Late Escalation

Depreciating Skills, Compounding Judgement

Darryl Brown — Fri, 23 Oct 2026 08:54:35 GMT

October's php2shell critical vulnerabilities only cemented further one of my biggest worries going on my "Late Escalation" journey - How relevant is this learning for me in 2026?

Much of my career has been cyber-adjacent (project managing cyber projects), my Late Escalation is a mid-career pivot to learning the ins and outs of the coal face of cyber security. My main interest is red teaming, hacking as the good guy. But as I work tirelessly through simulations, crafting the perfect bash commands, learning Metasploit, combing logs for clues, I can't help but consider … AI can do this better.

What takes me a full day to learn, imperfectly, AI can execute in minutes with a well crafted prompt. A decent AI can walk a learner (or an attacker) from "suspicious upload form" to "reverse shell" in 30 minutes. So what of the humble entrant to this space who wants a fulfilling career pivot?

Accepting the Depreciating Skills

Like buying a new car, I have accepted that the skills I am learning depreciate as soon as I leave the training ground and try to apply them in the real world, a real job. The methodology of exploiting many vulnerabilities is a commodity now. AI handles these best, known patterns - running sqlmap, crafting payloads, firing Metasploit modules.

And as we saw with php2shell, AI excels at taking complex vulnerabilities, requiring precision execution, and crafting the perfect exploit, tailored to the target.

I continue to learn basic techniques as a strong foundation. Building my own pattern library for my brain. Not only do I find it fascinating, but learning these skills, although depreciating in of themselves, will actually help me compound everything else.

What Compounds

One of my biggest takeaways from the labs is not so much devising the right commands to take over a box, but more:

Which end points to poke?
What clues does this 400 error give me?
What do I do with this screen full of ports and processes?

Context is Everything. The labs call this out constantly. A forensics room handed me decrypted C2 (Command & Control) traffic and no further instructions - the skill wasn't the decryption, it was deciding what to hunt for in the wreckage. The tools give you the data; the judgement decides which data matters.

But even this is under assault. For example, Wiz's Red Agent - generally available since July 2026 - is an autonomous AI attacker that reasons about architecture and application logic, chaining multi-step attack paths by drawing on context from its Security Graph across cloud, identity and data.

It reportedly surfaced over 17,000 findings across roughly 1,000 environments in its first month of preview. So the machine now has context too. But notice what that context is: technical and environmental. It's fed by ingesting schemas and graphs, not by sitting across the table from a client. It doesn't know which finding threatens the CFO's flagship project.

For this reason even Wiz positions itself with human-in-the-loop workflows.

The Part after the Findings

I have no doubt the first draft of every pentest report will soon be machine-generated (if not already!).

But after nearly twenty years of project and risk work, I know the hard part is sitting in front of a client whose budget you're threatening, watching them push back on a severity rating. It's translating "unrestricted file upload" into "an attacker can persist in your estate and you'd struggle to evict them."

And AI-generated reports produce confident nonsense. A hallucinated CVE, an overstated risk. And clients don't sue the AI.

Summary: Making Best Use of my Learnings

At worst, I've invested evenings learning the mechanics of systems most people assume are magic. That alone puts me ahead of the project-people who've never touched a terminal.

But the pivot's still on. The sweet spot isn't competing with AI on execution. Why I am on this journey:

I will know how to use the AI tools, and what they are doing under the hood.
I will verify what they output.
I will stand in front of the client and explaining what it means to them.

My guiding statement as I go through this journey is that "it's never too late to escalate." Turns out that applies to the machines too. I'm just choosing to escalate alongside them.

MrPhisher: Decoding a Macro

Darryl Brown — Wed, 14 Oct 2026 12:05:36 GMT

Analysing a macro-enabled Word attachment (.docm) from a simulated phishing email, on a lab machine with no outbound internet access. Objective: extract the flag, but where could it be?

