Reversing 101 – Solving a protection scheme
In this post, we’ll look at an application reversing challenge from HTS (hackthissite.org) resembling a real-life protection scheme.
Put simple, the program creates a key for your username, and compares it to the one you enter.
The goal of the HTS challenge is to create a key generator, but I just want to demonstrate how to retrieve the password.
Continue reading
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
BlackHat EU 2012 – Day 3
Good morning, Since doing live-blogging seemed to work out pretty well yesterday, I’ll do the same thing again today. Please join in for day 3 at BlackHat Europe 2012, in a cloudy and rainy Amsterdam. The first talk I attended today was : “Secure Password Managers” and “Military Grade Encryption” on Smartphones Andrey Belenko and [...]
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
BlackHat EU 2012 – Day 2
Welcome back friends, at day 2 of BlackHat Europe 2012, held in the Grand Hotel Krasnapolsky in the wonderful city of Amsterdam. Today, I’m going to do things slightly different. I will try to post write-ups immediately after a presentation (and I’ll add in pictures later). I will basically update this page all the [...]
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
BlackHat EU 2012 – Day 1
Introduction – Back in Amsterdam ! After a 2 year detour in Barcelona, BlackHat Europe has returned to Amsterdam again this year. After spending a few hours on the train, checking in at The Grand Hotel Krasnapolsky, getting my ‘media’ badge (thank you BlackHat) & grabbing a delegate bag, and finally working my way [...]
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
Debugging Fun – Putting a process to sleep()
Recently I played with an older CVE (CVE-2008-0532, http://www.securityfocus.com/archive/1/489463, by FX) and I was having trouble debugging the CGI executable where the vulnerable function was located.
Continue reading
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
Exploit writing tutorial part 11 : Heap Spraying Demystified
A lot has been said and written already about heap spraying, but most of the existing documentation and whitepapers focus on IE7 or older versions.
Although there are a number of public exploits available that target IE8, the exact technique to do so has not been really documented in detail.
Of course, you can probably derive how it works by looking at those public exploits.
With this tutorial, I’m going to provide you with a full and detailed overview on what heap spraying is, and how to use it on old and newer platforms.
I’ll start with some “ancient” techniques (or classic techniques if you will) that can be used on IE6 and IE7.
We’ll also look at heap spraying for non-browser applications.
Next, we’ll talk about precision heap spraying, which is a requirement to make DEP bypass exploits work on IE8.
I’ll finish this tutorial with sharing some of my own research on getting reliable heap spraying to work on IE9.
Continue reading
Copyright secured by Digiprove © 2012 Peter Van Eeckhoutte | Corelan GCV
Donations
Now that the Copyright Dispute with Infosec Institute is settled, I am going to do what I promised to do.
During the process of settling the issue, many of you donated some money to help fight plagiarism. A few weeks ago, I announced that I funded all additional legal expenses myself and didn’t had to use any of the donations. That’s great news because that means I could refund the donations to anyone who requested a refund, and donate the remaining sum, on behalf of the people who donated, to good causes.
Continue reading
Copyright secured by Digiprove © 2011 Peter Van Eeckhoutte | Corelan GCV
Many roads to IAT
A few days ago a friend approached me and asked how he could see the import address table under immunity debugger and if this could be done using the command line.
I figured this would be a good time to take a look at what the IAT is, how we can list the IAT and what common reversing hurdles could be with regards to the IAT.
Continue reading
WoW64 Egghunter
Traditional Egghunter An Egghunter is nothing more than an assembly routine to find shellcode somewhere in memory. We typically deploy an Egghunter when there is no more room in our buffer that we can use to initially redirect EIP to. If we are able to load our shellcode elsewhere in process memory, the Egghunter will [...]
Copyright secured by Digiprove © 2011 Peter Van Eeckhoutte | Corelan GCV
Copyright Dispute resolved
Hello community, friends, visitors, I can now report that the Infosec Institute (ISI) and myself signed a settlement agreement on november 18, 2011. Please find below the official statement announcing the settlement: ISI admits that it used certain of Peter Van Eeckhoutte’s work without his permission, proper attribution of authorship, or proper copyright notice. ISI [...]
Copyright secured by Digiprove © 2011 Peter Van Eeckhoutte | Corelan GCV
Corelan Team Merchandise
Corelan Team Wallpaper / Exploit dev cheatsheet : Download here
