Over the last 20 years I’ve used many environments for programming and editing files (vim, Emacs, Eclipse, NetBeans, PHPStorm, Visual Studio, just to name some). While I will use the right tool for the right job, I’m partial to Emacs. Emacs is easy to extend – You can modify Emacs while it’s running, within Emacs.…
All posts by justintaft
.NET Deserilization Gadgets
The use of BinaryFormatter in .NET applications often leads to Remote Code Execution quite easily. See https://github.com/pwntester/ysoserial.net for example gadgets. When testing the TypeConfuseDelegate payload in your own project, a couple of exceptions may be thrown: ‘Object must implement IConvertible’ – This occurs when the appropriate deserialization types can not be found. Check to ensure…
Applying SELinux Tags To Allow Cross-VM Disk Access
Fedora uses SELinux’s Multi Category Security to restrict VMs from accessing other VMs backing disks. Each VM is assigned a randomized category number when starting. When accessing a VM disk file from another running VM, such as by sharing a directory, an error similar to the following is logged by systemd: audit[26742]: AVC avc: denied…
Creating and backing up security sensitive VMs using KVM and Borg
It’s Thursday night. You’ve been hacking away at a web app all week. All of a sudden your laptop turns off because you forgot to plug in the power cord. No bigge you think. You plug your laptop in, boot it up, and start the VM you’ve been using. Crap, you sigh to yourself, as…