https://aegrah.github.io/Recent content on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudSat, 09 May 2026 12:00:00 +0200https://aegrah.github.io/post/2026-05-09-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild.htmlSat, 09 May 2026 12:00:00 +0200https://aegrah.github.io/post/2026-05-09-copy-fail-dirtyfrag-linux-page-bugs-in-the-wild.html At Elastic Security Labs, together with Eric Forte and Samir Bousseaden, we analyzed the Linux kernel privilege escalation vulnerabilities Copy Fail (CVE-2026-31431), Copy Fail 2, and DirtyFrag. These issues exploit subtle page cache corruption bugs to create reliable paths to root access, using legitimate kernel interfaces such as AF_ALG, splice(), and in DirtyFrag's case, networking stack primitives via AF_NETLINK and AF_RXRPC. Copy Fail has been reported as exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog.https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.htmlThu, 02 Apr 2026 12:00:00 +0200https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.html In the second part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I turn from theory to detection engineering. We begin by demonstrating why static detection is often unreliable against Linux rootkits—even trivial modifications like stripping binaries or appending a single null byte can significantly degrade VirusTotal detection rates. From there, we cover practical behavioral detection across userland rootkit loading (LD_PRELOAD, /etc/ld.so.preload, dynamic linker configuration), kernel-space LKM loading via init_module/finit_module syscalls, out-of-tree and unsigned module taint signals, kill-signal abuse, eBPF rootkits, io_uring-based evasion, persistence mechanisms, and defense evasion techniques such as masquerading as kernel threads and log cleansing.https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.htmlThu, 26 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.html At Elastic Security Labs, Remco Sprooten and I analyzed a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink—a cloud-native Linux malware framework first documented by Check Point Research. The dump revealed a multigenerational rootkit framework actively developed and tested across real targets, spanning CentOS 7 through Ubuntu 22.04. VoidLink's architecture immediately stood out: rather than relying on a single technique, it combines a traditional Loadable Kernel Module with eBPF programs in a hybrid design rarely encountered in the wild.https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.htmlFri, 20 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-20-teampcp-container-attack-scenario.html At Elastic Security Labs, I published a real-world walkthrough of TeamPCP's multi-stage container compromise, demonstrating how Elastic's Defend for Containers (D4C) surfaces runtime signals across each stage of the attack chain. Rather than analyzing isolated techniques in abstraction, we follow the attack as it unfolds inside a containerized environment based on the TeamPCP cloud-native ransomware operation documented by Flare. The scenario spans nearly the entire MITRE ATT&CK lifecycle—from initial execution via curl | bash and Kubernetes environment discovery, through lateral movement via kube.https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.htmlThu, 19 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-19-getting-started-with-defend-for-containers.html At Elastic Security Labs, I published a comprehensive walkthrough of Elastic's Defend for Containers (D4C) integration, covering Kubernetes-based deployment, BPF-enriched runtime telemetry analysis, and the practical application of policy-driven security controls for containerized Linux environments. Defend for Containers arrived in Elastic Stack 9.3.0 as a runtime security integration that captures process execution and file access events enriched with container and orchestration context. This post provides a practical starting point for detection engineers: how to deploy D4C via Elastic Agent in Kubernetes, how its selector-response policy model works, which fields matter for detection logic (capabilities, interactive execution, container privilege context), and how to enable the pre-built detection ruleset.https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.htmlThu, 05 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.html In the first part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I explore the theory behind how rootkits work: their taxonomy, evolution, and the hooking techniques they use to subvert the kernel. We trace the progression from early userland shared object rootkits through LKM-based implants, eBPF rootkits, and emerging io_uring-based evasion. The publication covers rootkit loader and payload components, kernel