/ Recent content on unixawy.com | Security Blog Hugo en-us Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ Fri, 01 Aug 2025 13:02:40 +0000 /sccm-tampering-with-deployment-boundaries-for-eop/ An in-depth analysis of how automated software deployment mechanisms in Microsoft Endpoint Configuration Manager (SCCM / MEM) introduce local privilege escalation vectors via DLL hijacking, race conditions, and WMI triggering. /enterprise-admin-golden-ticket/ Sun, 24 May 2020 03:20:32 +0000 /enterprise-admin-golden-ticket/ How compromising a child Active Directory domain leads to complete forest takeover by injecting the forest Enterprise Admins SID into a forged Golden Ticket (SID History abuse). /dynamic-memory/ Fri, 22 May 2020 04:27:54 +0000 /dynamic-memory/ A deep dive into Linux dynamic memory management: malloc internals, ptmalloc chunk headers, free chunk structures, bins, and allocation syscalls (brk/sbrk vs mmap). /ida-debugger-you-dont-have-the-necessary-privileges/ Thu, 01 Aug 2019 20:46:18 +0000 /ida-debugger-you-dont-have-the-necessary-privileges/ How to resolve the IDA Pro debugger privilege attach error on 64-bit Windows targets using the standalone remote debugging stub (win64_remotex64.exe). /gdb-init/ Mon, 04 Feb 2019 22:35:25 +0000 /gdb-init/ How to configure native GDB stop hooks and Intel disassembly syntax in ~/.gdbinit to automatically display registers, opcodes, and stack memory on break without third-party plugins. /learn-how-to-learn/ Fri, 16 Nov 2018 02:30:49 +0000 /learn-how-to-learn/ Key cognitive principles and mental models for mastering complex technical domains: focused vs. diffuse thinking, working memory chunking, spaced repetition, and active recall. /shellcode-validation-via-c-pointer/ Mon, 15 Oct 2018 17:19:50 +0000 /shellcode-validation-via-c-pointer/ A minimal C harness to test, validate, and debug raw assembly shellcode by casting a byte array into an executable function pointer. /run-mysql-cluster-multi-masters-high-availability/ Tue, 05 Sep 2017 04:20:05 +0000 /run-mysql-cluster-multi-masters-high-availability/ A comprehensive production guide to architecting, deploying, scaling, and managing a distributed, multi-master MySQL NDB Cluster using Oracle MySQL Cluster Manager (MCM). /selinux/ Sat, 23 Jul 2016 21:26:19 +0000 /selinux/ How to query and interpret SELinux Access Vector Cache (AVC) denial events using ausearch, and forward audit logs to centralized rsyslog collectors. /linux-performance-co-pilot-webui/ Sat, 23 Jul 2016 14:38:33 +0000 /linux-performance-co-pilot-webui/ A comprehensive guide to deploying Performance Co-Pilot (PCP), collecting kernel and subsystem metrics with pmcd and pmlogger, and visualizing system telemetry via Vector WebUI. /facebook-mass-invite-like-script/ Thu, 21 Jul 2016 12:46:33 +0000 /facebook-mass-invite-like-script/ A lightweight client-side JavaScript snippet to automate inviting post engagers to follow brand pages via the browser developer console. /docker-persistent-storage-mysql-server-selinux/ Sat, 16 Jul 2016 21:12:28 +0000 /docker-persistent-storage-mysql-server-selinux/ How to configure persistent shared storage for MySQL containers on SELinux-enforced Linux systems (RHEL/CentOS/Fedora) using correct UID ownership and security contexts. /iptables-prerouting-postrouting/ Thu, 14 Jul 2016 16:08:25 +0000 /iptables-prerouting-postrouting/ A guide to implementing complex traffic redirection and routing across multi-homed Linux servers using Netfilter PREROUTING (DNAT) and POSTROUTING (SNAT/MASQUERADE). /phpmyadmin-error-1146-table-phpmyadmin-pma_tracking-doesnt-exist/ Sun, 26 Jun 2016 13:45:41 +0000 /phpmyadmin-error-1146-table-phpmyadmin-pma_tracking-doesnt-exist/ How to resolve MySQL error #1146 (Table 'phpmyadmin.pma_tracking' doesn't exist) on Ubuntu and Debian systems by repairing the