-lab-for-kernel-debugging.html"]

[taxonomies]
categories = ["tutorial"]
Expand Down
1 change: 1 addition & 0 deletions content/2017-08-14-a-primer-to-windows-x64-shellcoding.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "A Primer to Windows x64 shellcoding"
authors = ["hugsy"]
date = 2017-08-14T00:00:00Z
updated = 2017-08-14T00:00:00Z
aliases = ["/posts/2017/08/14/a-primer-to-windows-x64-shellcoding.html"]

[taxonomies]
categories = ["tutorial"]
Expand Down
2 changes: 1 addition & 1 deletion content/2017-08-18-first-exploit-in-windows-kernel-hevd.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
+++
title = "First exploit in Windows Kernel (HEVD)"
authors = ["hugsy"]

date = 2017-08-18T00:00:00Z
updated = 2017-08-18T00:00:00Z
aliases = ["/posts/2017/08/18/first-exploit-in-windows-kernel-hevd.html"]

[taxonomies]
categories = ["tutorial", "research"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ date = 2017-08-31T00:00:00Z
updated = 2017-08-31T00:00:00Z
title = "Arbitrary Write primitive in Windows kernel (HEVD)"
authors = ["hugsy"]
aliases = ["/posts/2017/08/31/arbitrary-write-primitive-in-windows-kernel-hevd.html"]

[taxonomies]
categories = ["tutorial", "research"]
Expand Down Expand Up @@ -130,7 +131,7 @@ fffff802`f8cbc25b 7818 js nt!KeQueryIntervalProfile+0x41 (fffff8
So if we use the WWW vulnerability to overwrite `nt!HalDispatchTable[1]` with
the address of our shellcode mapped in a RWX location in userland, then
use the undocumented `NtQueryIntervalProfile` to trigger it, we will make the
kernel execute our shellcode! And game over :)
kernel execute our shellcode! And game over 😀

For those unfamiliar with the [Hardware Abstraction Layer (or HAL)](https://wiki.osdev.org/Hardware_Abstraction_Layer),
it is a software layer aiming to provide a common unified interface to heterogeneous hardware (motherboard, CPUs, network cards, etc.). On Windows, it resides in [`hal.dll`](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-hal-library) that is invoked by `ntoskrnl.exe`:
Expand Down
1 change: 1 addition & 0 deletions content/2017-10-13-flareon-4-writeups.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "FlareOn 4 WriteUps"
authors = ["hugsy"]
date = 2017-10-13T00:00:00Z
updated = 2017-10-13T00:00:00Z
aliases = ["/posts/2017/10/13/flareon-4-writeups.html"]

[taxonomies]
categories = ["ctf"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title = "Building a Debian Stretch QEMU image for AARCH64"
authors = ["hugsy"]
date = 2018-01-07T00:00:00Z
updated = 2018-01-07T00:00:00Z

aliases = ["/posts/2018/01/07/building-a-debian-stretch-qemu-image-for-aarch64.html"]
[taxonomies]
categories = ["tutorial"]
tags = ["gef","qemu","aarch64"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Fuzzing arbitrary functions in ELF binaries"
authors = ["hugsy"]
date = 2018-03-11T00:00:00Z
updated = 2018-03-11T00:00:00Z
aliases = ["/posts/2018/03/11/fuzzing-arbitrary-functions-in-elf-binaries.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2018-11-02-some-time-travel-musings.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Some Time Travel musings"
authors = ["hugsy"]
date = 2018-11-02T00:00:00Z
updated = 2018-11-02T00:00:00Z
aliases = ["/posts/2018/11/02/some-time-travel-musings.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2018-12-02-quick-visualization-of-a-binary-file.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Quick visualization of a binary file"
authors = ["hugsy"]
date = 2018-12-02T00:00:00Z
updated = 2018-12-02T00:00:00Z
aliases = ["/posts/2018/12/02/quick-visualization-of-a-binary-file.html"]

[taxonomies]
categories = ["minis"]
Expand Down
1 change: 1 addition & 0 deletions content/2018-12-30-goodbye-virtualbox-hello-hyper-v.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Goodbye VirtualBox, hello Hyper-V"
authors = ["hugsy"]
date = 2018-12-30T00:00:00Z
updated = 2018-12-30T00:00:00Z
aliases = ["/posts/2018/12/30/goodbye-virtualbox-hello-hyper-v.html"]

