Michael Edie

Decoding OWA Ids in On-Prem Exchange

Tue, 20 May 2025 22:58:14 +0000

If you’ve analyzed Outlook Web Access (OWA) logs in an on-premises Exchange environment, you’ve likely run into strange Base64-encoded strings embedded in GetFileAttachment HTTP requests. At first glance, decoding one of these strings might yield a GUID-like result—encouraging, but ultimately not actionable on its own. What’s buried deeper, though, is far more useful: a MAPI EntryId.

With the right decoding and inspection techniques, you can extract the PR_ENTRYID—a native Exchange identifier that precisely maps to the email in question. This capability becomes especially valuable in environments where mailbox auditing is unavailable or incomplete. In such cases, decoding the Id parameter from OWA requests may be the only way to determine what an attacker actually accessed.

Background & Experience

Wed, 01 Jan 2025 00:00:00 +0000

Honeypot Diaries: SSH Authorized Keys

Sun, 16 Apr 2023 14:57:27 +0000

One of the many reasons I decided to deploy honeypots is to be able to observe attacker tactics, techniques, and procedures (TTPs). This blog post will share a frequently used tactic that attackers use to keep access once they have compromised one of my distributed honeypots. You may benefit from the rest of this content if you use or manage systems that allow remote access using a Secure Shell (SSH) client.

Migrating Splunk Storage to S3 SmartStore

Sat, 01 Apr 2023 03:53:24 +0000

Splunk is a software technology that allows you to index, search, analyze, and visualize data at scale. I use it to ingest logs from my honeypots, homelab, and other projects. Initially, I had Splunk running in a local virtual machine where everything was fine except for the downtime, so I rapidly migrated it to an Amazon Web Services (AWS) Elastic Compute Cloud (EC2) instance. Migrating to the cloud was also a forcing function to increase my knowledge of AWS. I learned a lot daily about the ecosystem; cost optimization was one of those beautiful lessons. A short guide follows on how I transitioned an existing Splunk deployment to S3 SmartStore.

Managing Password Hygiene

Wed, 01 Mar 2023 04:16:00 +0000

According to a study by NordPass, the average user with an online presence has about 80-100 passwords. This explains to some degree why individuals tend to use easy passwords. Just take a moment to think about how many passwords you have. What’s the current state of your password hygiene? Do you use the same password to log into more than one account? Do you share passwords?

Password Complexity

When I think about password hygiene, three things come to mind, password complexity, password recycling, and password exposure. The National Institute of Science and Technology (NIST) has said that particular attention should be given to password length over complexity since people tend to choose passwords that meet complexity requirements but are easy to guess. For example, ’ P@ssw0rd123’ seems secure but has predictable attributes that make it much easier to crack.

Email Spam: Forgotten Bitcoin

Fri, 20 Jan 2023 01:20:24 +0000

This is the first installment of a spam email series where I investigate what happens when you click on those links we security professionals keep telling you not to click on. I hope it provides some value to someone and keeps one less person from falling prey to these ever-prevalent schemes.

Like most of you, I logged into my email, which I have done many times over the years, and saw a strange email that caught my attention. The email purports that I had forgotten about $21,000 worth of Bitcoin (BTC) in an account, and I had 8 hours to withdraw, or the balance would be forfeited.

Detecting Default Meterpreter HTTPS Listeners

Sun, 31 Jul 2022 01:19:12 +0000

Meterpreter is an advanced payload within the well-known Metasploit Framework (MSF).

We will look specifically at the reverse_https payload and see how we can detect the listener in our environment. I always tell my junior analysts to make sure they can detect the low-hanging fruit. For instance, most tools such as Metasploit and Cobalt Strike are very powerful, but they all come with moderately dynamic defaults that can be fingerprinted.

Honeypot Diaries: Masscan

Mon, 06 Jun 2022 03:57:51 +0000

This blog post is the second installment of a series I want to use to cover lessons learned and interesting observations from my honeypots. These honeypots are geographically dispersed and have been running for a few years. Hopefully, this and future posts will add some value for someone.