hooking techniques including IDT hooking, syscall table patching, inline hooking, VFS hooking, ftrace and kprobes abuse, the KHOOK framework, userspace LD_PRELOAD interposition, and eBPF program attachment.https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.htmlTue, 01 Apr 2025 12:00:00 +0200https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.html At Elastic Security Labs, Remco Sprooten and I analyzed OUTLAW, a persistent yet unsophisticated auto-propagating coinminer package that remains active across multiple versions despite lacking advanced evasion techniques. It leverages simple but impactful tactics such as SSH brute-forcing, SSH key and cron-based persistence, and manually modified commodity miners and IRC channels. We deployed a honeypot to observe the attackers in action, revealing both automated propagation and manual post-compromise activity—including real-time command entry and even typos from the operator.https://aegrah.github.io/post/2025-02-25-linux-detection-engineering-grand-finale-on-linux-persistence-mechanisms.htmlTue, 25 Feb 2025 12:00:00 +0200https://aegrah.github.io/post/2025-02-25-linux-detection-engineering-grand-finale-on-linux-persistence-mechanisms.html In the fifth and final part of the Linux Persistence Detection Engineering series, we bring the journey to its grand finale by exploring some of the most obscure, creative, and complex persistence mechanisms. Building on the foundational concepts covered in previous publications, this final installment focuses on techniques rooted in the Linux boot process, authentication systems, inter-process communication, and core utilities. We begin with GRUB-based persistence and the manipulation of initramfs, demonstrating both manual modifications and automated approaches using Dracut.https://aegrah.github.io/post/2025-02-11-linux-detection-engineering-approach-the-summit-on-persistence-mechanisms.htmlTue, 11 Feb 2025 12:00:00 +0200https://aegrah.github.io/post/2025-02-11-linux-detection-engineering-approach-the-summit-on-persistence-mechanisms.html In the fourth part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment delves into additional creative and complex methods adversaries use to maintain persistence on Linux systems. We explore the abuse of Pluggable Authentication Modules (PAM), specifically how pam_exec can be leveraged to execute malicious code during authentication events. We also analyze installer package manipulation via RPM and DPKG, where lifecycle scripts are weaponized to establish persistence through package installations and updates.https://aegrah.github.io/post/2025-01-27-linux-detection-engineering-continuation-on-persistence-mechanisms.htmlMon, 27 Jan 2025 12:00:00 +0200https://aegrah.github.io/post/2025-01-27-linux-detection-engineering-continuation-on-persistence-mechanisms.html In the third part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment dives into more creative and complex persistence methods, providing security researchers and defenders with a deeper understanding of how adversaries maintain access on Linux systems. We explore techniques such as dynamic linker hijacking, where adversaries manipulate the dynamic linker through LD_PRELOAD to execute malicious code persistently.https://aegrah.github.io/post/2024-12-12-declawing-pumakit.htmlThu, 12 Dec 2024 12:00:00 +0200https://aegrah.github.io/post/2024-12-12-declawing-pumakit.html At Elastic Security Labs, we uncovered PUMAKIT, a sophisticated multi-stage Linux malware with advanced rootkit capabilities. Initially identified through routine threat hunting on VirusTotal, PUMAKIT consists of a dropper (cron), two memory-resident executables, an LKM rootkit module, and a userland shared object (SO) rootkit. The rootkit, internally named PUMA by its authors, employs ftrace to hook 18 syscalls and multiple kernel functions, enabling stealthy privilege escalation, file and process hiding, and anti-debugging measures.https://aegrah.github.io/post/2024-11-15-falco-workload-protection.htmlFri, 15 Nov 2024 12:00:00 +0200https://aegrah.github.io/post/2024-11-15-falco-workload-protection.html At Elastic, we recognize the critical need for securing containerized applications in Kubernetes and cloud environments. To enhance runtime security, we’ve integrated Falco—an open-source cloud-native security tool—directly with Elastic Security. Falco leverages Linux kernel events and plugins to detect abnormal behavior, security threats, and compliance violations across hosts, containers, and Kubernetes clusters. Building on our recent expansion of cloud security protections using CNCF open-source tools, this research details how the Falco and Elastic Security integration strengthens threat detection at the edge.https://aegrah.github.io/post/2024-09-28-cups-overflow.htmlSat, 28 Sep 2024 12:00:00 +0200https://aegrah.github.io/post/2024-09-28-cups-overflow.html At Elastic Security Labs, we analyzed a critical set of vulnerabilities in the CUPS printing system, disclosed by security researcher Simone Margaritelli (@evilsocket) on September 26, 2024. These flaws, affecting CUPS versions ≤ 2.0.1, enable unauthenticated remote attackers to achieve remote code execution (RCE) via the Internet Printing Protocol (IPP) and mDNS, exploiting UDP port 631. Key weaknesses include input validation flaws in cups-browsed, libcupsfilters, and libppd, as well as the long-unpatched foomatic-rip filter.https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.htmlFri, 27 Sep 2024 12:00:00 +0200https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.html At Elastic Security Labs, we uncovered a sophisticated Linux malware campaign exploiting Apache2 servers since March 2024. Attackers used multiple malware families, including KAIJI (DDoS) and RUDEDEVIL (crypto miner), along with custom tools for persistence and control. They leveraged C2 channels disguised as kernel processes, Telegram bots, and cron jobs. The investigation suggests a potential Bitcoin/XMR mining scheme tied to gambling APIs, hinting at money laundering. Continuous malware development was observed through a file share hosting fresh KAIJI samples.https://aegrah.github.io/post/2024-08-29-linux-detection-engineering-sequel-on-persistence-mechanisms.htmlThu, 29 Aug 2024 12:00:00 +0200https://aegrah.github.io/post/2024-08-29-linux-detection-engineering-sequel-on-persistence-mechanisms.html In this second part of the Linux Persistence Detection Engineering series, I explore the world of more advanced Linux persistence techniques. This part builds upon the knowledge obtained from the previous persistence blog dubbed "Linux Detection Engineering - A Primer on Persistence Mechanisms". This sequel aims to equip defenders and security researchers with a more comprehensive understanding of Linux persistence. With the help of PANIX, a Linux persistence tool I developed, we will simulate these techniques, analyze the logs and observe detection opportunities.https://aegrah.github.io/post/2024-08-21-linux-detection-engineering-primer-on-persistence-mechanisms.htmlFri, 23 Aug 2024 12:00:00 +0200https://aegrah.github.io/post/2024-08-21-linux-detection-engineering-primer-on-persistence-mechanisms.html In this first installment of the Linux Persistence Detection Engineering series, I delve into Linux persistence mechanisms, exploring both common and complex techniques to enhance the knowledge of defenders and security researchers. I examine how these persistence methods operate, how to set them up, and most importantly, how to detect and hunt for them effectively. With the help of PANIX, a Linux persistence tool I developed, I’ll demonstrate practical examples and detection strategies, ensuring you gain a solid understanding of these crucial techniques.https://aegrah.github.io/post/2024-04-09-linux-detection-engineering-with-auditd.htmlTue, 09 Apr 2024 12:00:00 +0200https://aegrah.github.io/post/2024-04-09-linux-detection-engineering-with-auditd.html In this article, I explore how to effectively use Auditd and Auditd Manager for detection engineering. I’ll demonstrate Auditd's powerful features, guide you through the setup process, and show you how to create and modify rules to capture specific behaviors. You'll also learn how to interpret the logs and discover how Auditd Manager, an Elastic integration, enhances Auditd's utility by streamlining its management. Are you interested in this research? The full paper is available at Elastic Security Labs!https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.htmlMon, 31 Jul 2023 12:00:00 +0200https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.html This research delves into large-scale malware analysis conducted by Elastic Security Labs, highlighting how Elastic ingest pipelines were used to filter out benign and duplicate data during dynamic malware analysis. By leveraging these pipelines, we efficiently managed vast datasets, enabling us to focus on identifying malicious behaviors. The study also explores different types of ingest pipelines, their applications, and provides a step-by-step workflow for implementing them, including automation scripts. Finally, we present our findings and discuss how others can replicate this workflow to achieve similar results.https://aegrah.github.io/post/2022-03-30-timelapse-htb-walkthrough.htmlSun, 21 Aug 2022 07:00:00 +0200https://aegrah.github.io/post/2022-03-30-timelapse-htb-walkthrough.html Welcome back! Today we are going to solve the Timelapse machine from Hack The Box. Timelapse is an easy box which focuses on accesible SMB