lordnet.sh

Over The Wire - Behemoth retrospective

2026-03-30T00:00:00Z

Prologue

push ebp; mov esp, ebp; sub esp, 4

Context

A long time ago now, I did a bunch of these OverTheWire wargames. Back then, it was as an introduction to cybersecurity, when I was trying to transition to it in college. Now, with my feet wet with a little network security experience, I find myself missing that. There's something about gaining control over something by out-witting the architecture that is so gratifying. So, I decided to come back and tackle it again. If it's in the cards, maybe this marks a career shift for me :o). Who knows.

OTW Policy, "Why this post?"

OverTheWire has a no-spoiler policy. Granted, they aren't going to hunt me down, and there are already tons of writeups online. But I believe in the mission and what it stands for - so even though I'd love to show off my work, I'm going to abstain. That's where this blog post comes in.

Instead of posting my solution, I'm simply going to post a retrospective at the end about what I learned. For future CTFs, this may change to be more granular, but Behemoth is easy enough. Got it done over a couple of days.

Actually attacking the challenge

Goals

So why return to this one in particular? I didn't go back to anything easier, nor did I start with anything particularly difficult.

To me, I wanted to build real skill. I believe this requires being challenged just enough at my skill level, and doing the rote work. Much like practicing problems in math, you want to have to do it the "right" way enough to understand it. So I tackled these problems with a different solution to the same thing. Sometimes I wrote my own shellcode. Sometimes I used pwntools' pre-canned shellcode. Sometimes I used shell-storm shellcodes. For every "fundamental", I tried to do it in multiple ways.

Additionally, when I did these forever ago, I was, for lack of a better word, a total skid. I was really just manually shifting payloads around with pre-canned shellcode straight off of shell-storm. I wasn't REALLY getting intimate with the internals, I was just using them as a convenient toy. This time, I do a lot more shellcoding, spend a lot of time in the debugger, and use more tools. In particular, my tool-goals are to use more pwntools for scripting, and get comfortable on radare2 for my analysis.

Results

And get comfortable I did! I am now confident I can bring these tools over to the next challenge and begin to catch up to where I was when I left off forever ago, but correctly this time. So, let's see, did I meet my goals?

Radare2

Way more comfortable here. Had a few super productive assembly markup sessions, and got comfortable navigating it. Not a power user just yet, haven't even had to harness the scripting. But I can do the basics.

pwntools

Also had a great time learning more about using this library. One particular challenge was a simple format string bug, and pwntools' fmt library was a very fun way to generate the payload for the solve. I'm also straight ADDICTED to shellcoding with assembly within a string, and having it assemble it at runtime! In my previous shellcode excursions, I'd really have to assemble a binary myself and extract the code from the resulting executable. This was WAY more streamlined.

Epilogue

mov esp, ebp; pop ebp; ret

I think this was a super succesful traceback to a set of easier challenges to build some stronger fundamentals, and I'm looking forward to doing more. In the interest of not leaving this post without any real code, have a pwntools excerpt of shellcode I made that simply does setreuid(0x32CC) and execve("/bin/sh", NULL, NULL).

#0xf7f41de8 in the shellcode is the location of /bin/sh in libc. Waste not want not!
shellcode = '''

sub esp,0x40
xor eax, eax
xor ebx, ebx
xor ecx, ecx

mov al, 0x46
mov bl, 0xCC
mov bh, 0x32 
mov cl, 0xCC
mov ch, 0x32

int 0x80

xor eax,eax
xor edx, edx
xor ecx, ecx
mov ebx, 0xf7f41de8
mov al, 0xB
int 0x80
'''

LLMs and the Nuance of Thought

2026-08-04T00:00:00Z

Intro

This post introduces the Rambling tag into the blog tags. I'll be using it when I'm yapping about something. In essence, it's the inverse of the technical tags, or a lack of technical tags.

Today I ran into a post on Tildes about AI discourse, and how looking past the polarized discourse on the subject actually can reveal beauty in how ideas are embedded within language. I thought this was a beautiful way to look at it, and inspired some of my own introspection on the topic, and effectively also inspired this post.

Detractors of AI often like to boil down Large Language Models (LLMs) as being "unable to reason", or as "overhyped auto complete". I believe that the implications of LLM output run significantly deeper than that, however, I also wish to offer up what I believe is actually missing from AI output. Because in a sense, the detractors are correct... it's critically lacking something fundamental in the experience of being a consciousness.

But let's start with what AI is, not what it isn't.

Language and Knowledge

This section will almost certainly be a rephrasing of the Tildes post above. I strongly recommend you check it out. Hopefully the link doesn't die any time soon.

LLMs do essentially one thing - it calculates a probable output from a context. The context window (a phrase literally used in the field) is a critical part of the LLMs view. It is a machine that can take some amount of text, as defined by the computing resources supplied to it, and predict what the most likely next set of words is. You can see why detractors use the aforementioned terms, it is essentially a word machine. However, I think this has more nuanced implications of what we are capable of extracting from predictions. In a way, we are using statistics to predict ideas.

Language, as a tool, has been honed over thousands of years to effectively encode ideas into something we can share. My words, your reponse to those words, even this very post, are a collection of words and phrases meant to contain ideas. We use words to record knowledge, wisdom, and everything in between. With this in mind, I would put forward that the output of LLMs isn't just text. LLMs are an invention that allow us to use statistics to predict ideas, using text as a vehicle. Phrased another way, in the same way we use statistics to predict social trends or scientific phenomenon, we are using it to predict the output of thought. LLMs allow us to use statistics to distill ideas out of words.

This means that LLMs exist in an interesting space - they are capable of reason. They reason all the time. In the same way a domino falls and knocks over the next one, an LLM goes from one word (token) to another, constructing ideas in the form of sentences. This is a form of reasoning, even if it's done mathematically using text. The human advancement that allowed this to exist is absolutely staggering. It's a combination of thousands of years of language development, mathematics, and computer processing. Despite our current world climate, it is without a doubt a beautiful achievement.

However, it is missing something. And I believe that thing has a lot to do with the experience of being human. It's something i'll boil down to...

Inspiration

Here, I'll use the term inspiration in a slightly specific way. I use it to describe something I believe LLMs are fundamentally incapable of experiencing. Inspiration, to me, is a phenomenon in the brain that introduces variance, and allows us to come up with unique ideas.

An LLM introduces variance into its output by rolling a random number, and using it to decide if it will vary from its statistical calculation. As humans, we do no such thing. In fact, the output of our thoughts is even more deterministic. It's the result of the lighting pathways within our minds. A mass of connected neurons firing together to form thoughts, ideas, memories. However, humans manage to achieve variant thoughts in a totally different way: experiences.

The core idea of inspiration, to me, is that human thought becomes unique when it's paired with the experiences of being a human. An LLM may reason in one line of thought, but a human's line of thinking is directly influenced by whatever else hits the brain at that time. It might be a stimuli (smell, sight, sound), it might be a memory (technically feasible with a big context window, but humans have context windows that AI could only dream of), it might even be literal damage (maybe you're concussed? idk). Regardless of what it is, the system of human thought is more than just context and linear reasoning. The chemistry in the brain is subject to the environment to such a degree that variance is inevitable. An LLM would not have an apple fall on its head like Newton, nor could it get an idea for a melody by walking down the street. Even writing this post, I am listening to relaxing music, which is without a doubt setting the tone for my writing.

To me, Inspiration is consciousness incarnate. It's whats missing in AI art, it's what's missing in AI writing, and it's what the greatest minds in history have ample of. To be more human, is to be more inspired.

Closer

I feel the need to write a closer here, though I think the last line of the previous section closes it out well. Who knows if AI advancement will get to the point where it manages to encode inspiration somehow. All I know is, there are humans that are capable of reason without any inner monologue at all. So until we find more ways to distill ideas out of math (like we have with statistics and language), I'm not confident that we'll ever hit something that replicates a human perfectly.

To Make a Blog Usable

2026-08-19T00:00:00Z

Intro

I've had a few iterations of blogs and sites over the years. Turns out, the less you use something, the more difficult it is to keep it working the way you want. I'm going to spend this post talking a bit about the types of technologies I went through, and where I am now. Maybe this helps someone build something sane, that may need to sit idle for years at a time.

Some Requirements, or "Why Not WordPress?"

My biggest requirement for my website was to be lightweight. I'm not particularly interested in a million WordPress plugins, and really just offers me attack surface for no benefit. Could a website that just works really be that hard?

Of course, this is a little hypocritical - you've probably noticed my website is pretty stylized. But at the core of the site, it's a rather simple framework that delivers text in an orderly fashion. Which brings me to my next requirement...

My website should be customizable. That's the whole point! I'm not here to use a platform that lets me pick a few colors out of a palette for their UI. I want full control over how my site looks. In this sense, I want to build a website, not just inherit a structure for my blog post.

The website should be extensible. I don't want to lock myself out of the million potential features that WordPress offers. As much as I love my simplicity, sometimes I like features too.

Finally, the website should be stable. Surprisingly difficult! I noticed a trend that any website I could host on another platform that handles things for you, WILL be deprecated eventually. That'll be a headache.

