>_0xFORUM
Sign in

Network isolation that survived a 'just this once' exception

in Defense13 replies4.5k views

The exception became a NAT. The NAT became a path. I ripped it out and put a ticket in front of any future exception.

Just-this-once is how labs leak. I will be the unpopular one.

Refs: FLARE VM

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 13 REPLIES

I would have written the opposite conclusion a year ago. You wrote «The exception became a NAT». That is the sentence I keep. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I reproduced it on lab build 1023.

@edwardconnect

I would have written the opposite conclusion a year ago. You wrote «The exception became a NAT». That is the sentence I keep. Except the ins

Calling the sticky 'priest talk' is how you earn a ban note. Please keep the hashes and drop the mystery zips. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Snapshot or it did not happen. I will not restore your VM again. Version in my shot: current lab snapshot, not last year's blog.

I still keep a paper notebook for this kind of note. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Jump box is not a desktop. No browser, no mail, no Slack. Pinned a comment at 0x140002a82 in the listing.

@ledgr

The screenshot is the useful part of the post. You wrote «The exception became a NAT». That is the sentence I keep. Host-only NIC, no shared

Good. Dated shot, version in the post. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I still have the snapshot named defe-184-pre.

Good. Dated shot, version in the post. You wrote «The exception became a NAT». That is the sentence I keep. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I reproduced it on lab build 1095.

@golfx

This belongs in the first-hour ritual. The load-bearing line: The exception became a NAT. Firewall rules not in the repo are unreviewed code

This is the kind of thread that should be a sticky and is not. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Jump box is not a desktop. No browser, no mail, no Slack. Pinned a comment at 0x140006a06 in the listing.

@kingsleyo

This is the kind of thread that should be a sticky and is not. You wrote «The exception became a NAT». That is the sentence I keep. Snapshot

Decompiler output is a hypothesis. Treat it like one. The screenshot is the useful part of the post. You wrote «The exception became a NAT». That is the sentence I keep. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Version in my shot: current lab snapshot, not last year's blog.

@frankybee

I still keep a paper notebook for this kind of note. On «Network isolation that survived a 'just this once' exception»: The exception became

That is a vibe. I asked for a listing offset. This belongs in the first-hour ritual. The load-bearing line: The exception became a NAT. Firewall rules not in the repo are unreviewed code. What did you key the join on — PID or process GUID? Pinned a comment at 0x140000b57 in the listing.

@hashr

This is the kind of thread that should be a sticky and is not. On «Network isolation that survived a 'just this once' exception»: The except

If you cannot paste bytes, you do not have a counterexample. I reproduced it twice before I believed you. The load-bearing line: The exception became a NAT. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Pinned a comment at 0x140002f16 in the listing.

This is the kind of thread that should be a sticky and is not. You wrote «The exception became a NAT». That is the sentence I keep. Snapshot or it did not happen. I will not restore your VM again. Did you snapshot before, or is this a restore-from-memory story? I wrote a 12-line script and then threw it away. The listing was enough.

@intel

Good. Dated shot, version in the post. You wrote «The exception became a NAT». That is the sentence I keep. Except the instance, keep the cl

You keep moving the goalposts. First it was the decoder, now it is the dump. Please keep the hashes and drop the mystery zips. You wrote «The exception became a NAT». That is the sentence I keep. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Took me 9 hours the first time.

@mapper

Good. Dated shot, version in the post. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Except

This is getting personal and it does not need to. Did this on ARM64 last week — same shape, different pain. The load-bearing line: The exception became a NAT. Firewall rules not in the repo are unreviewed code. Pinned a comment at 0x1400041d7 in the listing.

Not fully convinced yet. On «Network isolation that survived a 'just this once' exception»: The exception became a NAT. Snapshot or it did not happen. I will not restore your VM again. I will +rep a listing and −rep a vibe. That is the deal.

Also: Isolate the host too, or stop calling the guest isolated.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.