Author Archives: Shuzheng

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

Posted on by

I’m implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server.
I’ve read RFC4559, which describes how authentication should be performed:
https://datatracker.ietf.o… Continue reading SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?→

Does Microsoft implement "Windows Defender"-like security for WSL 2 instances?

Posted on by

I’m not certain whether WSL 2 instances, running in Hyper-V, are actually scanned by Windows Defender.
I have found some articles on Google describing Window Defender’s performance impact on WSL, but they are not mentioning whether they ar… Continue reading Does Microsoft implement "Windows Defender"-like security for WSL 2 instances?→

Why does Docker use the same user and cgroup namespaces by default, when starting a new container? [migrated]

Posted on by

Why does Docker use the same user and cgroup namespaces by default, when starting a new container?

I don’t understand why Docker doesn’t set up a new user namespace, so that root in the container isn’t the same as root on the host.

… Continue reading Why does Docker use the same user and cgroup namespaces by default, when starting a new container? [migrated]→

heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?

Posted on by

I’m currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy():

https://exploit.education/phoenix/heap-one/

struc… Continue reading heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?→

Why isn’t the checksum length increased on macOS to mitigate generic heap exploitation?

Posted on by

I’ve been studying heap exploitation on Linux/macOS for learning purposes.

Many of the generic exploits on macOS rely on brute-forcing the 4-bit checksum derived from the rack’s cookie value. This effectively results in a 2^… Continue reading Why isn’t the checksum length increased on macOS to mitigate generic heap exploitation?→

How to execute a command directly on the host system through docker.sock in a Docker container?

Posted on by

I’ve been studying Docker security and examining ways of escaping from container to host.

Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker client (docker) can send comma… Continue reading How to execute a command directly on the host system through docker.sock in a Docker container?→

What’s the use of an "extra" dynamic declaration in an external DTD blind XXE attack?

Posted on by

I’ve been studying XXE attacks through Portswigger’s Web Security Academy. I stumbled upon a lab Exploiting blind XXE to exfiltrate data using a malicious external DTD.
In this lab an attacker has to define an entity within XML request to … Continue reading What’s the use of an "extra" dynamic declaration in an external DTD blind XXE attack?→