shares and a lot of hash cracking to get the initial foothold. We then find configuration files that allow us to login to the system as the administrator user. Foothold Let's start off with a basic nmap scan. We use -Pn to skip host discovery, -sC to enumerate services, -sV to enumerate service versions and -oN to write to Nmap readable format.https://aegrah.github.io/post/2022-04-10-undetected-htb-walkthrough.htmlTue, 19 Jul 2022 09:00:00 +0200https://aegrah.github.io/post/2022-04-10-undetected-htb-walkthrough.html Today we will be taking a look at the medium box "Undetected" from Hack The Box. The foothold for the box can be found through a vulnerable php script in a directory that should not be world accessible. The script allows for remote code execution onto the box as the www-data user. We then escalate to user by finding an odd looking backup file which is actually an ELF compiled exploit.https://aegrah.github.io/post/2022-06-21-web-application-hacking-server-side-request-forgery.htmlMon, 20 Jun 2022 13:33:35 +0200https://aegrah.github.io/post/2022-06-21-web-application-hacking-server-side-request-forgery.html This blog post will cover server-side request forgery (SSRF) attacks. Along the way we will be covering what a SSRF is, take a look at the basics of a SSRF attack, discuss several more advanced SSRF attacks and learn about the ways to prevent your web application of being vulnerable to these types of attacks. While analyzing the topic, we will be going through several easy and more advanced labs, which are available for free at PortSwigger academy.https://aegrah.github.io/post/2022-04-07-meta-htb-walkthrough.htmlSun, 12 Jun 2022 13:14:53 +0200https://aegrah.github.io/post/2022-04-07-meta-htb-walkthrough.html Welcome to my Hack The Box walkthrough for the "Meta" box. The box is considered to be of medium difficulty. Meta requires you to perform DNS virtual host enumeration, identify the inner workings of an image upload functionality, and exploit this to get a foothold. We then find a vulnerable version of ImageMagick (which is vulnerable to ImageTragick). We exploit this to get user access. Finally we escalate to root privileges through Neofetch, that is allowed to be executed with root permissions.https://aegrah.github.io/post/2022-04-01-timing-htb-walkthrough.htmlSat, 04 Jun 2022 19:00:00 +0200https://aegrah.github.io/post/2022-04-01-timing-htb-walkthrough.html Today we will be taking a look at Timing from Hack the Box. Timing is considered to be of medium difficulty, and requires the usage of a local file inclusion to eventually find credentials for the box. We then find an application that we can run with sudo permissions, and misuse it to gain root access. Foothold Let's start off by initiating an nmap scan, which will enumerate all services and their versions that are running on the machine.https://aegrah.github.io/post/2022-05-19-web-application-hacking-command-injection.htmlWed, 18 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-19-web-application-hacking-command-injection.html In the fourth post regarding web application security, we will be diving into OS command injection or shell injection attacks. We will be covering what command injection is, what different types of command injection attacks exist and how to prevent command injection vulnerabilities within your own web applications. While analyzing the topic, we will be going through several easy and more advanced labs, which are available for free at PortSwigger academy.https://aegrah.github.io/post/2022-05-18-web-application-hacking-directory-traversal.htmlWed, 18 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-18-web-application-hacking-directory-traversal.html In this post we will be taking a look at the directory traversal or path traversal vulnerability. I'll go over what directory traversal exactly is, how we can weaponize it, how we can bypass common protections and misconfigurations and lastly how to prevent it within your own web application. While elaborating on this topic, I will be going through several easy and more advanced examples that are available for free at PortSwigger Academyhttps://aegrah.github.io/post/2022-05-11-web-application-hacking-sql-injection.htmlFri, 13 May 2022 13:33:35 +0200https://aegrah.github.io/post/2022-05-11-web-application-hacking-sql-injection.html This post will explain what SQL-injection (SQLi) is, how we can find SQLi vulnerabilities in web applications, how we can weaponize this vulnerability and how to prevent it. While researching and explaining the topic, we will go through several easy and more advanced examples that are available for free at PortSwigger Academy. What is SQL-injection? Let's first take a look at what SQL exactly is. SQL, or Structured Query Language, is a standard language for storing, manipulating and retrieving data in databases (some examples include but are not limited to MS SQL Server, Oracle and MySQL).https://aegrah.github.io/post/2022-04-05-unicode-htb-walkthrough.htmlSat, 07 May 2022 21:00:00 +0200https://aegrah.github.io/post/2022-04-05-unicode-htb-walkthrough.html Hello everyone, today we are going to take a look at Unicode from Hack The Box. Unicode is a medium box that involves JWT manipulation, local file inclusion and a custom made application that can be used to access the root flag. Foothold As usual, we start off with an nmap scan to enumerate all ports, services and their versions. 1nmap -sC -sV -p- -oA nmap/initial unicode.htb Which provides us with the following results.https://aegrah.github.io/post/2022-02-25-x86-windows-buffer-overflow-pt2.htmlMon, 25 Apr 2022 13:33:38 +0200https://aegrah.github.io/post/2022-02-25-x86-windows-buffer-overflow-pt2.html This tutorial is part two of a two part series that focuses on binary exploitation, in particular on x86 stack-based Windows buffer overflows. The first part of the series focuses on the theory behind the topics that will be described in this tutorial, and can be found here. The information provided in this blog is based on the notes and cheatsheets I wrote while studying for the Offensive Security Certified Professional (OSCP) exam.https://aegrah.github.io/post/2022-02-25-x86-windows-buffer-overflow-pt1.htmlMon, 25 Apr 2022 13:33:35 +0200https://aegrah.github.io/post/2022-02-25-x86-windows-buffer-overflow-pt1.html This tutorial is part one of a two part series that focuses on binary exploitation, in particular on x86 stack-based Windows buffer overflows. This part of the series focuses on the theory behind memory, processors and buffer overflows. We first take a look at some simple c programs and assembly, then dive into the different memory regions and how processes are executed. We then take a look at a vulnerable program in a debugger to see what a buffer overflow looks like.https://aegrah.github.io/post/2022-03-31-shibboleth-htb-walkthrough.htmlThu, 31 Mar 2022 11:25:54 +0200https://aegrah.github.io/post/2022-03-31-shibboleth-htb-walkthrough.html Today we will be taking a look at "Shibboleth" from Hack the Box. To get get a foothold onto the box we first exploit the vulnerable-by-design IPMI protocol to obtain an administrator hash for Zabbix, and crack it. Through Zabbix we can execute local commands and obtain a shell. We can then use a recent MariaDB privilege escalation exploit to escalate to the root user. Foothold As always, we start off with a simple nmap scan to enumerate ports, services and version numbers.https://aegrah.github.io/post/2022-03-29-backdoor-htb-walkthrough.htmlTue, 29 Mar 2022 14:19:37 +0200https://aegrah.github.io/post/2022-03-29-backdoor-htb-walkthrough.html Welcome to my walkthrough for the "Backdoor" machine from Hack The Box. Backdoor is considered to be an easy box. We get a foothold onto the box through the exploitation of a vulnerable web service running at an unusual port. We can then escalate privileges through a screen session that was still open, which was running as the root user. Foothold Today I figured it would be nice to get some tea while the scans were running, so therefore I started the box off with an nmap scan on all ports.https://aegrah.github.io/post/2022-02-17-windows-privilege-escalation.htmlThu, 17 Feb 2022 14:07:56 +0200https://aegrah.github.io/post/2022-02-17-windows-privilege-escalation.html This post is based on the notes and cheatsheets I wrote while studying for the Offensive Security Certified Professional (OSCP) exam, and can be used as a brief reference while looking for basic Windows privilege escalation methods. The contents of this blog originate from the “Windows Privilege Escalation for OSCP & Beyond” course created by Tib3rius. The course is available at Udemy and can be found here. Tib3rius also created a free room at TryHackMe that can be leveraged to practice the techniques outlined in his course and this cheatsheet.https://aegrah.github.io/post/2022-02-17-linux-privilege-escalation.htmlThu, 17 Feb 2022 14:03:19 +0200https://aegrah.github.io/post/2022-02-17-linux-privilege-escalation.html This post is based on the notes and cheatsheets I wrote while studying for the Offensive Security Certified Professional (OSCP) exam, and can be used as a brief reference while looking for basic Linux privilege escalation methods. The contents of this blog originate from the "Linux Privilege Escalation for OSCP & Beyond" course created by Tib3rius. The course is available at Udemy and can be found here. Tib3rius also created a free room at TryHackMe that can be leveraged to practice the techniques outlined in his course and this blog post.