Automating attack chains is not only necessary for testing cybersecurity mechanisms, but also very practical for cybersecurity training and pentests. Most existing tools are not primarily concerned with the attacks manifesting themselves in the logs as if they had been carried out by a human attacker. AttackMate was written with the intention of performing realistic attacks and allows attacks to be chained across all phases of the killchain. I wrote that tool as part of my work at the AIT, where we need realistic logs for anomaly detection. It is Free Open Source Software and available on GitHub

This year was my first time at the balccon conference. This infosec event takes place in Serbia and is a community oriented congress very similar to the CCC Congress in Germany. I felt very comfortable there right from the start. There were incredibly good talks and fantastic installations built by the community.

One of my daily work is to create testbeds to test defense mechanisms. As a result, I am constantly watching for vulnerabilities that I could use in such testbeds. In February 2023, someone discovered a vulnerability in the open-source surveillance software “Zoneminder”. It was a command injection vulnerability that an unauthorized attacker could trigger. Since there was only an advisory on Github without any proof of concept code, I created an exploit and contributed it to Metasploit. I learned a lot about developing modules for the Metasploit framework, and this article summarizes my experiences. To give Zoneminder administrators enough time to patch their systems, I waited more than seven months from releasing a patched version of Zoneminder before releasing this exploit.