Observations

While looking over some of my honeypot logs, I observed the download of an open-source port scanner named masscan. In the documentation for this tool, the author claims it can scan the entire internet in less than five minutes. I can see the appeal for attackers, and naturally, the logs show evidence of the attacker attempting to use masscan to find other targets of opportunity.

Setup and Securing Winlogbeat

Mon, 21 Feb 2022 18:30:00 +0000

Winlogbeat is a lightweight open-source Windows agent that uses the Windows API to ship different event logs to Logstash or Elasticsearch. I have been a Splunk user for quite some time, but I have started to also leverage the Elastic Stack at work and in my home lab. This post is for my reference and anyone trying to configure winlogbeat as securely as possible.

Download and install winlogbeat on a Windows endpoint. I would try to keep the same version of winlogbeat as the rest of the Elastic Stack running in your environment. For instance, if your Logstash or Elasticsearch is version 7.16 then make sure you download version 7.16 of winlogbeat.

Ingesting PCAP Files with Zeek and Splunk

Tue, 01 Feb 2022 02:32:32 +0000

Whenever I want to analyze a relatively small packet capture (PCAP), I load it up in Wireshark and get the job done. However, this process does not scale and becomes a problem with large-sized pcap files. Even if you split, let’s say, a 25 terabyte PCAP up into smaller chunks, can you imagine how long it would take using just Wireshark for analysis?

This blog post will look at a simple data pipeline to read and ingest pcap files into a Security Incident and Event Management (SIEM) platform using Zeek and Splunk.

Cryptocurrency Pump & Dumps

Thu, 22 Jul 2021 02:30:58 +0000

Cryptocurrencies like Bitcoin and Dogecoin have seen greater adoption by retail and institutional investors over the last year. I’m not going to get into the reasons for this, but the ubiquitous stories of crypto millionaires add to the fear of missing out (FOMO).

I use discord for a subset of my online collaboration, and that includes following some cryptocurrency groups. One day, I received a DM with an invite to a cryptocurrency pump group that promises early notification for when and which coin to buy. The idea is that the group organizers regularly coordinate pumps, which is done by convincing a massive group of people to buy simultaneously or in a relatively short period. This action increases the price of the selected cryptocurrency and should allow me and anyone else in the group to sell at a hopefully significant profit. Sounds good, right?

Better Secure Shell (SSH)

Mon, 01 Feb 2021 04:21:00 +0000

I highly recommend using SSH Public Key Authentication and a customized SSH client configuration to ease your everyday SSH workflows. I have more than 10 servers that I manage on a daily basis and using a password for each one would be tedious. Using the same password for all of them is definitely not recommended and is a risky decision. This post will be updated as I incorporate new and relevant changes to my setup.

Detecting Tor communication

Thu, 31 Dec 2020 19:01:00 +0000

Tor (The Onion Router) is an internet communication network built on privacy and anonymity. Much of the attention that Tor receives comes from the malicious segment of users that leverage the Tor network to conduct attacks while concealing their location. This negative association and challenge in attribution have led most organizations to block traffic coming from the Tor network.

Proofpoint Emerging Threats has many security feeds and intrusion detection system (IDS) signatures that help defenders detect cyber threats. We will be utilizing the Tor IDS alert rules provided by Emerging Threats (ET) for this blog post.

Using DoD Root Certificates with Git

Mon, 16 Nov 2020 20:51:23 +0000

Git clients perform certificate verification whenever you interact with a remote repository over TLS. Since the Department of Defense (DoD) certificates are not in most mainstream operating systems, the validation fails. The quick and insecure solution is to disable certificate verification globally.

git config --global http.sslVerify false

Or you can also use the -c option, which allows you to pass a configuration parameter.

git -c http.sslVerify=false clone https://git.redacted.mil/dod/project-repo.git

Disabling certificate validation globally is the most insecure course of action and should be avoided. The second quick fix limits the risk to the cloned repository. Both choices are not best practices, and you should configure git to use the DoD root certificates.

