Peter Van Eeckhoutte's Blog

When I started Win32 exploit development many years ago, my preferred debugger at the time was WinDbg (and some Olly). While Windbg is a great and fast debugger, I quickly figured out that some additional/external tools were required to improve my exploit development experience. Despite the fact that the command line oriented approach in windbg has many advantages, it appeared not the best tool to search for good jump addresses, or to list non-safeseh compiled / non-aslr aware modules, etc….  Ok, looking for a simple “jmp esp” is trivial, but what if you are looking for all pop pop ret combinations in non-safeseh compiled modules…   Not an easy task. It is perfectly possible to build plugins for Windbg, but the ones that I have found (MSEC, byakugan (Metasploit)) don’t always work the way I want them …

Introduction Easter is still far away, so this is probably the right time to talk about ways to hunting for eggs (so you would be prepared when the easter bunny brings you another 0day vulnerability) In the first parts of this exploit writing tutorial series, we have talked about stack based overflows and how they can lead to arbitrary code execution. In all of the exploits that we have built so far, the location of where the shellcode is placed is more or less static and/or could be referenced by using a register (instead of a hardcoded stack address), taking care of stability and reliability. In some parts of the series, I have talked about various techniques to jump to shellcode, including techniques that would use one or more trampolines to get to the shellcode.  In …

I would like to wish you all a Happy New Year with – good health – lots of fun – lots of time to do research and learn – the strength to share your knowledge with others – new tutorials – constructive discussions – the best of everything !!   Take care in 2010 !

From the MSExchangeTeam Blog : It is my distinct pleasure to announce today the global availability of Exchange Server 2010. This has been an amazing journey from conception to launch, and the team has delivered an unprecedented line up of innovations in this release. I am incredibly proud of the team and our product. The dedication of the Exchange community working side by side with us to deliver Exchange 2010 has been inspiring for me. I want to thank you for your commitment over the past 3 years helping us develop new ideas, make product enhancements and test pre-release bits to ensure our final product is rock solid. I believe Exchange has the most impressive IT Pro and Developer community in the world today. We could not have shipped this product …

Finally … after spending a couple of weeks working on unicode and unicode exploits, I’m glad and happy to be able to release this next article in my basic exploit writing series : writing exploits for stack based unicode buffer overflows (wow – that’s a mouthful). You may (or may not) have encountered a situation where you’ve performed a stack buffer overflow, overwriting either a RET address or a SEH  record, but instead of seeing 0×41414141 in EIP, you got 0×00410041. Sometimes, when data is used in a function, some manipulations are applied. Sometimes data is converted to uppercase, to lowercase, etc…  In some situations data gets converted to unicode.  When you see 0×00410041 in EIP, in a lot of cases, this probably means that your payload had been converted to unicode before it was put on the …

I have received a very sad message this morning that str0ke (milw0rm) has passed away yesterday. I sincerely hope this is some (bad and morbid) joke, but if it’s not then all I can say is that this is terrible. My thoughts and prayers are with his family (wife & 4 children) now. Rest in peace, str0ke. We’ll miss you bro. /Be safe 1974-04-29  / 2009-11-03 bl4cksecurity.blogspot.com/2009/11/str0ke-milworms-funeral-is-this-friday.html http://blog.xanda.org/2009/11/04/rest-in-peace-str0ke-milw0rm/   Update : maybe this is a bad joke after all :

In an older blog post on Certificate Authorities, I have provided some information about the process to generate Exchange 2007 certificates.  This process has slightly changed in Exchange 2010, and Johan Delimon (pro-exchange.be) has written an excellent article about this : Generating Exchange 2010 Certificates (Exchange Management Shell)

The 2 most important changes are :

the new-exchangecertificate cmd-let no longer supports the -path variable (so requests cannot be written directly to disk)
the 2007 GUI at Digicert still uses the -path parameter, so a new GUI was created to support 2010 certificate requests

In short, the updated procedure is :

generate the powershell command using an updated gui at Digicert : https://www.digicert.com/easy-csr/exchange2010.htm
Save the exchange certificate request into a $Data variable
Write the contents of the $Data variable to a file  (Set-Content -path “c:\request.req” -Value $Data)

Then, …