krish shrestha.

a web-based network automation toolkit built with django and ansible, made to simplify and automate network device configuration. a role-based interface (admin / operator / viewer) for vlan creation, access port config, device backup, and config rollback across cisco ios, arista eos, and mikrotik routeros — all simulated in gns3 while it grows up.

ansible playbooks trigger straight from the django backend. every job is logged, config backups are encrypted with fernet (aes-128) and pushed to a github repo, and gmail smtp handles email notifications. approval workflow, task scheduling, real-time notifications, immutable audit log — a small, secure automation platform for educational and small-scale networks.

$ ansible-playbook -i inventory/ vlan-push.yml --limit core-*
PLAY [core-*] **************************************************
TASK [gather vendor facts] .......................... ok
TASK [cisco_ios : create vlan 42] ................... changed
TASK [arista_eos : create vlan 42] .................. changed
TASK [mikrotik_routeros : create vlan 42] ........... changed
TASK [audit : write job record] ..................... ok
PLAY RECAP *****************************************************
core-sw-01   : ok=4  changed=1  rescued=0  failed=0
core-sw-02   : ok=4  changed=1  rescued=0  failed=0
mkt-edge-01  : ok=4  changed=1  rescued=0  failed=0
# 3 switches. 1 vlan. 0 ssh sessions. friday, saved.

injected a meterpreter payload into spoolsv.exe in a controlled win10 lab (process hollowing), escalated to NT AUTHORITY\SYSTEM, then pulled the memory image apart with volatility 3 looking for suspicious regions, weird parent-child chains, and a c2 channel quietly chatting over tcp/443.

i also catalogued what the attacker tried to hide: ntfs timestomping, registry hive exfil, cleared event logs, deleted-file recovery via autopsy. ram remembers what disk forgets.

$ vol -f mem.raw windows.malfind
Process     PID   Protection   Tag   Hexdump
spoolsv.exe 1428  PAGE_EXECUTE_READWRITE  Vad   4d 5a 90 00 ..  MZ.....
spoolsv.exe 1428  PAGE_EXECUTE_READWRITE  Vad   50 45 00 00 ..  PE..
# spooler subsystem is not supposed to host a PE. huh.
$ vol -f mem.raw windows.netscan | grep 443
TCPv4  10.0.2.15:49871 → 185.xx.xx.xx:443  ESTABLISHED  spoolsv.exe(1428)
# the spooler does not print things to the internet, friend.

classic MITM on a flat network: poison the arp table, sit in the middle, collect the plaintext credentials people still send in 2024. then put dynamic arp inspection and a snort IDS in front of it and watch the same attack bounce off.

// turns out "trust" is not a protocol.