Honeypot Diaries: Dota Malware

Sun, 01 Nov 2020 03:58:44 +0000

A honeypot is a form of deception technology used to observe threat actor tactics, techniques, and procedures (TTP). I have deployed a customized version of the Cowrie honeypot in several regions, and I have one at home to capture residential IP space activity. The Honeypot Diaries will be a recurring series that I will use to share interesting and notable things I see happening with my honeypot network.

While looking through my honeypot logs in Splunk, I noticed thousands of downloaded files with the name up.txt so I drilled down into one of the events where I saw some interesting activity. We will take a look at some of the things I saw below. Keep in mind that brute-force SSH password guessing is how almost all of the attacks gain entry to the honeypot network.

Blue Team Tactics: Honey Tokens Pt. III

Thu, 01 Oct 2020 00:30:00 +0000

This is the final part of a multipart blog post, read part one and two then continue here.

In part 2, we simulated adversary interaction with our deployed tokens and then leveraged Windows Event Viewer to assess the generated artifacts. What follows will be several options for getting the audit logs from the endpoints to a centralized medium for analysis.

Blue Team Tactics: Honey Tokens Pt. II

Tue, 01 Sep 2020 03:49:24 +0000

This is a multipart blog post, read part one and then continue here.

We enabled filesystem auditing, created our audit template, and staged our honey tokens for deployment in part one. In part two, we will deploy the honey tokens and identify various methods for monitoring adversary interaction.

Load Balancing a Splunk Search Head Cluster

Fri, 31 Jul 2020 02:34:00 +0000

A Splunk Search Head (SH) enables an analyst to query a Splunk Indexer for data in a distributed configuration. A Search Heads group that shares knowledge objects and settings is known collectively as a Search Head Cluster (SHC). Deploying a SHC provides high availability (HA) and many other benefits to your users. However, as you scale out your Search Heads, updating DNS, and providing the list of available servers to your users is not ideal. We need a way to provide a single landing point while abstracting the details from your users.

FreeIPA integration with Splunk

Tue, 30 Jun 2020 20:42:00 +0000

Splunk has built-in user authentication; however, if you have multiple deployments or a clustered environment, it makes sense to utilize centralized user management. FreeIPA provides a solution similar to a Domain Controller in an Active Directory (AD) environment. Setting up FreeIPA is outside the scope of this document, and we will instead focus on how to integrate Splunk user authentication with an existing FreeIPA environment.

Create bindDN user for Splunk Instance

The Splunk server needs a FreeIPA system account (bindDN) to perform LDAP queries and validate user authentication requests. The web UI does not allow configuration of system accounts, so we have to create it from the command line.

Blue Team Tactics: Honey Tokens Pt. I

Mon, 01 Jun 2020 03:15:00 +0000

If you are defending an enterprise network, you should be using some form of honey token or canary, which is just something you place in your environment that no one should access. If any interaction is detected, it is usually an indicator of unauthorized activity. Using pseudo domain accounts as honey tokens usually illuminate the risk bubble for network owners, therefore I recommend using pseudo files with windows file auditing turned on and configured.

DIY IP Threat Feed

Thu, 30 Apr 2020 21:46:05 +0000

A threat feed is a collection of actionable information about threats that allows for mitigating harmful events. This blog post is concerned with developing an IP based threat feed or blacklist. We will look at how to gather, aggregate, enrich, and extract threat data for consumption.

Gathering the threat data

I have several servers in the US, Europe, and Asia running modified versions of cowrie, a medium interaction honey pot. These honey pots allow ssh access by accepting logins based on a random number of guesses for each attacker. The configuration setting is below:

Deploying Splunk Universal Forwarders via GPO

Sat, 28 Mar 2020 20:11:04 +0000

When you want to get security event data from your Windows endpoints, there exists a myriad of ways to achieve that objective. Here I am going to outline how to deploy the Splunk Universal Forwarder (UF) using a Group Policy Object (GPO). From there, you can configure the agents using a deployment server to ship the logs to a Splunk Indexer.

