Talks

Hacks

Bug Bounty

Cyberrange

Reported 5 critical bugs

Ranked #1 in the 2024 Standoff Bug Bounty leaderboard

Ranked #1 in the 2023 Standoff Bug Bounty leaderboard

Reported 100 bugs

Reported 50 bugs

Enjoyed bug hunting and soaking up the sun at Standoff Hacks in Sochi

Summer Hacks '23

Standoff 11 attacker

Initial Access

Valid Accounts

Valid Accounts: Default Accounts

Valid Accounts: Domain Accounts

Valid Accounts: Local Accounts

Valid Accounts: Cloud Accounts

Replication Through Removable Media

External Remote Services

Drive-by Compromise

Exploit Public-Facing Application

Supply Chain Compromise

Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Supply Chain Compromise: Compromise Software Supply Chain

Supply Chain Compromise: Compromise Hardware Supply Chain

Trusted Relationship

Hardware Additions

Phishing

Phishing: Spearphishing Attachment

Phishing: Spearphishing Link

Phishing: Spearphishing via Service

Phishing: Spearphishing Voice

Content Injection

Execution

Windows Management Instrumentation

Scheduled Task/Job

Scheduled Task/Job: At

Scheduled Task/Job: Cron

Scheduled Task/Job: Scheduled Task

Scheduled Task/Job: Systemd Timers

Scheduled Task/Job: Container Orchestration Job

Command and Scripting Interpreter

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: AppleScript

Command and Scripting Interpreter: Windows Command Shell

Command and Scripting Interpreter: Unix Shell

Command and Scripting Interpreter: Visual Basic

Command and Scripting Interpreter: Python

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: Network Device CLI

Command and Scripting Interpreter: Cloud API

Command and Scripting Interpreter: AutoHotKey & AutoIT

Command and Scripting Interpreter: Lua

Software Deployment Tools

Native API

Shared Modules

Exploitation for Client Execution

User Execution

User Execution: Malicious Link

User Execution: Malicious File

User Execution: Malicious Image

Inter-Process Communication

Inter-Process Communication: Component Object Model

Inter-Process Communication: Dynamic Data Exchange

Inter-Process Communication: XPC Services

System Services

System Services: Launchctl

System Services: Service Execution

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Persistence

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts: Logon Script (Windows)

Boot or Logon Initialization Scripts: Login Hook

Boot or Logon Initialization Scripts: Network Logon Script

Boot or Logon Initialization Scripts: RC Scripts

Boot or Logon Initialization Scripts: Startup Items

Account Manipulation

Account Manipulation: Additional Cloud Credentials

Account Manipulation: Additional Email Delegate Permissions

Account Manipulation: Additional Cloud Roles

Account Manipulation: SSH Authorized Keys

Account Manipulation: Device Registration

Account Manipulation: Additional Container Cluster Roles

Account Manipulation: Additional Local or Domain Groups

Create Account

Create Account: Local Account

Create Account: Domain Account

Create Account: Cloud Account

Office Application Startup

Office Application Startup: Office Template Macros

Office Application Startup: Office Test

Office Application Startup: Outlook Forms

Office Application Startup: Outlook Home Page

Office Application Startup: Outlook Rules

Office Application Startup: Add-ins

Browser Extensions

BITS Jobs

Traffic Signaling

Traffic Signaling: Port Knocking

Traffic Signaling: Socket Filters

Server Software Component

Server Software Component: SQL Stored Procedures

Server Software Component: Transport Agent

Server Software Component: Web Shell

Server Software Component: IIS Components

Server Software Component: Terminal Services DLL

Implant Internal Image

Pre-OS Boot

Pre-OS Boot: System Firmware

Pre-OS Boot: Component Firmware

Pre-OS Boot: Bootkit

Pre-OS Boot: ROMMONkit

Pre-OS Boot: TFTP Boot

Create or Modify System Process

Create or Modify System Process: Launch Agent

Create or Modify System Process: Systemd Service

Create or Modify System Process: Windows Service

Create or Modify System Process: Launch Daemon

Create or Modify System Process: Container Service

Event Triggered Execution

Event Triggered Execution: Change Default File Association

Event Triggered Execution: Screensaver

Event Triggered Execution: Windows Management Instrumentation Event Subscription

Event Triggered Execution: Unix Shell Configuration Modification

Event Triggered Execution: Trap

Event Triggered Execution: LC_LOAD_DYLIB Addition

Event Triggered Execution: Netsh Helper DLL

Event Triggered Execution: Accessibility Features

Event Triggered Execution: AppCert DLLs

Event Triggered Execution: AppInit DLLs

Event Triggered Execution: Application Shimming

Event Triggered Execution: Image File Execution Options Injection

Event Triggered Execution: PowerShell Profile

Event Triggered Execution: Emond

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Installer Packages

Event Triggered Execution: Udev Rules

Boot or Logon Autostart Execution

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Boot or Logon Autostart Execution: Authentication Package

Boot or Logon Autostart Execution: Time Providers

Boot or Logon Autostart Execution: Winlogon Helper DLL

Boot or Logon Autostart Execution: Security Support Provider

Boot or Logon Autostart Execution: Kernel Modules and Extensions

Boot or Logon Autostart Execution: Re-opened Applications

Boot or Logon Autostart Execution: LSASS Driver

Boot or Logon Autostart Execution: Shortcut Modification

Boot or Logon Autostart Execution: Port Monitors

Boot or Logon Autostart Execution: Print Processors

Boot or Logon Autostart Execution: XDG Autostart Entries

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Login Items

Compromise Host Software Binary

Modify Authentication Process

Modify Authentication Process: Domain Controller Authentication

Modify Authentication Process: Password Filter DLL

Modify Authentication Process: Pluggable Authentication Modules

Modify Authentication Process: Network Device Authentication

Modify Authentication Process: Reversible Encryption

Modify Authentication Process: Multi-Factor Authentication

Modify Authentication Process: Hybrid Identity

Modify Authentication Process: Network Provider DLL

Modify Authentication Process: Conditional Access Policies

Hijack Execution Flow

Hijack Execution Flow: DLL Search Order Hijacking

Hijack Execution Flow: DLL Side-Loading

Hijack Execution Flow: Dylib Hijacking

Hijack Execution Flow: Executable Installer File Permissions Weakness

Hijack Execution Flow: Dynamic Linker Hijacking

Hijack Execution Flow: Path Interception by PATH Environment Variable

Hijack Execution Flow: Path Interception by Search Order Hijacking

Hijack Execution Flow: Path Interception by Unquoted Path

Hijack Execution Flow: Services File Permissions Weakness

Hijack Execution Flow: Services Registry Permissions Weakness

Hijack Execution Flow: COR_PROFILER

Hijack Execution Flow: KernelCallbackTable

Hijack Execution Flow: AppDomainManager

Power Settings

Privilege Escalation

Process Injection

Process Injection: Dynamic-link Library Injection

Process Injection: Portable Executable Injection

Process Injection: Thread Execution Hijacking

Process Injection: Asynchronous Procedure Call

Process Injection: Thread Local Storage

Process Injection: Ptrace System Calls

Process Injection: Proc Memory

Process Injection: Extra Window Memory Injection

Process Injection: Process Hollowing

Process Injection: Process Doppelgänging

Process Injection: VDSO Hijacking

Process Injection: ListPlanting

Exploitation for Privilege Escalation

Access Token Manipulation

Access Token Manipulation: Token Impersonation/Theft

Access Token Manipulation: Create Process with Token

Access Token Manipulation: Make and Impersonate Token

r0hack