Infosec on $ pirx^H^H^H^H

wtfis: Passive FQDN and Domain Lookup Tool

Sat, 13 Aug 2022 00:00:00 +0000

I wrote a nifty Python commandline tool for looking up FQDNs and domains using various OSINT sources. It’s definitely useful to me, but I hope it is too to security researchers, incident responders and the like. Check out the project page here:

pirxthepilot/wtfis

It’s available in Pypi, so installation is as easy as

$ pip install wtfis

I wrote this because I wanted a faster way to gather information on a hostname or domain. Most of the time, it is the same set of data that I look for, but spread out across different websites.

Update to Log4shell Detection With Falco

Mon, 20 Jun 2022 00:00:00 +0000

In a prior post I described how to detection potential Log4shell (CVE-2021-44228) exploitation by looking for patterns in a Java process’ write() or sendto() buffer in LDAP and RMI connections. One limitation of this is that it matches on text in the buffer.

The good news is that as of version 0.32.0, Falco now supports matching on raw bytes expressed as hexadecimal strings! This means that we can now match on any pattern in the buffer, not just “human-readable” text.

PwnKit Privilege Escalation Detection

Tue, 07 Jun 2022 00:00:00 +0000

This article describes one way to detect the PwnKit (CVE-2021-4034), a privilege escalation vulnerability on polkit’s pkexec utility.

As with the previous post, we are using Falco for detection and Sysdig for analysis.

Resources

Analysis

Premise

Based on the Qualys report, this exploit depends on GLib to load the privesc code:

To convert messages from one charset to another, iconv_open() executes small shared libraries; normally, these triplets (“from” charset, “to” charset, and library name) are read from a default configuration file, /usr/lib/gconv/gconv-modules. Alternatively, the environment variable GCONV_PATH can force iconv_open() to read another configuration file; naturally, GCONV_PATH is one of the “unsecure” environment variables (because it leads to the execution of arbitrary libraries), and is therefore removed by ld.so from the environment of SUID programs.

Syscall-Based Log4Shell Detection on Linux

Fri, 20 May 2022 00:00:00 +0000

This is a write-up about detecting exploitation of the Log4Shell vulnerability (CVE-2021-44228) in Log4j by monitoring specific syscalls using Falco. This post also describes the analysis I employed to arrive at my conclusions.

Note that this is not meant to be an end-all detection for Log4Shell but instead one of many that, as a whole, provide coverage across different points of visibility.

UPDATE (2022-06-20): This post outlines an alternative way to detect Log4shell, this time using Falco’s brand new byte matching feature.