James Woolley

Interested in Network security and Technology

[James Woolley @Xtrato]

I've recently been trying to decompile obfuscated LUA bytecode from a TPLink device. It couldn't be decompiled using luadec or unluac due to custom typecodes and opcodes in use. I finally managed to do it, and wrote a blog post around the process.

https://t.co/9fMCckDS2g

[James Woolley @Xtrato]

@Paul_Reviews The fact we have gotten into this mess of users having to submit sensitive information just to verify age is insane. Its only a matter of time before a data breach of one of these verification authorities happens. This is a much better solution for a very simple issue.

[James Woolley @Xtrato]

@jwkingsman This is very cool!

[James Woolley @Xtrato]

I recently created a VNC honeypot. Many people asked me how I went about setting it up, so I've created a blog post describing the process. You can read about it at:

https://t.co/GGb2bsS0Zp

[James Woolley @Xtrato]

@julianharris Definitely!

[James Woolley @Xtrato]

@alexpotato Thanks!

[James Woolley @Xtrato]

@Andr3Baca0 @JimmyMcShill https://t.co/knHSirJQYM

[James Woolley @Xtrato]

@JimmyMcShill 🧵1. I can create a full blog post about it once I've refined the process a bit. I'm essentially running tigervnc server with no username/password required to authenticate. A bash script monitors the vnc log file, if someone connects it starts ffmpeg and records the session.

[James Woolley @Xtrato]

I left a server online with VNC wide open to see how it would be interacted with. This is one of the more interesting interactions:

[James Woolley @Xtrato]

@DaAlphaPanda I haven't gotten around to checking the files properly. I have them saved and intend to though.

[James Woolley @Xtrato]

@re_skob Probably scanned for it, it found it in a Shodan listing or something similar.

[James Woolley @Xtrato]

@rossb_testRepo Thanks!

[James Woolley @Xtrato]

@ptkatchouk They would scan for them, yes. There are also services like Shodan that can be used to find VNC servers.

[James Woolley @Xtrato]

@FiveOhFour @InternBerry They are both different protocols, but achieve the same thing. RDP is more Windows-based, although it can be used on Linux as well.

[James Woolley @Xtrato]

@_romeopeter You won't see the commands entered into SSH on the VNC session, if that's what you mean. Unless you look at the bash history.

[James Woolley @Xtrato]

@DirkSchmedemann Thanks!

[James Woolley @Xtrato]

@AlexisPaques The first bot was around 1 hour. The first person was 6 days.

[James Woolley @Xtrato]

@jcalvarez2 Thanks!

[James Woolley @Xtrato]

@W95918789 Thanks!

[James Woolley @Xtrato]

@alexpotato Thanks!

[James Woolley @Xtrato]

@InternBerry I do plan to do that next 🙂

[James Woolley @Xtrato]

@MakJoris Yea I guess you're right!