Category: punktwissen
-
Vintage Temperature Waves
There might be three people among my active followers who still remember when this blog was primarily about hard science and tech – without artistic adornments. These were the glory days of the internet, in the early 2010s. When social media had not yet defeated small blogs. We had our German heat pump and energy…
-
Unearthing a Time Capsule and Preserving a Fading Cathedral
My first creative endeavors (as an adult) were not drawings or paintings. It was the early web that made me pick colors by hand and stitch together HTML code snippets. The web of the early 2000s was a very different place from the modern social media era, built from many small independent sites and blogs,…
-
New Art Prints and Merch Store: Canvas Prints, Coffee Mugs, and Blankets with Physics-Inspired Art!
The title is the whole message, but let me add a mysterious trailer first! For years, I have been flying trough my structures from mathematical physics… Oscilloscopic Dance. Flying through virtual structures built from 3D Lissajous figures. … searching for the best viewpoint to take a snapshot. Searching for the art within the math. Searching…
-
Lord of the SID: How to Add the objectSID Attribute to a Certificate Manually
In May 2022 Microsoft has fixed a vulnerability related to certificate logon to Active Directory. As a non-privileged user you could escalate privileges by impersonating a Domain Controller, as you can join machines to the domain and thus control the dnsHostName attribute. Microsoft fixed this in an indirect way: Since last May, Windows Certification Authority…
-
Stargate of Diffraction. Escaping the Labyrinth of Colorful Wires.
This blog has been many things. Experimental poetry playground, notes from the field by a small business owner, popular science and tech blog, compilation of dry research reports, self-referential musing of a web developer. The only intersection between all of this has been me being interested & invested in it. I had tech-blogged myself into…
-
Defused That SAN Flag!
In May, Microsoft has fixed a bug that allowed normal users to impersonate Domain Controllers. This bug allowed non-privileged users to obtain a logon certificate issued to a domain controller, because users can write to the Active Directory attribute dnsHostName of a computer they have joined to the domain. If a machine can enroll for…
-
How to Add a Subject Alternative Name Safely
I am writing about that PKI stuff again. I am running out of ideas for catchy introductions. So, here is a new post with old code! In Active Directory a UPN is mapped to a user automatically if it matches a user’s LDAP attribute userPrincipalName (and a DNS SAN is mapped to dnsHostName). A Windows…
-
Rogue Certificate Challenge: No Hardware Tokens, No Linux, Just a Web Server with Certificate Mapping.
I am back to my favorite security research: How to abuse certificates in a Windows / Active Directory environment! If an Active Directory integrated certification authority sign a certificate with a custom Subject Alternative Name of your choosing, you can impersonate any administrator in an AD forest. I’ve published two blog posts about how to…
-
Innovation and Scarcity (and Panic)
I tried to avoid such words. They sounded like hollow buzzwords in times of abundance, used by advertizers playing on fears. But our complacent world is taught a lesson, right now, at furious speed. I am following news as everybody else, I am reading about gloomy forecasts. An Austria paper mill has announced today it…
-
Joys of Geometry
Creating figures with math software does not feel like fabricating illustrations for science posts. It is more of a meditation on geometry. I want to literally draw every line. I am not using grid lines or rendered surfaces. I craft a parametric curve for every line. A curve is set of equations. Yet, playing with…
-
Galaxies of Diffraction
These – the arrangement of points in the image below – are covectors, sort of. I wrote about them, some time ago. They are entities dual to vectors. Eating vectors, spitting out numbers. Vectors are again ‘co’ to vectors; they will eat covectors. If vectors live in a space with axes all perpendicular to each…
-
Looking Back: Hacking and Defending Windows Public Key Infrastructure (ADCS)
I live at the fringes of the cybersecurity community. I have never attended infosec conferences. There will be a talk on PKI hacking at Blackhat 2021 soon: Top AD offensive security gurus are presenting comprehensive research on abusing ADCS (Active Directory Certificate Services). I only know about that, because I noticed backlinks from their article…
-
Vintage Covectors
Covectors in the Dual Space. This sounds like an alien tribe living in a parallel universe hitherto unknown to humans. In this lectures on General Relativity, Prof. Frederic Schuller says: Now comes a much-feared topic: Dual vector space. And it’s totally unclear why this is such a feared topic! A vector feels familiar: three numbers…
-
Dirac’s Belt Trick
Is classical physics boring? In his preface to Volume 1 of The Feynman Lectures on Physics, Richard Feynman worries about students’ enthusiasm: … They have heard a lot about how interesting and exciting physics is—the theory of relativity, quantum mechanics, and other modern ideas. By the end of two years of our previous course, many…
-
Parse Certificates Stored in the Windows Registry
You can parse the binary blobs that represent certificates stored in the Windows registry with certutil correctly, even when the Windows Explorer / GUI tells you that this is not a certificate. certutil seems to be able to handle / ignore meta data better. Once upon a time I played with the machine Ethereal provided by…
-
Statistical Independence and Logarithms
In classical mechanics you want to understand the motion of all constituents of a system in detail. The trajectory of each ‘particle’ can be calculated from the forces between them and initial positions and velocities. In statistical mechanics you try to work out what can still be said about a system even though – or…
-
The RSA Algorithm
You want this: Encrypt a message to somebody else – using information that is publicly available. Somebody else should then be able to decrypt the message, using only information they have; nobody else should be able to read this information. The public key cryptography algorithm RSA does achieve this. This article is my way of…
-
Impersonating a Windows Enterprise Admin with a Certificate: Kerberos PKINIT from Linux
This is about a serious misconfiguration of a Windows Public Key Infrastructure integrated with Active Directory: If you can edit certificate templates, you can impersonate the Active Directory Forests’s Enterprise Administrator by logging on with a client certificate. You have a persistent credential that will also survive the reset of this admin’s password. In the…