https://blog.omiilgo.com/categories/operating-systems/ Recent content in Operating Systems on Security Notes Hugo en-us Thu, 10 Sep 2026 16:00:00 +0800 https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Thu, 10 Sep 2026 16:00:00 +0800 https://blog.omiilgo.com/posts/windows-token-privilege-checklist/ Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC. https://blog.omiilgo.com/posts/container-escape-class-lessons/ Fri, 13 Feb 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/container-escape-class-lessons/ Lab capsh –print and docker inspect seccomp/AppArmor, dropped caps, failed mount — no escape exploit. https://blog.omiilgo.com/posts/postgresql-privilege-boundaries/ Sat, 29 Nov 2025 12:00:00 +0800 https://blog.omiilgo.com/posts/postgresql-privilege-boundaries/ Lab \du dump, a safe SECURITY DEFINER function, failed GRANT, search_path notes — no superuser exploit. https://blog.omiilgo.com/posts/des-in-active-directory-crypto/ Tue, 08 Aug 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/des-in-active-directory-crypto/ Lab klist encryption types, supported-etype table, GPO ‘Configure encryption types allowed for Kerberos’ — inventory, not cracking. https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Tue, 14 Mar 2023 14:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-ticket-times-and-checksums/ Lab klist dump, field-by-field decode of times and checksum types, clock-skew 401 — no ticket-forging steps. https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Tue, 27 Sep 2022 10:00:00 +0800 https://blog.omiilgo.com/posts/print-spooler-lpe-class-lessons/ Lab spooler service ACL and RPC interface dump, Point-and-Print registry, 7036/808 logs — no spool exploit. https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Mon, 09 May 2022 16:00:00 +0800 https://blog.omiilgo.com/posts/ntlm-relay-defense-notes/ Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires. https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Sat, 11 Dec 2021 12:00:00 +0800 https://blog.omiilgo.com/posts/samaccountname-impersonation-class/ Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit. https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Mon, 17 May 2021 15:00:00 +0800 https://blog.omiilgo.com/posts/windows-delegation-edge-cases/ Lab klist/setspn dumps redacted, unconstrained vs constrained vs RBCD text diagrams — flags and ACLs, not an abuse chain. https://blog.omiilgo.com/posts/active-directory-recon-notes/ Tue, 10 Nov 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/active-directory-recon-notes/ Fake lab DC ldapsearch and PowerView-style listings, 4662/1644/4624 event IDs — inventory, not an attack playbook. https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Tue, 17 Mar 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/kerberos-constrained-delegation-map/ Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse. https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Sat, 14 Sep 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment.