/categories/security/ Recent content in Security on unixawy.com | Security Blog Hugo en-us Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ An in-depth analysis of how automated software deployment mechanisms in Microsoft Endpoint Configuration Manager (SCCM / MEM) introduce local privilege escalation vectors via DLL hijacking, race conditions, and WMI triggering. /enterprise-admin-golden-ticket/ Sun, 24 May 2020 03:20:32 +0000 /enterprise-admin-golden-ticket/ How compromising a child Active Directory domain leads to complete forest takeover by injecting the forest Enterprise Admins SID into a forged Golden Ticket (SID History abuse). /dynamic-memory/ Fri, 22 May 2020 04:27:54 +0000 /dynamic-memory/ A deep dive into Linux dynamic memory management: malloc internals, ptmalloc chunk headers, free chunk structures, bins, and allocation syscalls (brk/sbrk vs mmap). /ida-debugger-you-dont-have-the-necessary-privileges/ Thu, 01 Aug 2019 20:46:18 +0000 /ida-debugger-you-dont-have-the-necessary-privileges/ How to resolve the IDA Pro debugger privilege attach error on 64-bit Windows targets using the standalone remote debugging stub (win64_remotex64.exe). /gdb-init/ Mon, 04 Feb 2019 22:35:25 +0000 /gdb-init/ How to configure native GDB stop hooks and Intel disassembly syntax in ~/.gdbinit to automatically display registers, opcodes, and stack memory on break without third-party plugins. /shellcode-validation-via-c-pointer/ Mon, 15 Oct 2018 17:19:50 +0000 /shellcode-validation-via-c-pointer/ A minimal C harness to test, validate, and debug raw assembly shellcode by casting a byte array into an executable function pointer. /selinux/ Sat, 23 Jul 2016 21:26:19 +0000 /selinux/ How to query and interpret SELinux Access Vector Cache (AVC) denial events using ausearch, and forward audit logs to centralized rsyslog collectors. /iptables-prerouting-postrouting/ Thu, 14 Jul 2016 16:08:25 +0000 /iptables-prerouting-postrouting/ A guide to implementing complex traffic redirection and routing across multi-homed Linux servers using Netfilter PREROUTING (DNAT) and POSTROUTING (SNAT/MASQUERADE). /audit-keystrokes-with-pam/ Wed, 07 Oct 2015 22:36:23 +0000 /audit-keystrokes-with-pam/ How to capture and audit real-time interactive TTY keystrokes in Linux using the pam_tty_audit module and aureport, preventing bash history tampering. /protect-bootsingle-user-mode/ Mon, 17 Aug 2015 03:42:42 +0000 /protect-bootsingle-user-mode/ How to prevent unauthorized local console takeovers on Linux by password-protecting GRUB, enforcing sulogin on single-user recovery mode, and disabling console reboot interrupts. /ssh-tunnelling/ Wed, 12 Aug 2015 23:18:08 +0000 /ssh-tunnelling/ A practical guide to SSH port forwarding: local port forwarding (-L), dynamic SOCKS proxies (-D), and reverse remote tunnels (-R) for bypassing NAT and firewalls. /securelock-accounts-with-pam-tally2/ Wed, 05 Aug 2015 00:50:28 +0000 /securelock-accounts-with-pam-tally2/ How to configure PAM to automatically lock accounts after repeated failed login attempts across SSH, consoles, and TTYs using pam_tally2. /password-policy-with-pam_cracklib/ Mon, 03 Aug 2015 18:33:37 +0000 /password-policy-with-pam_cracklib/ A practical guide to enforcing strict password complexity, dictionary checks, and immediate expiration across Linux accounts using pam_cracklib. /pluggable-authentication-modules/ Mon, 03 Aug 2015 16:51:56 +0000 /pluggable-authentication-modules/ A comprehensive guide to Linux Pluggable Authentication Modules (PAM): management groups, control flags, module stacks, and configuration architecture. /regex-to-find-mac-address/ Fri, 31 Jul 2015 00:49:11 +0000 /regex-to-find-mac-address/ Practical regular expressions and grep commands to parse, extract, and validate MAC addresses from system logs, network captures, and digital forensics evidence. /find-duplicated-uid-in-the-linux-system/ Thu, 16 Jul 2015 02:03:09 +0000 /find-duplicated-uid-in-the-linux-system/ How to audit Linux passwd databases for duplicate UIDs—a common indicator of backdoor accounts and local privilege abuse. /users-in-shadow-file-explanation/ Thu, 16 Jul 2015 01:09:24 +0000 /users-in-shadow-file-explanation/ A detailed breakdown of the 9 fields in the Linux /etc/shadow file, password hash algorithms ($1, $5, $6), epoch timestamp math, and account aging with chage. /aide-intrusion-detection-environment/ Tue, 14 Jul 2015 05:05:05 +0000 /aide-intrusion-detection-environment/ How to configure Advanced Intrusion Detection Environment (AIDE) on Linux to detect unauthorized file tampering, privilege escalations, ACL changes, and rootkits. /umask-permissions-explanation/ Fri, 10 Jul 2015 07:16:00 +0000 /umask-permissions-explanation/ How the Linux umask (user mask) controls default permissions on newly created files and directories, binary bitmask calculation, and security hardening. /removable-disk-could-lead-to-privilege-escalation/ Sun, 05 Jul 2015 22:41:43 +0000 /removable-disk-could-lead-to-privilege-escalation/ How auto-mounted removable USB drives and external filesystems without nosuid and noexec mount options allow local privilege escalation on Linux systems. /persistent-mount-for-luks-with-unlock-key/ Sun, 05 Jul 2015 04:18:13 +0000 /persistent-mount-for-luks-with-unlock-key/ How to configure automated headless unlocking and persistent mounting for LUKS block devices on system boot using keyfiles, /etc/crypttab, and /etc/fstab. /linux-disk-encryption-with-luks/ Sun, 05 Jul 2015 02:50:28 +0000 /linux-disk-encryption-with-luks/ A complete step-by-step walkthrough of formatting, unlocking, mounting, and securing encrypted Linux block partitions using cryptsetup and LUKS. /rpm-integrity-and-scripts/ Tue, 30 Jun 2015 02:54:40 +0000 /rpm-integrity-and-scripts/ How to inspect GPG signatures, checksum digests, and embedded root install scriptlets in RPM packages to prevent software supply-chain compromises in Red Hat and CentOS. /redhat-packaging-security-with-yum/ Mon, 29 Jun 2015 09:40:05 +0000 /redhat-packaging-security-with-yum/ How to manage security patching on Red Hat Enterprise Linux and CentOS using YUM security plugins, RHSA IDs, CVE tracking, and updateinfo. /nmap-cheat-sheet/ Tue, 03 Feb 2015 02:17:38 +0000 /nmap-cheat-sheet/ A comprehensive reference guide for Nmap network discovery, TCP/UDP scanning techniques, evasion flags, protocol audits, and NSE scripts. /port-forward-pivoting-meterpreter/ Thu, 08 Jan 2015 22:55:55 +0000 /port-forward-pivoting-meterpreter/ How to pivot through compromised multi-homed hosts into isolated internal networks using Meterpreter's portfwd and Metasploit autoroute. /iptables-redirect-ports-one-port/ Thu, 08 Jan 2015 21:27:08 +0000 /iptables-redirect-ports-one-port/ How to use Linux Netfilter iptables PREROUTING rules with DNAT to redirect broad port ranges or all incoming TCP traffic to a single destination port. /metasploit-payload-executable-exe/ Thu, 08 Jan 2015 17:22:37 +0000 /metasploit-payload-executable-exe/ A quick reference for generating staged and stageless Windows Portable Executable (PE) payloads using Metasploit's msfvenom. /bruteforce-ftp-files-folders/ Sat, 06 Dec 2014 18:15:48 +0000 /bruteforce-ftp-files-folders/ How to perform dictionary-based directory and file discovery against FTP servers when directory listing permissions (LIST / NLST) are disabled. /smash-stack-level6/ Fri, 05 Dec 2014 00:28:10 +0000 /smash-stack-level6/ A walkthrough of Level 6 on Smash The Stack IO, exploiting struct alignment, language localization buffers, and environment variable shellcode injection. /get-environment-variable-memory-address/ Thu, 04 Dec 2014 19:32:27 +0000 /get-environment-variable-memory-address/ How to reliably determine the memory address of environment variables on the Linux stack during binary exploitation and ret2env attacks. /duplicate-file-finder-md5sum/ Thu, 04 Dec 2014 18:59:01 +0000 /duplicate-file-finder-md5sum/ A Python script to recursively scan directories, identify duplicate files using cryptographic hash comparisons, and interactively prune redundant data. /truecrypt-password-bruteforce/ Thu, 04 Dec 2014 18:53:52 +0000 /truecrypt-password-bruteforce/ A Python automation script for testing dictionary attacks against encrypted TrueCrypt and VeraCrypt file containers using non-interactive mounting. /smash-the-stack-level-5/ Wed, 03 Dec 2014 13:59:04 +0000 /smash-the-stack-level-5/ A walkthrough of Level 5 on Smash The Stack IO, developing a classic stack-based buffer overflow exploit with shellcode and NOP sled. /smash-the-stack-level4/ Wed, 03 Dec 2014 13:27:27 +0000 /smash-the-stack-level4/ A walkthrough of Level 4 on Smash The Stack IO, exploiting an unquoted binary call via PATH variable hijacking. /underc0de-3-walkthrough/ Wed, 03 Dec 2014 10:37:59 +0000 /underc0de-3-walkthrough/ A comprehensive Boot2Root walkthrough of the Underc0de 3 challenge: base64 Local File Inclusion (LFI), SSH key discovery, command injection in a Python cronjob, and SUID stack buffer overflow. /smash-the-stack-level3/ Mon, 01 Dec 2014 18:09:38 +0000 /smash-the-stack-level3/ A walkthrough of Level 3 on Smash The Stack IO, exploiting a stack buffer overflow with memcpy to overwrite a function pointer. /smash-the-stack-level2/ Mon, 01 Dec 2014 00:48:04 +0000 /smash-the-stack-level2/ A walkthrough of Level 2 on the Smash The Stack IO wargame, exploiting signed integer overflow with SIGFPE to spawn a privileged shell. /smash-the-stack-level1/ Mon, 01 Dec 2014 00:08:03 +0000 /smash-the-stack-level1/ A walkthrough of Level 1 on the Smash The Stack IO wargame, analyzing a SUID binary using strings and GDB to extract the passcode. /files-encrypt-with-gpg/ Mon, 24 Nov 2014 15:20:24 +0000 /files-encrypt-with-gpg/ A quick practical guide to symmetric and asymmetric file encryption using GnuPG (GPG) for secure transmission and storage in Linux.