posts on djnn@localhost

exploit dev is just graph search

djnnvx@mailfence.com (djnn) — 22 Oct 2026

every so often a talk reorganises how i think about something. Dion Blazakis’s XNU case study did that to me. he relearned a kernel he hadn’t seriously touched since 2010 and built a local privilege escalation in about five days, with an LLM doing a big chunk of the grunt work.

none of this exploit is mine. it’s Dion’s, all of it, from his [un]prompted.au talk and two public Apple CVEs. i just pulled on it, because i keep going back and forth on where AI is actually useful in vuln research and where it’s just a demo.

how to log in where you shouldn't (funny red team trick ?)

djnnvx@mailfence.com (djnn) — 06 Sep 2026

Recently, I was reading the source code for Linux’s PAM (as one does), and I found something funny. It can enable lateral movement during a red team engagement. Now, I don’t know if this trick is well-known or not, but to be honest, I don’t care much. It’s my blog, and I’ll write whatever the fuck I want ! Besides, I didn’t get to try it outside of a lab of my own creation, so it might just not be that good actually. Who knows. At least, you’ll go to sleep having learned something new.

more usb fun

djnnvx@mailfence.com (djnn) — 22 May 2026

Oh you thought I was done, did you ?

Last time I wrote about USB/IP, we discussed an issue I found in the Linux kernel related to USB-IP, but it was fixed before I could actually finish it, and at least confirm RIP control.

So I went back through my notes, and noticed I hadn’t actually fired one of the entries, a server-side TOCTOU in stub_recv_cmd_unlink. The note next to it said “clearly racy” and not much more. (yeah, in hindsight I should have circled back sooner.)

two months too late (linux kernel 1day)

djnnvx@mailfence.com (djnn) — 19 May 2026

Hey, it has been a while. :)

A coworker had been poking at USB/IP recently and I figured I’d take a look at the kernel side of it. After all, it’s just there. The protocol tunnels USB over TCP, no authentication on the wire, and the client kernel just parses whatever bytes the server sends. That is the kind of attack surface I will absolutely spend a weekend on. Moreover, USB is very stateful. It smells like bugs.

the impossible task of securing AI agents

djnnvx@mailfence.com (djnn) — 28 Jan 2026

Recently, I came across this project (initially called clawdbot, renamed moltbot). On paper, it is a cool project. It feels like the kind of thing you expect from all those AI agents. It’s open-source, free, maintained mostly by one guy.

I know I’ve had strong opinions about AI things, but I want to positively outline the work this dude made, by himself, and that he maintains for free. It’s cool, and I hope he can make it great.

making a keylogger for linux

djnnvx@mailfence.com (djnn) — 18 Jan 2026

Hello again, today I’d like to share on a project I’ve been working on, on and off for a long time.

Every now and then, I would pick up again this project but I think it is now in a releasable state. First, let’s see a short demo, from yours truly.

As you can see, it is a userland keylogger, written in C. Let’s go over key features, how they were implemented and how it could be improved in the future.

windows11 qemu notes

djnnvx@mailfence.com (djnn) — 17 Jan 2026

Recently, I experimented a bit with different Operating Systems. Maybe that could be an interesting post for the future. During my various tests, I wanted to keep working on projects, of course.

That means that I had at some point the need to setup a VM for Windows 11. I usually pick qemu, with virt-manager for these things as it is the most lightweight and I don’t need anything crazy. However, this process has become somewhat tedious recently, so I thought I’d document it here.

writing your own traceroute is surprisingly easy

djnnvx@mailfence.com (djnn) — 14 Dec 2025

Until you know how they work, programs related to networking always kind of feel like magic, at least to me. However, I have written enough code to know that there is no such thing as magic, just clever ideas that are properly implemented.

Some things I work on at $work touch a bit on the side of networking, and that drove me to be interested in the ICMP protocol, particularly traceroute.

Tengucon OSINT CTF

djnnvx@mailfence.com (djnn) — 22 Nov 2025

Recently, I’ve had the extreme pleasure of designing and setting up the challenges for the OSINT category of the Tengucon CTF.

