root@PandorasBox:~# https://blog.spookysec.net// Fri, 23 Jan 2026 06:25:03 +0000 Fri, 23 Jan 2026 06:25:03 +0000 Jekyll v3.10.0 <p><strong>This post was written as part of my internship with SANS Internet Storm Center.</strong></p> <p>Through November 20 and November 21, 2025, automated vulnerability scanning was identified against the DShield Honeypot from 192[.]159[.]99[.]95 with the goal of gaining remote code execution against potential victims. These probing and scanning activities stood out as interesting as some POST requests were observed attempting to pull down a stage to execute code on the system from a second server (74[.]194[.]191[.]52). A shell script that would have been executed on the system was successfully recovered, and the second stage x86 binary that would be executed on... Fri, 23 Jan 2026 00:00:00 +0000 https://blog.spookysec.net//RondoDox-Botnet/ https://blog.spookysec.net//RondoDox-Botnet/ Analysis Botnet Web DFIR <p><strong>This post was written as part of my internship with SANS Internet Storm Center.</strong></p> <p>To stay in tune with current threats in the cybersecurity landscape, it’s important to periodically review the various threat actors attacking organizations. Having a good working relationship with your Cyber Threat Intelligence (CTI) team can certainly help educate you on the current landscape, but nothing quite beats looking at an actual phishing campaign itself. Phishing is a massive threat to organizations of all sizes, from small businesses to large enterprises. The severity and impact of these campaigns vary, ranging from the execution of malware to the... Tue, 20 Jan 2026 00:00:00 +0000 https://blog.spookysec.net//amex-phish-analysis/ https://blog.spookysec.net//amex-phish-analysis/ Analysis Phishing DFIR <p>We’re onto the next competition category in the CISA ICS CTF - This time we’re taking a look at a challenge in Driftveil City; Register the Dots. This CTF has some infrastructure setup for the players to use; <a href="https://github.com/cisagov/Malcolm">Malcolm</a>, <a href="https://arkime.com/">Arkime</a>, <a href="https://github.com/netbox-community/netbox">NetBox</a> and <a href="https://github.com/gchq/CyberChef">CyberChef</a>. We probably won’t be using any of these services, but I’m putting this disclaimer in there just in case so we’re all on the same page if you see me use any of the tools.</p> <p><img src="https://blog.spookysec.net/img/Pasted image 20240903211847.png" alt="[Pasted image 20240903211847.png]" /></p> <h3 id="registering-the-dots-1-2a-2b">Registering the Dots 1, 2a, 2b</h3> <p>The challenge starts... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-Reg-the-Dots.md/ https://blog.spookysec.net//CISA-ICS-CTF-Reg-the-Dots.md/ CTF CISA <p>I’d like to think this forensics challenge is word play for RAM (Random Access Memory &amp;&amp; Read Askew Manuscripts), with a little bit of hinting at future challenges to come. This was a great one, so buckle up and let’s get on into it. After this last challenge set in Virbank, it’s Potpourri.</p> <h3 id="read-askew-manuscripts-1">Read Askew Manuscripts 1</h3> <p>Virbank Medical has recieved a call from Driftveil Police with news. Patient data x-ray data was stolen. Our task is to identify who dunnit! First of all, we need to identify the Serial Number of the X-Ray machine to verify our memory... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-RAM.md/ https://blog.spookysec.net//CISA-ICS-CTF-RAM.md/ CTF CISA <p>Onto the next challenge category in the CISA ICS CTF - Virbank City. This time we’re going to be taking a look at the Mission Inconceivable challenge set. There was a ton to learn from this one, so I’m excited to take a shot at this one next.</p> <p>This CTF has some infrastructure setup for the players to use; <a href="https://github.com/cisagov/Malcolm">Malcolm</a>, <a href="https://arkime.com/">Arkime</a>, <a href="https://github.com/netbox-community/netbox">NetBox</a> and <a href="https://github.com/gchq/CyberChef">CyberChef</a>. Some of these services we’ll be using in this challenge, some won’t. I’ll probably put this brief little introduction in each post so we’re all on the same page. Anyways, onto the... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-Mission-Inconceivable.md/ https://blog.spookysec.net//CISA-ICS-CTF-Mission-Inconceivable.md/ CTF CISA <p>Well, another year has passed, which means its time for my annual CTF competition. This year I’m doing CISA’s ICS CTF solo-mode. This CTF has some infrastructure setup for the players to use; <a href="https://github.com/cisagov/Malcolm">Malcolm</a>, <a href="https://arkime.com/">Arkime</a>, <a href="https://github.com/netbox-community/netbox">NetBox</a> and <a href="https://github.com/gchq/CyberChef">CyberChef</a>. Some of these services we’ll be using in this challenge, some won’t. I’ll probably put this brief little introduction in each post so we’re all on the same page.</p> <p>Today we’re going to start off with the Modeling Trains challenges. This is under the Anville category, so all of these are Rail/Transport themed challenges, one of the important... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-Mdl-Trains.md/ https://blog.spookysec.net//CISA-ICS-CTF-Mdl-Trains.md/ CTF CISA <p>Another challenge from Virbank city - this time Virbank employees have been spotted installing unauthorized software. An FTP server was recently setup on one of the hospital’s servers (yikes) and has been used for hosting video games and such! They identified an interesting executable of interest that is stored in <strong>malcolm</strong>. Our task is to find it and retrieve the hash.</p> <p>This CTF has some infrastructure setup for the players to use; <a href="https://github.com/cisagov/Malcolm">Malcolm</a>, <a href="https://arkime.com/">Arkime</a>, <a href="https://github.com/netbox-community/netbox">NetBox</a> and <a href="https://github.com/gchq/CyberChef">CyberChef</a>. Some of these services we’ll be using in this challenge, some won’t. I’ll probably put this brief little introduction... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-Follow-the-Charts.md/ https://blog.spookysec.net//CISA-ICS-CTF-Follow-the-Charts.md/ CTF CISA <p>Oh boy, we’re down to the final few challenges! We’re back in the Verbank category with “Extend Your Stay”. This time Virbank Medical has detected a suspicious browser add-on installed on a users device; The question is to RE the extension and identify the flag. Let’s dive into it!</p> <h3 id="extend-your-stay-1">Extend Your Stay 1</h3> <p>Okay, so we’re given a Chrome Extension (.crx) and we now need to do some analytical work on it. Like most things in live, proprietary file extensions are a fancy archive of sorts. There’s an awesome website out there <a href="https://www.ezyzip.com/open-extract-crx-file.html">ezyZip</a> that allows us to extract... Tue, 03 Sep 2024 00:00:00 +0000 https://blog.spookysec.net//CISA-ICS-CTF-Extend-Your-Stay.md/ https://blog.spookysec.net//CISA-ICS-CTF-Extend-Your-Stay.md/ CTF CISA <p>After a short nap and an Obsidian update, I’m back! This time we’re going to tackle Split32. We’re going to dive right into this guy and not spend as much time on initial theory unless relevant.</p> <h3 id="initial-program-usage--static-reing">Initial Program Usage &amp; Static REing</h3> <p>We should always initially use the program like an actual user before we dive into any behavior so we get a solid understanding of how the application actually works.</p> <p><img src="https://blog.spookysec.net/img/Pasted image 20240629201433.png" alt="[https://blog.spookysec.net/img/Pasted image 20240629201433.png]" /> <em>Much like ret2win, it simply asks the user for input.</em></p> <p>Great, now that we’re totally 100% sure that’s all the... Sat, 29 Jun 2024 00:00:00 +0000 https://blog.spookysec.net//ROP-Emporium-Split32/ https://blog.spookysec.net//ROP-Emporium-Split32/ Linux Cyber Security Exploitation <p>Wow, it’s been a long while since I’ve written one of these things. Just over 7 months to be exact, going forward into ‘24, I should really be better about that.</p> <p>Anyways, I’m traveling this weekend and just finished up SANS SEC660/GXPN (I passed btw!). One of my major weakpoints in offensive ops is Binary Exploitation - I really truly suck at it and this is kinda my last ditch effort to try to be good at it. After failing OSED last year, I kinda went into crisis mode and had a moment of clarity.</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>It's... Fri, 28 Jun 2024 00:00:00 +0000 https://blog.spookysec.net//ROP-Emporium-ret2win/ https://blog.spookysec.net//ROP-Emporium-ret2win/ Linux Cyber Security Exploitation