Exploits Archives - Page 3 of 4 - Corelan | Exploit Development & Vulnerability Research

Exploit writing tutorial part 10 : Chaining DEP with ROP - the Rubik's[TM] Cube

About 3 months after finishing my previous exploit writing related tutorial, I finally found some time and fresh energy to start writing a new article. In the previous tutorials, I have explained the basics of stack based overflows and how they can lead to arbitrary code execution. I discussed direct RET overflows, SEH based exploits, Unicode and other character restrictions, the use of debugger plugins to speed up exploit development, how to bypass common memory protection mechanisms and how to write your own shellcode. While the first tutorials were really written to learn the basics about exploit development, starting from scratch (targeting people without any knowledge about exploit development) you have most likely discovered that the more recent tutorials continue to build on those basics and require solid knowledge of asm, creative thinking, and some experience with exploit writing in general. Today's tutorial is no different. I will continue to build upon everything we have seen and learned in the previous tutorials. Today I will talk about ROP and how it can be used to bypass DEP (and ASLR)... Read more

Offensive Security Hacking Tournament - How strong was my fu ?

Hi,

Over the last 2 days my friends from Corelan Team and I participated in a Hacking Tournament, organized by Offensive Security. The primary goals of the tournament are :

be the first one to grab "secret" Read more

Exploiting Ken Ward Zipper : Taking advantage of payload conversion

In the article I wrote on the abysssec.com website, I explained the steps and techniques needed to build a working exploit for Ken Ward's zipper.

One of the main difficulties I had to overcome when building the exploit, was Read more

QuickZip Stack BOF 0day: a box of chocolates

Over the last couple of weeks, ever since I published 2 articles on the Offensive Blog, I have received many requests from people asking me if they could get a copy of those articles in pdf format. My blog Read more

Ken Ward Zipper exploit write-up on abysssec.com

Hi all,

I just wanted to drop a few lines to let you know that, earlier today, my exploit write-up article about this vulnerability was published on www.abysssec.com.

You can find the article here : http://www.abysssec.com/blog/2010/03/ken-ward-zipper-stack-bof-0day-a-not-so-typical-seh-exploit/

Enjoy !

corelanc0d3r featured on Offensive Security Blog

A few moments ago I published a detailed write-up, explaining the steps I took to build a 0day exploit for a zip file handling bug in QuickZip, on the Offensive Security blog.

You can read the article here :

http://www.offensive-security.com/blog/vulndev/quickzip-stack-bof-0day-a-box-of-chocolates/

Exploit writing tutorial part 8 : Win32 Egg Hunting

Introduction

Easter is still far away, so this is probably the right time to talk about ways to hunting for eggs (so you would be prepared when the easter bunny brings you another 0day vulnerability)

In the first parts Read more

Introduction

In all previous tutorials in this Exploit writing tutorial series, we have looked at building exploits that would work on Windows XP / 2003 server.

The success of all of these exploits (whether they are based on direct Read more

Exploits (36)

Introduction

Introduction