These are the general steps we will need to perform to complete this task:

A Tale of an MSBuild In-Line Task

Wed, 26 Feb 2020 23:22:56 +0000

I analyzed a suspicious file found during an Incident Response (IR) that turned out to be an in-line MSBuild task. The file had a byte array with an extremely long sequence of bytes. My first thought was that it was a binary of some sort. I extracted the bytes and wrote a few lines of C Sharp to convert it back to a binary.

The image above is a screenshot of a portion of the MSBuild task file. The byte sequence spanned thousands of lines. If you look at the byte[] buf variable assignment, the byte sequence 0x4d 0x5a represents the Magic Number for the Microsoft Portable Executable (PE) format.

Stack Smashing at Home

Sun, 19 Jan 2020 00:35:23 +0000

There are various wargaming sites such as SmashTheStack, OverTheWire, and IO Wargame that provide a platform for users to legally exploit real world software vulnerabilities. Source code is provided with a few of the challenges, which you can copy to a local research machine instead of working remotely. Keep in mind that the sites hosting these challenges have disabled most if not all of the compiler and kernel protections, so when you compile the source code at home you may have unintended results.

Ansible User Account Provisioning

Fri, 20 Dec 2019 03:21:28 +0000

Whenever I stand up a new Linux machine, I always find myself doing the same four things:

Creating my main user account
Creating an ansible user account
Configuring sudoers
Copying over SSH Public Keys.

Definitely, not something that evokes fun. I have tried various automation tools, but ansible has found a very special place in my toolkit.

For readers not familiar with ansible, it is a very powerful agent-less automation tool for all the things. There is a great primer [here][1]. This blog post is not a deep dive or an intro to ansible tutorial, I am only demonstrating how I initially provision the systems in my HomeLab (On-Prem) and in the Cloud.

Replacing the Default Splunk Web SSL Certificate

Wed, 06 Nov 2019 23:14:39 +0000

This post goes over how to sign a SplunkWeb Certificate Signing Request (CSR) using my Root CA in pfSense. I do not cover creating the Root CA.

Step 1: Create the directory for the certificates

splunk@siem:~$ mkdir /opt/splunk/etc/auth/certs

Step 2: Generate the private key and temporary password

splunk@siem:~~$ cd /opt/splunk/etc/auth/certs splunk@siem:~~$ splunk cmd openssl genrsa -des3 -out SplunkWebPrivate.key 4096 Generating RSA private key, 4096 bit long modulus Enter pass phrase for SplunkWebPrivate.key: (put something you will remember. we will remove it in the next step)

Working with Raw LVM Disk Images

Sun, 18 Aug 2019 20:11:17 +0000

Mounting disk images on Linux is fairly straight forward, however an image with a Logical Volume Manager (LVM) partition requires a little more attention. The first thing I do is find out some information about the image(s):

root@box:# fdisk -l -o Device,Type,Size disk.img

Device Type Size disk.img1 Linux 1G disk.img2 Linux LVM 952.9G

-l lists the partition table and -o outputs the columns specified. This particular image has two partitions one of which is an LVM parition. In order to access this space we need to mount the image. I chose to use udiskctl, but you are free to use your own method:

Slackware LVM over LUKS

Sun, 16 Jun 2019 22:44:16 +0000

This is mostly a post to document my process of setting up Full Disk Encryption (FDE) using the Linux Unified Key Setup (LUKS) and the Logical Volume Manager (LVM). Most major distributions already enable this process at installation, however Slackware does not and it must be done by hand. I am going to use an unencrypted boot partition. My boot manager does not currently support booting a LUKS container. Sometime in the future I will consider a rebuild of my laptop using grub2, which has support for LUKS and LVM.

Using NetworkManager with DNSMasq and Slackware

Sun, 02 Jun 2019 18:26:13 +0000

dnsmasq on Slackware 14.2 is compiled without D-Bus.

lab$ dnsmasq -v | grep options Compile time options: IPv6 GNU-getopt no-DBus i18n no-IDN DHCP DHCPv6 …

The logs show NetworkManager trying to start dnsmasq, but failing:

dnsmasq[4466]: DBus not available: set HAVE_DBUS in src/config.h dnsmasq[4466]: FAILED to start up NetworkManager[3101]: dnsmasq exited with error: Configuration problem (1)

After downloading the source files and SlackBuild resources from a Slackware Mirror, validate the GPG signature using the provided .asc file. Below are the contents of a directory after I assembled all the required pieces.

