Amethyst Systems

Possible SQL Injection Payload Detected Walkthru

Thu, 04 Jun 2026 16:17:59 -0700

I have been hardening my incident response skills lately and completed parts of the incident response coursework on LetsDefend. As of right now, I’m still working through the course– it’s a pretty comprehensive course! But based on my answer to the questions posed by the subject, a curator reached out to me and asked me to write a blog on the subject of detecting SQL injection during a Linux incident. So let’s walk through the incident posed by the challenge.

Cryptohostility: Navigating the Modern Cryptocurrency Landscape as a Nomad Hacker

Fri, 18 Apr 2025 13:59:51 -0700

I like cryptocurrency as a concept and a technology (despite beefs with being forced into Javascript with Ethereum). I do not like the financial community that surrounds it– it’s full of grifters and scammers, holdovers from Wall Street eager to take advantage of unregulated markets. This financial community’s historical abuses in tandem with the hacker’s natural desire to defy authority ultimately led to regulatory bodies like the Securities and Exchange Commission in the United States to crack down on the technology. Ultimately, this led to the bane of crypto enthusiasts everywhere: Know Your Customer regulations, somewhat lifting the veil on anyone who tries to be anonymous with their cryptocurrency.

Mimicking the Windows Executable Loader's Memory Allocation

Wed, 08 Jan 2025 01:28:39 -0800

I’m not going to blame procrastination this time, even though this is absolutely what this is. No, this is pure autistic fixation.

Let’s start by saying that a lot of the previous blogs have all used a rather lazy technique, and that is “allocating the entire executable image as one piece of memory and marking it as read-write-execute.” If you’re doing anything serious against someone who has better defense than Windows Defender, this raises red flags. I’m merely just a scientist and engineer, not someone who actually works in the field of penetration testing, so I don’t know the reality of the situation as it relates to RWX allocated pages, but in my experience of malware analysis, I would argue this is a good artifact to flag on and understand why it’s being employed.

Writing Migratory Payloads

Wed, 25 Dec 2024 03:29:34 -0800

Hi. I’m procrastinating again, but this time it’s related to the project I’m procrastinating. And according to a well respected hacker, this is a functional way to be productive. So you, the reader, benefit from everything. Besides, the deadline for the Phrack CFP isn’t for another few months, so I’ve got time. (Famous last words.)

First of all, what the hell do I mean by migratory payload? That’s not a term in MITRE ATT&CK! In more technical terms, when I say “migratory payload,” I am referring to executables that can otherwise occupy the space of another executable after existing and operating in another state. Think of an executable that runs away from your mouse and injects itself into explorer.exe after you double-click it. It relies ultimately on process injection, which is a slightly different but similar technique to DLL injection. MITRE can be fun to rag on but they host a useful technical compendium.

Various Ways to Be an Asshole with Runtime PE Decryption

Fri, 06 Dec 2024 17:23:35 -0800

I am currently procrastinating undoing the mess I made with CMake files for a bigger project I’m working on. It’s not hard– it’s just annoying, and I have no one to blame but myself. I did this intentionally because confusingly designed code seemed like a good anti-reversing trick. It’s an anti-coding trick. Don’t do it intentionally, you’ll just confuse yourself in the end.

But one of these things I can use as an excuse to Not Do What I Need To: talk about the way I’m encrypting the code in the DLL Hell I’ve crafted for myself. If you’ve been following along, prepare for another application of forbidden PE knowledge.

Shellcoding with MSVC

Tue, 19 Nov 2024 21:45:16 -0800

When it comes to thinking about shellcode, normally we don’t think of the MSVC toolchain. Maybe we’ll think of MASM, the assembler of MSVC, but we certainly won’t think of the C compiler. We typically prefer NASM, an extremely flexible x86/64 assembler for binary creatives.

As badass as writing an assembly shellcode payload can be for Windows, due to the utterly gargantuan size of their eventual product, it is tedious and painful. You have to re-roll standard structures for PE files and have to recall what the secret sauce of this structure is. Not to mention if you don’t use assembly structures you have to memorize specific offsets for common data structures. Over time the badass feeling of dropping down to assembly gets drowned out by the sheer tedium of actually writing the assembly payload.

Forbidden Content: Loading PE Exports by Hash

Thu, 07 Nov 2024 18:15:21 -0800

A Brief Comment

I got mad again. I was attempting to research PE headers for another project and it happened again. The actual data structure I need is erased from Microsoft documentation. So I’m back to teach some apparently forbidden knowledge as an excuse to document the data structure they’re attempting to wipe off the Internet.

Data Directories

In our last episode we covered how one loads a PE file into memory, preparing it for execution. This is incredibly useful for analysis, because it provides the ability to execute individual pieces of the code, such as decryption routines and other choice code you wish to execute. The technology to perform such a feat is couched behind compiler wizards who refuse to share their black magic with the world. This article is another attempt to spit in the face of those gatekeeping wizards. If you don’t understand the PE format, feel free to read that article first!

Forbidden Content: Crudely Loading a PE File

Sun, 03 Nov 2024 13:23:03 -0800

A Brief Comment

This post is being made because I’m rather annoyed. On top of search engines being ruined by the AI gold rush, Microsoft has wiped away easy access to some documentation on critical data structures in PE file loading. Only some critical data structures remain easily accessed in Microsoft’s documentation. What makes this especially annoying is that the critical data structures are still in the <windows.h> header, and I’m not particularly a fan of leaving open a copy of windows.h open to find my data structures. It’s a big file! And the structs you need are scattered all over the place!

Entry for BGGP5: Download

Mon, 01 Jul 2024 17:39:53 -0700

Binary Golf Grand Prix is a yearly mad dash to create a tiny binary, given some target parameters. This year, the theme was download: write a program to download and print the contents of a target URL.

Planning

I had literally never tried golfing a binary before, so I didn’t really know where to start. My bread and butter is Windows executables, so I figured I would attempt one of those. Naturally, since we’re golfing, I looked toward the Corkami corpus for guidance. But this didn’t satisfy– it was 32-bit. I know all about 32-bit binaries and they’re no longer modern! We needed to do better.