[taxonomies]
categories = ["research"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Scripting with Windows Root Directory Object"
authors = ["hugsy"]
date = 2019-01-30T00:00:00Z
updated = 2019-01-30T00:00:00Z
aliases = ["/posts/2019/01/30/playing-with-windows-root-directory-object.html"]

[taxonomies]
categories = [" research"]
Expand Down
1 change: 1 addition & 0 deletions content/2019-03-17-small-dumps-in-the-big-pool.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Small dumps in the big pool"
authors = ["hugsy"]
date = 2019-03-17T00:00:00Z
updated = 2019-03-17T00:00:00Z
aliases = ["/posts/2019/03/17/small-dumps-in-the-big-pool.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2020-03-09-unexpected-logic-bug-win32k.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "An unexpected logic bug on Win32k"
authors = ["hugsy"]
date = 2020-03-09T00:00:00Z
updated = 2020-03-09T00:00:00Z
aliases = ["/posts/2020/03/09/an-unexpected-logic-bug-on-win32k.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2020-05-23-enumerating-process-from-kd.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Enumerating processes from KD"
authors = ["hugsy"]
date = 2020-05-23T00:00:00Z
updated = 2020-05-23T00:00:00Z
aliases = ["/posts/2020/05/23/enumerating-processes-from-kd.html"]

[taxonomies]
categories = ["minis"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Some toying with the Self-Reference PML4 Entry"
authors = ["hugsy"]
date = 2020-06-15T00:00:00Z
updated = 2024-07-01T00:00:00Z
aliases = ["/posts/2020/06/15/some-toying-with-the-self-reference-pml4-entry.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2020-12-29-cheap_sandboxing_with_appcontainers.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Cheap sandboxing with AppContainers"
authors = ["hugsy"]
date = 2020-12-29T00:00:00Z
updated = 2020-12-29T00:00:00Z
aliases = ["/posts/2020/12/29/cheap-sandboxing-with-appcontainers.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2021-01-10-browsing_registry_kernel_mode.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Browsing the registry in kernel-mode"
authors = ["hugsy"]
date = 2021-01-10T00:00:00Z
updated = 2021-01-10T00:00:00Z
aliases = ["/posts/2021/01/10/browsing-the-registry-in-kernel-mode.html"]

[taxonomies]
categories = ["research"]
Expand Down
1 change: 1 addition & 0 deletions content/2022-07-14-setup-hyperv-kdcom.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Setup KDCOM for 2 Hyper-V VMs"
authors = ["hugsy"]
date = 2022-07-14T00:00:00Z
updated = 2022-07-14T00:00:00Z
aliases = ["/posts/2022/07/14/setup-kdcom-for-2-hyper-v-vms.html"]

[taxonomies]
categories = ["minis"]
Expand Down
1 change: 1 addition & 0 deletions content/2022-07-17-windbgx-workspaces.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "WinDbgX undocumented workspace options"
authors = ["hugsy"]
date = 2022-07-17T00:00:00Z
updated = 2022-07-17T00:00:00Z
aliases = ["/posts/2022/07/17/windbgx-undocumented-workspace-options.html"]

[taxonomies]
categories = ["minis"]
Expand Down
1 change: 1 addition & 0 deletions content/2022-08-06-install-hyperv-sandbox-win10home.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Install Hyper-V & Sandbox on Windows 10/11 Home"
authors = ["hugsy"]
date = 2022-08-06T00:00:00Z
updated = 2022-08-06T00:00:00Z
aliases = ["/posts/2022/08/06/install-hyper-v-sandbox-on-windows-1011-home.html"]

[taxonomies]
categories = ["minis"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ title = "Section Objects as Kernel/User communication mode"
authors = ["hugsy"]
date = 2023-04-04T00:00:00Z
updated = 2023-04-04T00:00:00Z
aliases = ["/posts/2023/04/04/section-objects-as-kerneluser-communication-mode.html"]

[taxonomies]
categories = ["research"]
Expand Down