Almost a year ago, on the dot, I decided to take a educational sabbatical (which I’ve logged on my website) to learn about the different aspects of vulnerability research.
After 3.5 years doing penetration testing, I decided it was time for me to change. I think I was mainly inspired by the people around me, and I just wanted to change the focus of my work on something that allowed me more freedom of choice.
Just like Drake, I started from the bottom. Like my friend Lailo said after I explained what pwn challenge I was working on, I was in the 90’s.
The idea for my educational sabbatical was to do a bit of everything. This included:
- Reverse engineering
- Binary exploitation
- Malware reversing
- Hardware hacking
- Vulnerability research
Let’s go back in time, shall we? xylophone chimes playing in your head🎶
First reverse-engineering course with BlackHoodie
I was lucky to be able to attend a BlackHoodie class at Hexacon in 2024, where I learned the basics of reverse engineering. It took me another year to finally decide it was time for me to move on from pentesting and go into vulnerability research.
First pwn challenge
I made a write-up of a challenge called restaurant, and I also wanted to make sure I kept notes of everything that went wrong.
I think it’s good to note failures, things that didn’t work, etc because 1) you can maybe help someone else debug their issues and 2) I like to see how far I’ve come.
This challenge taught me the basics of a stack-based buffer-overflow leading to ROP-based ret2libc exploit. This definitely took a bit of time to grasp how it worked, but I am lucky I had someone I could nag a bit to understand better how pwn challenges work.
It was a bit difficult for me to understand how I could leverage pwn-tools with python, and that’s also why, later on, I decided to give a training for Blackhoodie on binary exploitation for beginners. Having had someone show me how it works really helped me understand how everything can be set up before I even started digging into the vulnerable code.
I wrote this blogpost for people with no prior experience in pwn challenges, so I really went heavy on the explanations of where why how when and why again.
password is ret2libc (sorry idc)
Shellcoding
It’s really funny because for this one I gave up very quickly, cuz I couldn’t read whatever hieroglyphs were happening in a x64 system. It took a while for me to realize that it was basically rop but easie, where you wrote the instructions yourself.
After this challenge I decided shellcode wasn’t for me. Little did I know that I’d be feasting on a lot more shellcode later on.
A bit of theory – Reverse engineering structures
Oh dear, actually having to use the important features of binary ninja was a step up.
For the early stages I could get away with just opening up the binary in the decompiler. But then someone decided I should open a real binary and see the difference. They were right, but it was painful. I now had to deal with many memory offsets accesses.
I then decided to work on an open-source library so I could go back and forth to verify the mess I was making.
Introducing some memory safety features in pwn challenges
I had the pleasure of meeting Stack Canary, the stack buffer-overflow body guard. I think it was this challenge specifically where Lailo told me “ah yes you’re still in the 90’s”.
Anyway, this was fun to learn how to bypass a mitigation that was implemented right after I was born. Too bad I didn’t start hacking when I was 2.
Free Invoke RE course
During my gap-year I decided to go on holiday without my laptop (STUPID but I wrote a blogpost about it). Because malware reversing was something on my list of things to learn during my sabbatical, I didn’t want to miss out on a free malware reversing course. To enter the course, you had to solve a reverse-engineering challenge.
I managed to get my assistant Sparkey to send me the decompiled code once I managed to retrieve it using online tools like reqbin for the first stage of the challenge. I then had to do some little bits of math on my notes.
Anyways I solved the challenge, got the free course (and free Binja license) and I was happy!
PwnCollege
After doing a few HTB pwn challenges, I moved to PwnCollege.
I just want to take a moment to say HOW GOOD this platform is. Seriously.
Anyway, remember when I said I’d never do shellcoding again? WRONG.
I actually loved this module so much, it was literally like a game. Each level was the same concept but it got incrementally harder.
Oh, I also decided that I wouldn’t use AI during my pwncollege education. I wasn’t in a rush to solve the challenges and I found out that going through the grind really made my knowledge of the material stronger.
Hardware hacking
Moving on the check-list, I went on an adventure with breadboards, arduino, pins and painful aligator clips with my roommate.
This was funny because I think I went through the classic moment of “Let’s start hacking yay” and “oh shit I don’t have the right tools… alright we’ll start next week I guess”.
I was lucky to have Henri because he is like a robot, he reads instructions and executes. Me, on the other hand, I am still learning how to properly read manuals and documentation.
Blackhoodie @ BSides Limburg & OffensiveCon
This felt like a very big giving-back moment. I first started as a BlackHoodie attendee to learn about reverse-engineering and now I was able to give back and teach new inspiring women about reverse engineering and binary exploitation. What a good feeling <3. Best feeling was when one of my students attended a talk at OffensiveCon and told me “thanks to your training I actually managed to follow the talk a bit”. 🥹
Malware reversing
Even though malware reversing was originally part of the gap-year plan, I came across two Click-Fix malware by pure chance. And funny enough, this has been one of my most reacted and cited blogposts because it was still being actively investigated and these campaigns were running around like they were on cr*ck.
Last few real-world research projects
Unfortunately these blogposts are not out yet, but to complete the circle I finished up my educational gap year with some real world vulnerability research projects, most recently sending a submission to meta…:)
Landing a job in VR
And BAM, we’ve come full circle. Almost a year later, I was lucky to join Bynario as a vulnerability researcher and be part of a really cool team with very talented people.
Until next time, and don’t be afraid to take risks if you can!
Leave a Reply