phpMyAdmin configuration storage database. /phpmyadmin-no-password-dev-env/ Sun, 26 Jun 2016 13:26:36 +0000 /phpmyadmin-no-password-dev-env/ How to resolve 'Login without a password is forbidden by configuration (see AllowNoPassword)' in phpMyAdmin for local developer environments. /fix-mcrypt-warning-ubuntu-server/ Sun, 26 Jun 2016 12:39:03 +0000 /fix-mcrypt-warning-ubuntu-server/ How to fix the PHP mcrypt module warning on Ubuntu Server when conflicting configuration symlinks prevent php5enmod from activating the extension. /docker-crash-course/ Mon, 30 May 2016 03:00:06 +0000 /docker-crash-course/ A comprehensive guide to Docker core concepts, daemon architecture, interactive vs. detached modes, port mapping, and image customization. /audit-keystrokes-with-pam/ Wed, 07 Oct 2015 22:36:23 +0000 /audit-keystrokes-with-pam/ How to capture and audit real-time interactive TTY keystrokes in Linux using the pam_tty_audit module and aureport, preventing bash history tampering. /protect-bootsingle-user-mode/ Mon, 17 Aug 2015 03:42:42 +0000 /protect-bootsingle-user-mode/ How to prevent unauthorized local console takeovers on Linux by password-protecting GRUB, enforcing sulogin on single-user recovery mode, and disabling console reboot interrupts. /ssh-tunnelling/ Wed, 12 Aug 2015 23:18:08 +0000 /ssh-tunnelling/ A practical guide to SSH port forwarding: local port forwarding (-L), dynamic SOCKS proxies (-D), and reverse remote tunnels (-R) for bypassing NAT and firewalls. /securelock-accounts-with-pam-tally2/ Wed, 05 Aug 2015 00:50:28 +0000 /securelock-accounts-with-pam-tally2/ How to configure PAM to automatically lock accounts after repeated failed login attempts across SSH, consoles, and TTYs using pam_tally2. /password-policy-with-pam_cracklib/ Mon, 03 Aug 2015 18:33:37 +0000 /password-policy-with-pam_cracklib/ A practical guide to enforcing strict password complexity, dictionary checks, and immediate expiration across Linux accounts using pam_cracklib. /pluggable-authentication-modules/ Mon, 03 Aug 2015 16:51:56 +0000 /pluggable-authentication-modules/ A comprehensive guide to Linux Pluggable Authentication Modules (PAM): management groups, control flags, module stacks, and configuration architecture. /regex-to-find-mac-address/ Fri, 31 Jul 2015 00:49:11 +0000 /regex-to-find-mac-address/ Practical regular expressions and grep commands to parse, extract, and validate MAC addresses from system logs, network captures, and digital forensics evidence. /find-duplicated-uid-in-the-linux-system/ Thu, 16 Jul 2015 02:03:09 +0000 /find-duplicated-uid-in-the-linux-system/ How to audit Linux passwd databases for duplicate UIDs—a common indicator of backdoor accounts and local privilege abuse. /users-in-shadow-file-explanation/ Thu, 16 Jul 2015 01:09:24 +0000 /users-in-shadow-file-explanation/ A detailed breakdown of the 9 fields in the Linux /etc/shadow file, password hash algorithms ($1, $5, $6), epoch timestamp math, and account aging with chage. /aide-intrusion-detection-environment/ Tue, 14 Jul 2015 05:05:05 +0000 /aide-intrusion-detection-environment/ How to configure Advanced Intrusion Detection Environment (AIDE) on Linux to detect unauthorized file tampering, privilege escalations, ACL changes, and rootkits. /umask-permissions-explanation/ Fri, 10 Jul 2015 07:16:00 +0000 /umask-permissions-explanation/ How the Linux umask (user mask) controls default permissions on newly created files and directories, binary bitmask calculation, and security hardening. /google-drive-information-leak/ Tue, 07 Jul 2015 00:21:44 +0000 /google-drive-information-leak/ A vulnerability research writeup of an IDOR vulnerability discovered in Google Drive (Google VRP Bounty $3,133.70) that allowed unauthorized listing and leaking of private user files and Gmail attachments. /removable-disk-could-lead-to-privilege-escalation/ Sun, 05 Jul 2015 22:41:43 +0000 /removable-disk-could-lead-to-privilege-escalation/ How auto-mounted removable USB drives and external filesystems without nosuid and noexec mount options allow local privilege escalation on Linux systems. /persistent-mount-for-luks-with-unlock-key/ Sun, 05 Jul 2015 04:18:13 +0000 /persistent-mount-for-luks-with-unlock-key/ How to configure automated headless unlocking and persistent mounting for LUKS block devices on system boot using keyfiles, /etc/crypttab, and /etc/fstab. /linux-disk-encryption-with-luks/ Sun, 05 Jul 2015 02:50:28 +0000 /linux-disk-encryption-with-luks/ A complete step-by-step walkthrough of formatting, unlocking, mounting, and securing encrypted Linux block partitions using cryptsetup and LUKS. /rpm-integrity-and-scripts/ Tue, 30 Jun 2015 02:54:40 +0000 /rpm-integrity-and-scripts/ How to inspect GPG signatures, checksum digests, and embedded root install scriptlets in RPM packages to prevent software supply-chain compromises in Red Hat and CentOS. /redhat-packaging-security-with-yum/ Mon, 29 Jun 2015 09:40:05 +0000 /redhat-packaging-security-with-yum/ How to manage security patching on Red Hat Enterprise Linux and CentOS using YUM security plugins, RHSA IDs, CVE tracking, and updateinfo. /nmap-cheat-sheet/ Tue, 03 Feb 2015 02:17:38 +0000 /nmap-cheat-sheet/ A comprehensive reference guide for Nmap network discovery, TCP/UDP scanning techniques, evasion flags, protocol audits, and NSE scripts. /convert-virtualbox-harddisk-vmware/ Mon, 12 Jan 2015 18:44:44 +0000 /convert-virtualbox-harddisk-vmware/ How to convert virtual disk images between VirtualBox (VDI, VHD) and VMware (VMDK) using qemu-img and VBoxManage. /port-forward-pivoting-meterpreter/ Thu, 08 Jan 2015 22:55:55 +0000 /port-forward-pivoting-meterpreter/ How to pivot through compromised multi-homed hosts into isolated internal networks using Meterpreter's portfwd and Metasploit autoroute. /iptables-redirect-ports-one-port/ Thu, 08 Jan 2015 21:27:08 +0000 /iptables-redirect-ports-one-port/ How to use Linux Netfilter iptables PREROUTING rules with DNAT to redirect broad port ranges or all incoming TCP traffic to a single destination port. /metasploit-payload-executable-exe/ Thu, 08 Jan 2015 17:22:37 +0000 /metasploit-payload-executable-exe/ A quick reference for generating staged and stageless Windows Portable Executable (PE) payloads using Metasploit's msfvenom. /rehat-centos-repository-must/ Sun, 14 Dec 2014 17:44:29 +0000 /rehat-centos-repository-must/ A quick reference for adding essential third-party YUM repositories on Red Hat Enterprise Linux and CentOS (EPEL, IUS, Remi, and RPM Forge). /mysql-force-delete-rows/ Sat, 13 Dec 2014 20:27:08 +0000 /mysql-force-delete-rows/ How to safely bypass MySQL foreign key constraint checks (Error 1451: Cannot delete or update a parent row) using FOREIGN_KEY_CHECKS during database maintenance and migrations. /bruteforce-ftp-files-folders/ Sat, 06 Dec 2014 18:15:48 +0000 /bruteforce-ftp-files-folders/ How to perform dictionary-based directory and file discovery against FTP servers when directory listing permissions (LIST / NLST) are disabled. /smash-stack-level6/ Fri, 05 Dec 2014 00:28:10 +0000 /smash-stack-level6/ A walkthrough of Level 6 on Smash The Stack IO, exploiting struct alignment, language localization buffers, and environment variable shellcode injection. /get-environment-variable-memory-address/ Thu, 04 Dec 2014 19:32:27 +0000 /get-environment-variable-memory-address/ How to reliably determine the memory address of environment variables on the Linux stack during binary exploitation and ret2env attacks. /python-progress-bar/ Thu, 04 Dec 2014 19:04:28 +0000 /python-progress-bar/ How to build a lightweight, dependency-free command-line progress bar in Python using carriage returns and