Here is the write-up for the DEFCON 19 quals challenge b100 run by DDTEK. This one is somewhat funny. Description Category: Binary L33tness Your journey begins: Download jtd@hackbox:~/DEFCONquals2011/bl100$ ./b100_6817e51fa3b60f176b56 ./b100_6817e51fa3b60f176b56 [1-11|all] jtd@hackbox:~/DEFCONquals2011/bl100$ ./b100_6817e51fa3b60f176b56 ./b100_6817e51fa3b60f176b56 [1-11|all] 1 Running this
This article describes ELF relocation sections, how to abuse them for arbitrary code execution, and how to protect them at runtime. ELF Relocation Sections A dynamically linked ELF binary uses a look-up table called Global Offset Table (GOT) to dynamically resolve functions that are located in shared libraries. When you
Now that this semester is completed, I can continue going through gera's execises =). For reference, the program is below: {% highlight c%} /* fs2.c * * specially crafted to feed your brain by gera */ /* Can you tell me what's above the edge? */ int main(int argv,char **argc) { char
The basic database QUERY expression for a simple login is: [sql] SELECT * FROM users WHERE username = 'phillip' AND password = 'taco' [/sql] Which boils down to: "Login if T ∧ T" where in this case the first T is the result the database returns when username
A commercial, and in some respects a social, doubt has been started within the last year or two, whether or not it is right to discuss so openly the security or insecurity of locks. Many well-meaning persons suppose that the discussion respecting the means for baffling the supposed safety of
Evidence of recent attacks on major political and financial systems suggests that large-scale attacks on critical infrastructures are still a focus of attackers, despite recent reports that cyber attackers are focusing on smaller targets. In an article titled “Are We Ready for a Financial Cyber Attack” the Wall Street Journal
Words like “privacy” and “confidentiality” and “cyber-security” are thrown around frequently in discussions of technology, but many people consider these issues more idealistic than essential. It may be widely accepted that confidentiality is better than no confidentiality, but few people would go out of their way to protect their information
Use this .gdbinit. Make sure you save it as your ~/.gdbinit file in $HOME. This adds functionality: you can see the stack, data, registers and code and how they change on each cmd entered into gdb. For best results use 80x24 sized windows (It acts like a motion picture in
You are probably going to want to do this to make your initial exploit examples easier to work with and understand. Turn off ASLR: $ sudo echo 0 > /proc/sys/kernel/randomize_va_space or $ sudo sysctl -w kernel.randomize_va_space=0 Turn off NX (compile option to GCC)
Here's a quick one liner to make linux shell code that runs "exec /bin/bash". The last argument of c to msfencode generates the c. {% highlight bash%} msfpayload linux/x86/exec CMD=/bin/sh R | msfencode -b \x00\xff -t c > shellcode.h {% endhighlight %} The
“In everything one thing is impossible: rationality.” –Friedrich Nietzsche Unfortunately, Nietzsche’s assessment seems to hold true with regards to peoples’ attitudes about privacy. The New York Times published an article called “Our Paradoxical Attitudes Toward Privacy” that discusses how people make decisions regarding privacy. http://bits.blogs.nytimes.com/
The GNU Compiler Collection has a FORTIFY_SOURCE option that does automatic bounds checking of dangerous functions to prevent simple buffer overflows. The FORTIFY_SOURCE code will do static and dynamic checks on buffer sizes to prevent these buffer overflows. Details FORTIFY_SOURCE will do checks on the following functions:
