junftnt

This study focuses on the strategies used by the "xz backdoor", an extremely
complex piece of malware that contains its own x64 disassembler inside of it 
to find critical locations in your code and hijacks it by swapping out your 
code with its own as it runs.  Because this a machine-code based attack,
all code written in any program language can be attacked and is vulnerable.

Instead of targeting sshd directly, the xz 
backdoor injects itself in the parent systemd process then hijacks the 
GNU Dynamic Linker (ld), before sshd is even started or libcrypto.so is 

junftnt

Changing a KVM (libvirtd) network configuration

The documentation recommends you do this using virsh net update, but you'll need to read it very carefully to figure out exactly how -- because they provide you with only a single example to work with.

Only the following virtual network components can be changed using net-update:

ip-dhcp-host
ip-dhcp-range (add/delete only, no modify)
forward-interface (add/delete only)

junftnt

/**
 * gcc -o pty-demo pty-demo.c
 * pty-demo bash
 */

#define _XOPEN_SOURCE	600	/* Single UNIX Specification, Version 3 */

#include <fcntl.h>
#include <errno.h>
#include <stdio.h>		/* for convenience */

junftnt

#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>

volatile int running = 1;

junftnt

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"strings"

junftnt

Shibboleth Debugging

Throught this whole process, if you're unsure whether a Shibboleth login session worked (such as if it looks like your application isn't getting attributes etc), you can test by accessing /Shibboleth.sso/Session after going a /Shibboleth.sso/Login cycle and it'll list various details, or state:

A valid session was not found

if it didn't work or you haven't logged in yet.

junftnt

Setting up Qemu with a tap interface

There are two parts to networking within QEMU:

• The virtual network device that is provided to the guest (e.g. a PCI network card).
• The network backend that interacts with the emulated NIC (e.g. puts packets onto the host's network).

Example: User mode network

junftnt

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Debug Kernel",
            "type": "cppdbg",
            "request": "launch",
            "program": "${workspaceRoot}/kernel/bin/kernel.elf",
            "args": [],
            "stopAtEntry": false,

junftnt

# INSIDE WSL, install gdb (one-time instruction)
sudo apt install gdb

# Add the following to your kernel Makefile CFLAGS, so that gcc will generate 
# debug symbols that the debugger can use
# Note: The thing being added is -g, so as of lesson 12 it should look like this.  
# Delete all the contents of the lib folder to force a recompile
CFLAGS = -ffreestanding -fshort-wchar -g

# Add the following to your qemu invocation and start QEmu:

junftnt

# A tiny 16-bit guest "kernel" that infinitely prints an incremented number to the debug port

#
# Build it:
#
# as -32 guest.S -o guest.o
#	ld -m elf_i386 --oformat binary -N -e _start -Ttext 0x10000 -o guest guest.o
#

.globl _start