Collaborate Disseminate
I have a windows application that runs in 2 processes and communicates over localhost network port.
This application can hold secrets, such as a web cookie.
I’m trying to think through the security vulnerabilities.
My impr… Continue reading Security in memory and between local windows processes over localhost
I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a Kernel feature and Docker uses the host kern… Continue reading Disable ASLR inside Docker container
I’m practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this:
Find code cave and a hijacking point. In this case, I choose not to patch the en… Continue reading Backdooring PE binary compiled with ASLR
On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple vulnerabilities? An example of this … Continue reading Does every modern buffer overflow require multiple exploits in end user devices to be utilized?
Morpheus aims to make hacking so difficult at microprocessor level that attackers will give up long before they can do any damage. Continue reading Shapeshifting Morpheus chip aims to baffle hackers
what is “AV” in av->system_mem and what value does this line actually return??
Continue reading what is "AV" in av->system_mem and what does this line actually return [on hold]
My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
Code:
#include <string.h>
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I’ve determined I can input a buffer of 26 … Continue reading Simple buffer overflow trying to leak address of system()
I’m working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it reads up to 0x420 bytes fro… Continue reading How to exploit buffer overflow without space after return address?
I’m practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout Randomization (ASLR).
I’m now… Continue reading Buffer overflow return address with null byte, workaround