Migrating and Upgrading Apache Guacamole to Docker

Thu, 21 Mar 2019 06:23:50 +0000

UPDATED: I have created an all-in-one (AIO) version that includes nginx using TLS.

Apache Guacamole is a client-less remote desktop gateway. I use it in order to access my lab when traditional methods are not available. Guacamole does not use agents or fancy plugins, you only need an HTML5 supported browser and you can access your desktop or server in the cloud.

I started with version 0.9.14 of Guacamole. When version 1.0 was released, I decided to move away from Chase Wright’s all-in-one script and roll my own micro-services docker setup. This blog post covers the steps I took to deploy a containerized guacamole setup.

AutoFS with DHCP Classless Static Route Option

Thu, 07 Mar 2019 21:12:42 +0000

My FreeNAS server is a virtual machine (VM) on my Dell r710 server. I mount my NFS and CIFS Shares using AutoFS and configure my static routes to the NAS using the DHCP Server on my pfSense Appliance.

AutoFS is software that uses the automounter of the Linux kernel to dynamically mount file systems on demand. When not in use they are unmounted, freeing up resources.

Slackware Linux comes with autofs installed so I only need to configure it for my use case. The first order of business is to verify the Master Map File located at /etc/auto.master has acceptable defaults properly configured.

Using Physical Security Keys with Slackware Linux

Tue, 30 Oct 2018 04:12:08 +0000

Most people are aware of the various computer data breach incidents and password dumps that have occurred over the last few years. You can even visit Have I Been Pwned (HIBP) to find out if your email address is included among over five billion compromised accounts. Think about that for a second, we have a plethora of data dumps with email addresses, usernames, passwords and other personally identifiable information (PII) circling the internet and yet a greater percentage of folks are still satisfied with only a username and password.

Using OpenSSL and pfSense to sign a Subordinate Windows Enterprise Certificate Authority

Thu, 18 Oct 2018 22:23:01 +0000

Disclaimer: A Root CA trusted by Active Directory should not be trivialized. Make sure you know what you are doing when working with PKI. Take the time to study the technology before implementing it in production environments. There hasn’t been any extensive testing of this setup, so your mileage may vary.

I have a pfSense Security Gateway Appliance that I use heavily in my home network. One of the features that I have taken advantage of is the ability to create a Certificate Authority (CA) and issue certificates.

Handcrafting Linux Shellcode

Sat, 28 Jul 2018 02:26:16 +0000

Crafting your own shellcode requires getting muddy with low level programming. One does not simply write machine code from memory. This blog post is my attempt at providing a template and tutorial of the shellcode creation process for a 32-bit Linux machine.

The first step we will take is to write the task we want our shellcode to perform in a high level language:

#include <unistd.h>

int
main(void)
{
 char *egg[3];

 egg[0] = "/bin/cat";
 egg[1] = "flag.txt";
 egg[2] = NULL;
 execve(egg[0],egg,NULL);
}

Then statically compile the source and check to make sure it works as expected.

Mounting NFS Shares in Windows Using Identity Mapping

Sat, 16 Jun 2018 23:57:05 +0000

Before we begin let us enable Services for NFS and both Sub Features.

The typical way you will see an NFS share mounted in Windows involves mounting the remote file system using the anonymous (anon) user:

mount -o anon \\192.168.28.155\mnt\NAS0\media G:

This will give you read only access based on the configured permissions of the NFS Share.

The UID/GID value is -2 and locking=yes

If you want read/write access then you have to add two DWORD Registry Keys with the UID and GID of the Unix user that owns the share. Launch an administrative PowerShell Terminal.

Tracking SSH Brute-force Logins with Splunk

Wed, 13 Jun 2018 00:22:59 +0000

If you manage servers with OpenSSH access, you have no doubt been subject to the barrage of ssh brute-force attempts that occurs across the internet. Some administrators deal with this by either changing the default port (security by obscurity), utilizing public keys, threshold blocking, or white-listing source IP addresses among other things. AWS has security groups that lets you do this easily. However, if you are among those who have to allow public access from anywhere on the default port, you can at least monitor these attempts for trends or setup a SSH Honeypot and do all the sweet things. I decided to try the former using Splunk.

Raspberry Pi Centralized Log Server

Sun, 13 May 2018 20:53:17 +0000

Setting up a Pi to be a centralized log store is amazingly simple. If you are using Raspbian it comes with rsyslog installed by default, so all that’s left is to setup the config and tailor log rotation.

First, you should create a directory under /var/log for all the remote logs.

sudo mkdir /var/log/central

Then edit the configuration for rsyslog, which can be found in /etc/rsyslog.conf
Find and uncomment the following line(s):

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

You may see a different set of configuration options on newer versions of rsyslog

ELF Binary Disassembly

Mon, 26 Mar 2018 13:03:56 +0000

Let us take a tour through a disassembly dump of an ELF binary and see if we can reverse engineer it. The following output is a result of:

mech@dev:$ gcc -o distut distut.c
mech@dev:$ objdump -d distut|grep main

push %ebp // 0x55 
mov %esp,%ebp // 0x89 0xe5 
sub $0x14,%esp // 0x83 0xec 0x14
movl $0x1,0xfffffff8(%ebp) // 0xc7 0x45 0xf8 0x01 0x00 0x00 0x00
movl $0x7a68,0xfffffff4(%ebp) // 0xc7 0x45 0xf4 0x68 0x7a 0x00 0x00
cmpl $0xa,0xfffffff8(%ebp) // 0x83 0x7d 0xf8 0x0a
jne 0x80484d0 <main+32> // 0x75 0x06
jmp 0x8048570 <main+192> // 0xe9 0xa1 0x00 0x00 0x00
nop // 0x90
add $0xfffffff4,%esp // 0x83 0xc4 0xf4
push $0x8048600 // 0x68 0x00 0x86 0x04 0x08
call 0x80483b0 

 // 0xe8 0xd3 0xfe 0xff 0xff 
add $0x10,%esp // 0x83 0xc4 0x10
add $0xfffffffc,%esp // 0x83 0xc4 0xfc
mov 0x8049768,%eax // 0xa1 0x68 0x97 0x04 0x08
push %eax // 0x50
push $0x8 // 0x6a 0x08
lea 0xffffffec(%ebp),%eax // 0x8d 0x45 0xec
push %eax // 0x50 
call 0x8048380 <fgets> // 0xe8 0x8c 0xfe 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
add $0xfffffffc,%esp // 0x83 0xc4 0xfc
push $0x0 // 0x6a 0x00
push $0x0 // 0x6a 0x00
lea 0xffffffec(%ebp),%eax // 0x8d 0x45 0xec
push %eax // 0x50
call 0x8048390 <strtol> // 0xe8 0x89 0xfe 0xff 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
mov %eax,%eax // 0x89 0xc0
mov %eax,0xfffffffc(%ebp) // 0x89 0x45 0xfc
mov 0xfffffffc(%ebp),%eax // 0x8b 0x45 0xfc
cmp 0xfffffff4(%ebp),%eax // 0x3b 0x45 0xf4
jne 0x8048538 <main+136> // 0x75 0x21
add $0xfffffff8,%esp // 0x83 0xc4 0xf8
mov 0xfffffff8(%ebp),%eax // 0x8b 0x45 0xf8
push %eax // 0x50
push $0x8048620 // 0x68 0x20 0x86 0x04 0x08
call 0x80483b0 

 // 0xe8 0x88 0xfe 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
add $0xfffffff4,%esp // 0x83 0xc4 0xf4
push $0x0 // 0x6a 0x00
call 0x80483c0 <exit> // 0xe8 0x8b 0xfe 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
mov 0xfffffffc(%ebp),%eax // 0x8b 0x45 0xfc
cmp 0xfffffff4(%ebp),%eax // 0x3b 0x45 0xf4
jle 0x8048550 <main+160> // 0x7e 0x10
add $0xfffffff4,%esp // 0x83 0xc4 0xf4
call 0x80483b0 

