Donald Ashdown
Hack the Box - Poison
A machine involving LFI-RFI, SSH tunneling to access a local port/service.
Search
Donald Ashdown
- Aug 11, 2021
Hack The Box - Chatterbox
Summary Chatterbox was a fantastic machine that involved some CVE troubleshooting with a buffer overflow. This provided the initial foot...
Donald Ashdown
- Jul 30, 2021
Hack the Box Jeeves
Summary This was a fantastic Windows machine that involved deeper enumeration to identify a service running on a non standard port of...
Donald Ashdown
- Jul 23, 2021
Try Hack Me Buffer Overflow 2
Configure Mona - Prepare our environment and temp folder Crash the application - We will use a standard fuzzing script for this that will...
Donald Ashdown
- Jul 10, 2021
Kaseya MSP Incident Response
As someone who has a history of working for MSP's, today might be one of the most memorable days for the remainder of my life. A very...
Donald Ashdown
- Jul 7, 2021
HTB Red Cross
Summary This was an extremely cool box with many paths to gain user and root. The machine starts off with several subdomains requiring...
Donald Ashdown
- Jul 3, 2021
Hack the Box - Spectra Walkthrough
Summary Spectra is a great machine in which your journey will start with WordPress vulnerabilities and a GUI dashboard. Planting a...
Donald Ashdown
- Jun 28, 2021
HTB Cronos
Summary This was a great machine that did not provide anything too challenging or obscure which I really appreciated. It did however test...
Donald Ashdown
- Jun 27, 2021
THM Buffer Over Flow 1
We will be tackling the vulnerable application for the THM buffer overflow challenge level 1. Configure Mona Mona is a script that helps...
Donald Ashdown
- Jun 26, 2021
HTB October
Summary This was a great machine involving guided routes for the initial access to the machine, without many rabbit holes. From here we...
Donald Ashdown
- Jun 23, 2021
HTB Canape
This machine largely involved the enumeration of a git repository and flask application running on a couchDB. Writing a python script...
Donald Ashdown
- Jun 19, 2021
HTB - Delivery
Overview This machine features an IT departments ticketing system that allows you to gain access by registering for a new account out of...
Donald Ashdown
- Jun 17, 2021
WireShark - Pico CTF - twoo twoo - 100 points
This was a fun pcap & wireshark challenge that involved a good initial investigation eventually leading to several HTTP files named...
Donald Ashdown
- Jun 1, 2021
Data Exfiltration with DNS
Data exfiltration is a constantly evolving threat. I wanted to dive in deep on exfiltration techniques such as DNS exfiltration.
Donald Ashdown
- May 26, 2021
Binary Exploitation - PicoCTF- Stonk - 20 points
This is my writeup for a format string vulnerability, that we exploit to read data off the stack.
Donald Ashdown
- May 9, 2021
justCTF 2020 - That's not crypto
This was a simple reverse engineering challenge, however because I am not a developer full time I had to pull in one of my team mates to...
Donald Ashdown
- Apr 25, 2021
What if SSH could VPN?
There is a handy tool that can allow anyone with a user level unprivileged SSH connection to create a VPN tunnel with little overhead....
Donald Ashdown
- Mar 14, 2021
OWASP Top 10 - OS Command Injection
Command Injection 101
Donald Ashdown
- Mar 7, 2021
HTB Tenten
This is a great machine that involves identifying WordPress vulnerabilities and leveraging burpsuite.
Donald Ashdown
- Mar 4, 2021
HTB Doctor
A machine featuring Server side template injection and exploiting Slunk Forwarders.
Donald Ashdown
- Jan 16, 2021
Jigsaw Ransomware Analyses
Jigsaw Ransomware Analysis In this blog we are analyzing Jigsaw ransomware through both static and dynamic approaches with the end goal...
Donald Ashdown
- Jan 13, 2021
HTB LaCasa De Papel
This machine was largely focused around using openssl to custom craft a malicious SSL self signed certificate to gain unauthorized access.
Donald Ashdown
- Jan 3, 2021
THM, Advent of Cyber2, Web Exploitation - Task 6
This challenge deals with cookie manipulation and encoding.
Donald Ashdown
- Dec 5, 2020
HTB Friend Zone
This machines forces critical thinking of DNS records and name lookups. With module injection to finish it off.