If you want to learn more about Tengucon, you can do so here: https://tengucon.org/

Sadly, I was not in attendance for the event, but I was there in spirit. It was my first time designing and implementing CTF challenges from scratch, so I really hope the players enjoyed it.

Let’s look at the solutions !

anthropic's paper smells like bullshit

djnnvx@mailfence.com (djnn) — 16 Nov 2025

A report was recently published by an AI-research company called Anthropic. They are the ones who notably created Claude, an AI-assistant for coding. Personally, I don’t use it but that is besides the point. Before we start, it’s important to say I don’t have anything against them, or AI in general. I do have some documented concerns but I am not “Anti-AI”, or whatever. Rather than the technology itself, it’s the industry’s perception of it, and the way it is inserted everywhere, even when unnecessary that bothers me. However, that too is a bit besides the point.

something about AI models (artificial.htb write-up)

djnnvx@mailfence.com (djnn) — 25 Oct 2025

Hey, it has been a while. :)

Today, I am sharing a write-up for a Linux lab, available on Hackthebox with an easy difficulty level. It took me about 2 hours to complete it. I could have finished it earlier, but I am not interested in rushing and my VPN is unfortunately quite slow, because of the region I live in.

Anyways, let’s get started.

from recon to foothold

The recon process was pretty simple, I just ran a basic nmap scan:

ADCS shenanigans (tombwatcher.htb write-up)

djnnvx@mailfence.com (djnn) — 12 Oct 2025

Apologies for the late release, I recently got sick and could not be asked to write or deploy things.

Anyways, let’s get started. Today, we’re doing tombwatcher, which is a Medium-level windows box on HackTheBox. It actually took me a while to finish it (especially to get root), because of my lack of experience with ADCS.

As is common with most Windows boxes, we get credentials to emulate an “assumed-breach” scenario. Here are the credentials in this case: henry:H3nry_987TGV!

bloodhound spray and pray (puppy.htb write-up)

djnnvx@mailfence.com (djnn) — 28 Sep 2025

Hello again, my friends. :)

Today, I am sharing my notes on how I solved puppy.htb, a Medium-level box on HackTheBox. Like many, I have less experience with Windows Active Directory environments. We don’t use it at $work, and I am not focused on anything related to pentesting at the moment. I hope that, like for me, this will be a teachable moment for you.

Let’s start.

initial recon

Like always, I start by running an nmap scan.

certificates, certificates ~ fluffy.htb write-up

djnnvx@mailfence.com (djnn) — 22 Sep 2025

Good morning, my friends.

Today, I am sharing a write-up on an easy-level Windows box, running with active directory. If you don’t have any experience with certificates and authentication on AD, it can be challenging. However, it is somewhat straightforward if you have a bit of experiecne.

recon

Let’s scan the network using nmap, as is common at the beginning of HTB boxes.

Looking at the scan results, we discover what looks like an Active Directory environnement:

kim-cyka continued

djnnvx@mailfence.com (djnn) — 22 Aug 2025

EDIT: a trustable journalist has posted an update here: https://x.com/koryodynasty/status/1979048385937121406

it is alledged the perpetrators are Chinese-affiliated, and possibly responsible of a fire in a bunch of Korean datacenters too: https://www.news1.kr/local/moi/5927009

This is the second part of the investigation into KIMSUKI’s leak.

We had already explored this in our first post, but as a reminder:

This seem to be a Linux dev machine, mounted through hgfs
Approximately 20,000 records Brave / Chrome browser histories. These records reveal numerous email addresses accessed, websites visited, and tools downloaded.
A large number of passwords were found in the file mnt/hgfs/Desktop/fish_25327/vps20240103.docx. These passwords include email and VPS passwords:
- center2025a@tutamail.com:H4FHKMWMpX8bZ (https://sg24.vps.bz:4083)
- dysoni91@tutamail.com:dr567h%a”G6*m (https://monovm.com)
- root:1qaz2wsx
- dysoni91@tutamail.com:!QAZ4rfv!@#$

This server was used for various phishing campaigns (vps1735811325, hosted on vps.bz). The SSL certificates and auth.log on the server are noteworthy, and indicates attacks on several entities.