|
|
|
Reverse Engineering File Formats |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : The target application parses data from an EDS file format. We have no sample EDS file, and no idea what the file format looks like. But soon you will see by blackbox testing and reverse engineering, we can get all the information we need to correctly produce EDS files and find vulnerabilities. First off, lets just throw some data into the file test.eds load it into the application and see how it responds From the error message, we can see that it needs the data in 's load data Now we know an EDS file also contains Device and File sections load data Really, how lucky can we get 'VendCode', 'ProdType', 'ProdCode', 'MajRev', 'MinRev' are entries for the Device section and 'Revision' is an entry under File section. So far, using blackbox testing we have discovered lots of information about the EDS file format. But usually there is more to discover. Its time to reverse it. ---- Device ---- File Looks like there is another entry for the File section called 'DescText' and we see how to correctly format it in the EDS file. A closer look reveals a call to wsprintf on the 'DescText' entry, which can lead to a buffer overflow. So, lets use the format to write the entry attach a debugger and see what happens.. Yeah Hm, we probably didn't expect a unicode buffer overflow... How did that happen anyways sub_1000FB50 -- calls sub_10007160 sub_10007160 -- vulnerable function In sub_1000FB50, we see a call to MultiBytetoWideChar maps a character string to a wide-character Unicode string So, in conclusion, we just went from knowing absolutely nothing about the EDS file format to knowing exactly how to build a valid EDS file, the sections and entries it parses, and which ones may be vulnerable for attack.
Les mots clés de la revue de presse pour cet article : reverse engineering
Les videos sur SecuObs pour les mots clés : reverse engineering
Les mots clés pour les articles publiés sur SecuObs : reverse engineering
Les éléments de la revue Twitter pour les mots clé : reverse engineering
Les derniers articles du site "Jeremy's Computer Security Blog" :
- What did they fix
- Adobe Flash Temporary Filename Scheme
- Reverse Engineering File Formats
- Browser Fuzzer 3
- Writing Code that Breaks Code
- Mozilla Code sighs
- From Static Analysis to 0day Exploit
- Some vendors are 'unconcerned'
- Firefox Local Download Manager Vulnerability
- Desktop Management Interface DMI
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