 // 0xe8 0x63 0xfe 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
mov 0xfffffffc(%ebp),%eax // 0x8b 0x45 0xfc
cmp 0xfffffff4(%ebp),%eax // 0x3b 0x45 0xf4
jge 0x8048568 <main+184> // 0x7d 0x10
add $0xfffffff4,%esp // 0x83 0xc4 0xf4
push $0x804864a // 0x68 0x4a 0x86 0x04 0x08
call 0x80483b0 

 // 0xe8 0x4b 0xfe 0xff 0xff
add $0x10,%esp // 0x83 0xc4 0x10
incl 0xfffffff8(%ebp) // 0xff 0x45 0xf8
jmp 0x80484c4 <main+20> // 0xe9 0x54 0xff 0xff
xor %eax,%eax // 0x31 0xc0 
jmp 0x8048574 <main+196> // 0xeb 0x00
leave // 0xc9
ret // 0xc3
nop // 0x90
nop // 0x90 
nop // 0x90

The reader is assumed to be familiar with the above output. I have removed the memory addresses so each line can fit on a 80 character wide screen. The assembly dump is in AT&T syntax. For more in depth information on each of the opcodes see the references at the end of this tutorial.

IBM M1015 9220-8i cross-flashed to LSI 9211-8i IT mode

Fri, 23 Mar 2018 02:31:41 +0000

Flashing a raid card to a different firmware takes about five minutes, however if you have never done it before, the research process can be an order of magnitude higher. I spent about a day parsing all the blogs, forum posts, and subreddits that discuss flashing the LSI9211 HBA firmware to IT mode on compatible cards.

The process is simple:

BIOS Mode:

megarec -writesbr 0 sbrempty.bin
megarec -cleanflash 0

sas2flsh -o -f 2118it.bin -b mptsas2.rom
sas2flsh -o -sasadd 500605B0xxxxxxxx (x = numbers for SAS address)

UEFI Mode:

Scams in the Crypto Coin Space

Tue, 27 Feb 2018 14:30:44 +0000

If you are involved with crypto currency you are bound to be exposed to a scam or two at some point, much like the Nigerian scams that prey on fiat money.

I was looking at my twitter feed and noticed the Binance weekly report.

The interesting thing I noticed in the reply section was an apparent Ethereum give away.

Now if you are a cautious individual you will immediately notice that the “verified” mark is missing and the twitter handle is different, which should immediately set off alarms. Unfortunately, most people don’t catch these tells. This Social Engineering attack also uses several fake accounts that remark about how awesome it was to receive 5 ether, which is about $4,000 depending on the day.

Running an Authoritative DNS Server

Mon, 19 Feb 2018 05:24:14 +0000

I have been running my own Domain Name Server for several years. Some people argue the merits of doing such a thing when you can just put it in the “cloud”, but I enjoy managing DNS with all the flexibility and enrichment it brings.

I run Bind version 9 in a FreeBSD Jail and it serves as the authoritative nameserver for about six different domains. I use Hurricane Electric and BuddyNS as secondaries.

Michael Edie (tankmek)

Sun, 03 Dec 2017 20:50:50 +0000

So I figured it was about time I started my foray into the blog-o-sphere. Hold your beer while I get organized and squeeze content out to the masses.

About

Sun, 03 Dec 2017 15:50:52 +0000

[Certifications | Homelab]

Michael Edie is a senior Digital Forensics and Incident Response (DFIR) consultant specializing in enterprise-scale investigations, threat hunting, and coordinated incident leadership across complex environments. A former U.S. Army Warrant Officer (170A), he served as a technical lead on a Cyber Protection Team conducting incident response and hunt missions before transitioning fully into cybersecurity.

Michael’s background includes enterprise security engineering, detection strategy design, and hands-on forensic investigations across Windows, Linux, and hybrid cloud environments. He operates at the intersection of deep technical analysis and executive-level incident coordination, known for methodical execution under pressure.

Talks

Fri, 01 Jan 2016 00:00:00 +0000