Red Team on Christoph Kemetmüller

Anatomy of the One Fox Toolkit

Wed, 11 Feb 2026 21:25:10 +0100

When EclecticIQ analyzed a 2023 Cobalt Strike intrusion at Taiwan’s Directorate General of Highways (MOTC), the most useful artifact wasn’t the malware. It was a filesystem path leaked in the C2 logs:

C:\Users\Test\Desktop\ONE-FOX集成工具箱_V1.0魔改版_by狐狸\gui_other\Cobalt_Strike_4.5\plugin\TaoWu\script\lazagne.exe

Vulnhub - Breach 3 boot2root CTF walkthrough

Sun, 30 Apr 2017 20:21:59 +0000

The third boot2root system in the Breach series is an intermediate challenge. This time the VM will automatically acquire an IP address via DHCP.

First, let’s identify the target system. With netdiscover this is quite an easy task.

The target is at 10.0.2.9.

After identifying the target system at 10.0.2.9 a port scan to discover a potential attack vector for the breach. The SYN scan did not yield any results, all ports seem to be closed. The UDP scan shows that a service on port 161/udp is listening.

Vulnhub - Breach 2.1 boot2root CTF walkthrough

Wed, 08 Mar 2017 22:22:59 +0000

Breach 2.1 is meant to be beginner to intermediate boot2root/CTF challenge. The VM is configured with a static IP address (192.168.110.151) so you will need to configure your host-only adaptor to this subnet.

The VM is configured to the IP address 192.168.110.151. Let’s start by scanning the target via nmap.

Social Engineering with PowerShell Empire and gophish

Thu, 01 Sep 2016 10:46:59 +0000

Word macros are one of the top sources of malware infection. Creating such a malicious macro can be done in less than 10 minutes. This article will give an insight how to perform such an attack with open-source resources. The best is, that it just takes a few minutes.

Get a running Kali Linux. PowerShell Empire will already be installed. This will be our command and control tool.

GIAC Exploit Researcher and Advanced Penetration Tester

Thu, 18 Aug 2016 20:59:59 +0200

May 2016 I had the chance to participate in the SANS SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking in Amsterdam. The course syllabus gave a good outline about what to expect. For some topics I felt they would be really worth it.

Offensive Security Certified Expert

Mon, 06 Jul 2015 16:00:02 +0200

Update (October 2020): The OSCE certification and Cracking the Perimeter (CTP) course have been retired. They have been replaced by OSCE3, which requires passing three certifications: OSED (Windows User Mode Exploit Development), OSEP (Evasion Techniques and Breaching Defenses), and OSWE (Advanced Web Attacks and Exploitation). This article remains as a historical record of my experience with the original certification.

Try Harder! July 2015, I received my OSCE exam confirmation via mail. After trying for quite hard this was a really great achievement for me. So, I thought I could share my past experience in a few sentences.

Offensive Security Certified Professional

Wed, 28 May 2014 14:14:46 +0200

I received my OSCP certification via mail. The perfect time to write a short review. Try Harder!