Blog | OffSec

Blog

News and updates from OffSec

Unattended installation with PXE
Kali Linux

Aug 12, 2013

4 min read

Kali Linux Unattended PXE Install

Our last blog post on the Kali Linux site discussed implementing some cool scenarios with Kali Linux, such as remote unattended installations, creating custom Kali Linux ISOS, and getting Kali working on funky ARM hardware. We received several emails from people asking for more information on how to implement these scenarios, so we thought we’d make a few blog posts with more detailed examples.

Read more
Kali Linux on a Galaxy Note 10.1

Kali Linux

Kali Linux on a Galaxy Note 10.1

Here at Offsec, we love playing with hardware. Be it something like the Onity Hotel Door Unlocker, a Teensy USB HID attack payload, or RFID hacks – if it’s shiny, we like it. While we were in the last stages of developing Kali Linux, we made the effort to to get Kali working on some ARM hardware, such as the Samsung Chromebook, Odroid U2, Raspberry Pi and RK3306 devices such as the SS808, and then contributed these to the community as “Unofficial Trusted Images”, together with the Official Kali Linux downloads.

Apr 2, 2013

2 min read
Kali Linux a new dawn has come...

Kali Linux

Kali Linux Has Been Released!

Seven years of developing BackTrack Linux has taught us a significant amount about what we, and the security community, think a penetration testing distribution should look like. We’ve taken all of this knowledge and experience and implemented it in our “next generation” penetration testing distribution.

Mar 13, 2013

1 min read
BackTrack Reborn - Kali Linux

Kali Linux

BackTrack Reborn – Kali Linux

It’s been 7 years since we released our first version of BackTrack Linux, and the ride so far has been exhilarating. When the dev team started talking about BackTrack 6 (almost a year ago), each of us put on paper a few “wish list goals” that we each wanted implemented in our “next version”. It

Jan 22, 2013

1 min read
Yahoo XSS 0-Day

Research & Tutorials

Yahoo DOM XSS 0day – Not fixed yet!

After discussing the recent Yahoo DOM XSS 0day with Shahin from Abysssec.com, it was discovered that Yahoo’s fix set in place on 6:20 PM EST, Jan 7th, 2013 is not effective as one would hope.

Jan 8, 2013

2 min read
Fun with AIX Shellcode and Metasploit

Exploit Development

Fun with AIX Shellcode and Metasploit

In one of our recent pentests, we discovered an 0day for a custom C application server running on the AIX Operating System. After debugging the crash, we discovered that the bug could lead to remote code execution and since we don’t deal very often with AIX exploitation, we decided to write an exploit for it. The first steps were accomplished pretty quickly and we successfully diverted the execution flow by jumping to a controlled buffer. At this point, we thought we could easily generate some shellcode from MSF and enjoy our remote shell.

Nov 20, 2012

6 min read
CA ARCserve – CVE-2012-2971

Exploit Development

CA ARCserve – CVE-2012-2971

On a recent penetration test, we encountered an installation of CA ARCserve Backup on one of the target systems that piqued our interest. Like most “good” enterprise applications, ARCserve has processes that are running as SYSTEM so naturally, we went straight to work looking for vulnerabilities.

Oct 30, 2012

11 min read
Onity Door Unlocker Round Two

Research & Tutorials

Onity Door Unlocker, Round Two.

On one of our engagements, we figured an Onity Hotel door unlocker would be useful to us. Inspired by the “James Bond” type setup we saw on the Spiderlabs blog post, we thought we’de try to build a small, simple and “TSA friendly” version of the Onity key unlocker.

Oct 23, 2012

2 min read
Stand-Alone EM4x RFID Harvester

Research & Tutorials

Stand-Alone EM4x RFID Harvester

Continuing off from our last RFID Cloning with Proxmark3 post, we wanted to build a small, portable, stand-alone EM4x RFID tag stealer. We needed an easy way of storing multiple tag IDs whilst “rubbing elbows” with company personnel. The proxmark3 seemed liked an overkill and not particularly fast at reading em4x tags so we figured we’d try hooking up our RoboticsConnection RFID reader to a Teensy and see if we could make them play nicely together.

Sep 27, 2012

2 min read
Cloning RFID Tags with Proxmark 3

Research & Tutorials

RFID Cloning with Proxmark 3

Our Proxmark 3 (and antennae) finally arrived, and we thought we’d take it for a spin. It’s a great little device for physical pentests, allowing us to capture, replay and clone certain RFID tags.

Sep 24, 2012

5 min read
Offsec BlackHat / Defcon Scavenger Hunt

Enterprise Security

Offsec BlackHat / Defcon Scavenger Hunt

Are you in Vegas for BlackHat and Defcon ? Are you desperately looking for Offensive Security schwag ? We are giving out Metasploit books, BackTrack Challenge coins and large sized BackTrack Decals in this years BlackHat and Defcon conferences. So, what exactly does one need to do to get these wonderful, sought after gifts ? It’s easy:

Jul 24, 2012

2 min read
FreePBX Exploit Phone Home

Research & Tutorials

FreePBX Exploit Phone Home

During a routine scan of new vulnerability reports for the Exploit Database, we came across a single post in full disclosure by Martin Tschirsich, about a Remote Code Execution vulnerability in FreePBX. This vulnerability sounded intriguing, and as usual, required verification in the EDB. At first glance, the vulnerability didn’t jump out at us, especially as we are not familiar with the inner workings of asterisk. After a couple of emails back and forth with Martin, the path to code execution became clearer:

Mar 23, 2012

3 min read
Modern Warfare Students vs Trainers 0x2

OffSec News

Announcing the OSEE Certification

Since the inception of our Advanced Windows Exploitation (AWE) course, our students (who are always searching for more pain) have been asking for an accompanying certification exam. We are very pleased to announce the launch of the Offensive Security Exploit Expert (OSEE) certification.

Jan 16, 2012

2 min read

Showing 287 - 299 of 377 entries