Nick Zero

Automating Exploit Discovery with MCP: Ghidra, WinDbg and a Very Broken TCP Server

Mon, 20 Jul 2026 10:00:00 +0100

Exploit development is mostly alt-tabbing. You find an address in Ghidra, paste it into WinDbg, read a register, go back to Ghidra to work out what that register meant, and somewhere in the middle of all that you forget whether the offset was 104 or 140. It’s an enormous amount of very precise clerical work, and humans are famously excellent at that.

Reverse engineering and exploit dev are tool-driven activities. We live in a disassembler and a debugger, and most of the job is asking those two tools very specific questions. What calls memcpy? What’s at this address? What’s in RCX when we crash? How far is it from the buffer to the saved return address?

Automating a Red Team Lab (Part 2): Monitoring and Logging

Tue, 15 Mar 2022 07:33:28 +0000

In our previous post we used Packer, Ansible and Terraform to automate the creation of a domain on our ESXi server. This is great for testing out tools and techniques, but as red teamers we really need to see what’s going on behind the scenes in the event logs so that when the blue team kick in our front door, we know exactly where we went wrong.

In this post we’ll cover adding in some monitoring services so that we can trace events. In order to achieve this, we’re going to add an Ubuntu server to our lab, and install the ELK stack across the network. As before, we’re going to do all this automagically using Infrastructure-as-Code, because as the old saying goes:

Automating a Red Team Lab (Part 1): Domain Creation

Thu, 17 Feb 2022 13:03:18 +0000

If you’re anything like me, you will tend to rip your test lab down and build it again at least once a day. Whilst this is definitely great fun and an efficient usage of your time, wouldn’t it be amazing to just have a fire and forget script that will set it up exactly how you want, every time?

Luckily this is achievable using Infrastructure-as-Code! In this post, I’m going to go over how we can use Packer, Terraform and Ansible to go from an empty ESXi server to an up and running Windows domain in no time.

About

Fri, 11 Feb 2022 14:13:20 +0000

Nick is a hacker, penetration tester and red team consultant.

This blog is a collection of things I found interesting enough to write about; during my ventures, work and research.

You can get in touch via Twitter @_NickZero.