Peter Van Eeckhoutte's Blog

Archive for the ‘001_Security’ Category

A few moments ago I published a detailed write-up, explaining the steps I took to build a 0day exploit for a zip file handling bug in QuickZip, on the Offensive Security blog. You can read the article here : http://www.offensive-security.com/blog/vulndev/quickzip-stack-bof-0day-a-box-of-chocolates/ Read more »

Over the last couple of months, I have written a set of tutorials about building exploits that target the Windows stack. One of the primary goals of anyone writing an exploit is to modify the normal execution flow of the application and trigger the application to run arbitrary code… code that is injected by the attacker and that could allow the attacker to take control of the computer running the application. This type of code is often called “shellcode”, because one of the most used targets of running arbitrary code is to allow an attacker to get access to a remote shell / command prompt on the host, which will allow him/her to take further control of the host.  While this type of shellcode is still used in a lot of cases, tools such as Metasploit have …

When I started Win32 exploit development many years ago, my preferred debugger at the time was WinDbg (and some Olly). While Windbg is a great and fast debugger, I quickly figured out that some additional/external tools were required to improve my exploit development experience. Despite the fact that the command line oriented approach in windbg has many advantages, it appeared not the best tool to search for good jump addresses, or to list non-safeseh compiled / non-aslr aware modules, etc….  Ok, looking for a simple “jmp esp” is trivial, but what if you are looking for all pop pop ret combinations in non-safeseh compiled modules…   Not an easy task. It is perfectly possible to build plugins for Windbg, but the ones that I have found (MSEC, byakugan (Metasploit)) don’t always work the way I want them …

Introduction Easter is still far away, so this is probably the right time to talk about ways to hunting for eggs (so you would be prepared when the easter bunny brings you another 0day vulnerability) In the first parts of this exploit writing tutorial series, we have talked about stack based overflows and how they can lead to arbitrary code execution. In all of the exploits that we have built so far, the location of where the shellcode is placed is more or less static and/or could be referenced by using a register (instead of a hardcoded stack address), taking care of stability and reliability. In some parts of the series, I have talked about various techniques to jump to shellcode, including techniques that would use one or more trampolines to get to the shellcode.  In …

Finally … after spending a couple of weeks working on unicode and unicode exploits, I’m glad and happy to be able to release this next article in my basic exploit writing series : writing exploits for stack based unicode buffer overflows (wow – that’s a mouthful). You may (or may not) have encountered a situation where you’ve performed a stack buffer overflow, overwriting either a RET address or a SEH  record, but instead of seeing 0×41414141 in EIP, you got 0×00410041. Sometimes, when data is used in a function, some manipulations are applied. Sometimes data is converted to uppercase, to lowercase, etc…  In some situations data gets converted to unicode.  When you see 0×00410041 in EIP, in a lot of cases, this probably means that your payload had been converted to unicode before it was put on the …

I have received a very sad message this morning that str0ke (milw0rm) has passed away yesterday. I sincerely hope this is some (bad and morbid) joke, but if it’s not then all I can say is that this is terrible. My thoughts and prayers are with his family (wife & 4 children) now. Rest in peace, str0ke. We’ll miss you bro. /Be safe 1974-04-29  / 2009-11-03 bl4cksecurity.blogspot.com/2009/11/str0ke-milworms-funeral-is-this-friday.html http://blog.xanda.org/2009/11/04/rest-in-peace-str0ke-milw0rm/   Update : maybe this is a bad joke after all : Read more »

Just a few moments ago, Neil Roiter has reported on SearchSecurity that The Metasploit Project (and the Metasploit Framework) has been acquired by Rapid7, a network vulnerability management vendor. This news has been confirmed by Rapid7 (see website) and by Metasploit (see blog)

A podcast of a discussion (on the acquisition) between HD Moore and Corey Thomas can be found here

Base on the SearchSecurity report, Metasploit will remain open source (free licensing), and Rapid7 seems to be exploring ways to integrate Metasploit into their own NeXpose products.

It is not clear whether a commercial version of Metasploit framework will be developed in the future (to compete with similar tools from companies such as Immunity and Core Security), but let’s hope the framework will remain free, maintained and updated in the future as it has been in …