original.flipster - demystifying software one rant at a time

Recently, I found myself stumbling upon a .kdbx (KeePass Database) file as part of a backup in a CTF and needed to crack the password to gain access to the secrets contained and consequently elevate my privileges. Problem was, that I couldn’t get the hash in the right format for cracking it with john: unsupported database file version (4). So, I built keepass-rush to do so myself.

DPAPI can be useful in situations when you got an initial foothold on a Windows host and are seeking to escalate your privileges. More specifically, we are talking a scenarios where your initial access user shares their home folder with a privileged account. This is a setup that is commonly found in Active Directory contexts, when a single person is operating with 2 distinct users, 1 for their everyday work and another one for dedicated administrative actions such as managing other users & groups that required elevated privileges.

Let’s dive into the mess that we get ourselves into when naively relying on JPA and its implementations and see how to generate nothing else but SQL statements that spark joy! Spring Data, JPA, Hibernate got our backs though to avoid such a mess, right? HELL NO! All they do is teach you a lesson to not rely on other systems without verifying the fundamentals functioning as expected yourself! There is ALWAYS pitfalls and you do not want to iron out those kinks in production.

The microservices hype is 4 real, but also completely unjustified. Netflix somehow claims to have pulled it off and suddenly everyone is slaying perfectly good monoliths into tiny pieces just to secure a spot on the bandwagon. But, microservices are out there to hurt you, just wait and see. Meanwhile, monolithic architectures who have always been kind to us have gone out of fashion without any good reason. As Public Enemy said it best: ‘Don’t Believe the Hype’.