standard output buffers. /duplicate-file-finder-md5sum/ Thu, 04 Dec 2014 18:59:01 +0000 /duplicate-file-finder-md5sum/ A Python script to recursively scan directories, identify duplicate files using cryptographic hash comparisons, and interactively prune redundant data. /truecrypt-password-bruteforce/ Thu, 04 Dec 2014 18:53:52 +0000 /truecrypt-password-bruteforce/ A Python automation script for testing dictionary attacks against encrypted TrueCrypt and VeraCrypt file containers using non-interactive mounting. /django-notes/ Thu, 04 Dec 2014 18:47:46 +0000 /django-notes/ A practical developer reference guide for Django: complex ORM querysets, raw SQL execution, signal dispatching, session management, and custom authentication backends. /automatic-flight-ticket-script/ Thu, 04 Dec 2014 18:37:19 +0000 /automatic-flight-ticket-script/ How to use Python and the Splinter browser automation library to continuously monitor airline reservation systems and automate ticket booking forms. /bitcoin-price-tracker-speech/ Thu, 04 Dec 2014 18:29:01 +0000 /bitcoin-price-tracker-speech/ How to build a real-time cryptocurrency price tracker in Python that triggers audio speech alerts via espeak and desktop notifications via notify-send when market thresholds are crossed. /about/ Thu, 04 Dec 2014 16:17:47 +0000 /about/ Application Security Manager at ServiceNow with 10+ years of experience across application security, offensive operations, and critical infrastructure. /smash-the-stack-level-5/ Wed, 03 Dec 2014 13:59:04 +0000 /smash-the-stack-level-5/ A walkthrough of Level 5 on Smash The Stack IO, developing a classic stack-based buffer overflow exploit with shellcode and NOP sled. /smash-the-stack-level4/ Wed, 03 Dec 2014 13:27:27 +0000 /smash-the-stack-level4/ A walkthrough of Level 4 on Smash The Stack IO, exploiting an unquoted binary call via PATH variable hijacking. /underc0de-3-walkthrough/ Wed, 03 Dec 2014 10:37:59 +0000 /underc0de-3-walkthrough/ A comprehensive Boot2Root walkthrough of the Underc0de 3 challenge: base64 Local File Inclusion (LFI), SSH key discovery, command injection in a Python cronjob, and SUID stack buffer overflow. /smash-the-stack-level3/ Mon, 01 Dec 2014 18:09:38 +0000 /smash-the-stack-level3/ A walkthrough of Level 3 on Smash The Stack IO, exploiting a stack buffer overflow with memcpy to overwrite a function pointer. /smash-the-stack-level2/ Mon, 01 Dec 2014 00:48:04 +0000 /smash-the-stack-level2/ A walkthrough of Level 2 on the Smash The Stack IO wargame, exploiting signed integer overflow with SIGFPE to spawn a privileged shell. /smash-the-stack-level1/ Mon, 01 Dec 2014 00:08:03 +0000 /smash-the-stack-level1/ A walkthrough of Level 1 on the Smash The Stack IO wargame, analyzing a SUID binary using strings and GDB to extract the passcode. /nginx-forward-visitor-real-ip-to-apache/ Sun, 30 Nov 2014 22:08:16 +0000 /nginx-forward-visitor-real-ip-to-apache/ How to configure Nginx reverse proxy headers (X-Real-IP, X-Forwarded-For) and Apache modules (mod_remoteip / mod_rpaf) to restore original client IP addresses in backend access logs. /files-encrypt-with-gpg/ Mon, 24 Nov 2014 15:20:24 +0000 /files-encrypt-with-gpg/ A quick practical guide to symmetric and asymmetric file encryption using GnuPG (GPG) for secure transmission and storage in Linux. /script-mysql-create-database-utf-8-with-user-and-password/ Mon, 24 Nov 2014 08:46:44 +0000 /script-mysql-create-database-utf-8-with-user-and-password/ A Python utility to streamline provisioning MySQL databases configured with UTF-8 character encoding, along with dedicated application users and privileges. /rest-mysql-root-password/ Mon, 24 Nov 2014 08:15:35 +0000 /rest-mysql-root-password/ A practical guide to recovering and resetting a forgotten MySQL or MariaDB root password using skip-grant-tables or an init-file.