Jekyll on GitHub Pages

When I tried this almost a decade ago (horrifying), this was what everyone was talking about when you look up a lightweight blog. This was also my first static site generator (SSG). SSGs are fundamentally exactly what I'm looking for. They are close to the bare minimum to stand up on a server (often just whatever HTML/CSS/JS you want), while also offering a good way to write posts and pages in a simple way (Markdown). In fact, this approach would've been exactly what I use today, if it weren't for the actual mechanisms behind hosting on GitHub.

To me, hosting an SSG on GitHub was a harrowing experience. Practically every time I wanted to make a blog post, I'd clone down the repository, and find some issue with the SSGs build environment that just didn't work. Sometimes GitHub's ruby implementation was out-of-date, sometimes Jekyll stopped supporting whatever version GitHub was using, sometimes the version they both supported wasn't supported any more on my machine's repositories. I often spent more time trying to get my environment to function than I did actually writing posts.

Look, I'm a sick freak and truly love fixing obscure software issues, but this is too much even for me. Just let me write the damn post, man.

Substack, Neocities, Tumblr, Etc.

There's a genre of site I like to think of as a "custom page container". Substack less so than this, but Tumblr fits the bill if you think about it. If a platform just needs to be customizable with web technologies and make posts, why anything else?

Well, for starters, I like my domain. I like it when people visit lordnet.sh, and I feel awesome linking it. Plus, it was around this time that control started becoming one of my concerns. By this point, GitHub was almost down more than it was up. Why subject myself to the uptime of another entity? Especially small fry (all due respect) like Neocities or such.

Also, if we're talking polish, Substack crushes the rest in this category. But it's way less customizable. Also it looks like twitter, eh.

I'd like my projects to exist in the same space as my posts, too. When I considered these platforms, I had to concede that my projects would live on GitHub, and my posts would live on another platform. This segmentation, to me, is just ugly.

Just a Web Server (Who Even Needs CSS?)

Don't do this. I know I look stupid for mentioning it, but genuinely after wrestling with Jekyll and being dissatisfied with the more streamlined solutions, part of me just wanted to throw HTML onto a web server and call it a day.

It should be obvious why this is a bad idea. Who has to organize it? Me. Who has to make sure every post is referenced? Also me. Not even to mention designing it, if you want it to not look like a 70 year old CS professor's .edu page. Not that there's anything wrong with that. Full respect to that.

Something that's less obvious about this approach is that it's way harder to use as a portfolio. If you want to consolidate your projects and posts into one platform, you need to remember that some HR department that wants to hire you should be able to navigate it. Way harder than it sounds! If any HR departments are reading this, this is not an insult, engineers genuinely cannot build software to accommodate normal people. You need to yell at us. Building for non tech people is a whole skill to consider.

The Stack I Landed on: 11Ty on My Own Hardware

It might sound a little silly to go from "Hey you don't want to build it yourself" to "Hey just build 90% of it yourself" - but I promise it's way easier than it sounds. If you're willing to throw together a little CSS (the worst part), your SSG of choice will practically do the rest for you.

If you don't have your own hardware, a cloud device will do just fine. But I'm honestly in love with the way my stack looks right now. A little bit of elbow grease in, and I have a Forgejo action (GitHub actions for people who like stuff on-prem) that automatically deploys it to my web server.

The flow is easy now that it's set up. Write a blog post, git commit, git push, done. The automations handle the rest. 11ty is configured to automatically generate what I call the "boring" variant of the page, where normal people don't have to look at my goofy phosphor website. It's linkable to us dorks and well-adjusted individuals alike.

My projects and posts exist on a page that 11ty generates as a collection, meaning when I upload blog posts or projects, it'll populate those lists, and list/organize them accordingly when requested.

The drawback? It's work, man. Ignoring the strange layout of the main site, I had to string together a lot of boilerplate for the 11ty logic to handle a lot of this stuff for me. Not for the faint of heart.

But hey, at least I can guarantee that 2 years from now, GitHub won't throw a fit based on what ruby version my blog was written against.

Epilogue

If you host any of your own machines, I super recommend this flow. I use 11ty to build my website, Forgejo to orchestrate the build, and Caddy to host the output. The beauty here is that any of this stack can be swapped out. You don't even need to have a GitHub actions equivalent to build it, I just found it convenient.

But if you were interested in hosting all of your data yourself, I highly recommend it! It's not a very heavyweight process (besides the orchestrator - again optional).

Expect to see more posts from me as I've made this exponentially easier. I've also added An atom feed here. I'll be adding a subscribe button alongside the commit that builds this post, stay tuned!