The Scenario and the Triage

I am presented with a lab machine with a suspicious looking .docm file. Immediately this means "macro". I have recently been learning about techniques in analysing suspicious files, and specifically macro extraction. So let's explore with olevba - a tool to extract macros from OLE files.

I also note no outbound internet access on the machine, olevba not installed, so let's get the suspicious file somewhere we can work.

Move the Artefact, not the Tool

The lab machine and my attack box can see each other, let's spin up a webserver and serve the file.

On the lab machine, in the mrphisher directory:

python3 -m http.server 8000

From my attack box:

wget http://:8000/MrPhisher.docm

The macro

Let's go ahead and install the tooling:

Note: I am using the TryHackMe attack box for this exercise, which doesn't have olevba installed. if you are using your own instance of Kali or similar, you might be ok to skip this bit if you already have the tooling.

pip3 install oletools

Now we have the tooling, let's point at the file:

olevba MrPhisher.docm
olevba 0.60.2 on Python 3.8.20 - http://decalage.info/python/oletools
===============================================================================
FILE: MrPhisher.docm
Type: OpenXML
WARNING  For now, VBA stomping cannot be detected for files in memory
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls 
in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO NewMacros.bas 
in file: word/vbaProject.bin - OLE stream: 'VBA/NewMacros'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Sub Format()
Dim a()
Dim b As String
a = Array(102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88)
For i = 0 To UBound(a)
b = b & Chr(a(i) Xor i)
Next
End Sub
+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|Suspicious|Chr                 |May attempt to obfuscate specific strings    |
|          |                    |(use option --deobf to deobfuscate)          |
|Suspicious|Xor                 |May attempt to obfuscate specific strings    |
|          |                    |(use option --deobf to deobfuscate)          |
+----------+--------------------+---------------------------------------------+

Interesting - nothing in plain sight. Tool suggests using option --deobf to deobfuscate, let's give that a try.

Nope, same output. What is that Array in the code? An integer array, plus Chr, plus XOR against a counter. Classic obfuscation technique (apparently - more on this later!)

The road to plain text

I am a beginner on this journey (check out my About Me if you haven't already.) I know Python can do this, but I have been playing a lot with CyberChef lately. Can this help me decode?

We are looking at a loop, with each variable in the string obfuscated based on its position in the array.

Therefore each byte must be XORed against its own array index. In CyberChef, I need to paste the array to the Input area, delimited by comma. The recipe is to:

"From Decimal" to convert from decimal back to raw form.
XOR with a HEX key.
That key is byte for byte equal to the length of the data. So I just (just - ha - this took me an age to work out) need to count from 00:

00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25

This gives me the flag in the Output area:

Lessons, and why did --deobf not work?

The Array + Chr + Xor-with-counter was new to me as an amateur in this space, and took some research for me to decode, as well as thinking back to my university coding days. My research taught me this trio is quite well known as a technique for obfuscation, and I commit this to my memory:

Integer arrays + Chr() signals encoded strings

XOR with a loop counter is the positional, not-repeating, key. I finally figured out that CyberChef will work through the key in step with the data. Given the key is just the position of the data in the array, we know we can get the flag this way:

Index:   [0]   [1]   [2]   [3]   [4]   [5]   [6]   [7]  ...
Data:    102   109    99   100   127   100    53    62  ...  
XOR key:  00    01    02    03    04    05    06    07  ...   
         ----  ----  ----  ----  ----  ----  ----  ---- 
Result:  102   108    97   103   123   125    51    57   
Char:    REDACTED (this is the flag ;))

The olevba tool can help deobfuscate static code (using the flag --deobf.) It works on constant expressions only. It failed this time because static analysis cannot evaluate runtime state. A loop variable changes each iteration, which static analysis cannot solve without emulation. I could have run the macro in LibreOffice (perfectly safe in a lab environment, maybe not on a real engagement!), but I really wanted to find another way.

An enjoyable room for sure!