Exploit writing tutorial part 7 : Unicode – from 0x00410041 to calc

Finally … after spending a couple of weeks working on unicode and unicode exploits, I’m glad and happy to be able to release this next article in my basic exploit writing series : writing exploits for stack based unicode buffer overflows (wow – that’s a mouthful). You may (or may not) have encountered a situation […]

Str0ke R.I.P. (or alive & kicking ?)

I have received a very sad message this morning that str0ke (milw0rm) has passed away yesterday. I sincerely hope this is some (bad and morbid) joke, but if it’s not then all I can say is that this is terrible. My thoughts and prayers are with his family (wife & 4 children) now. Rest in […]

Exchange 2010 Certificates

In an older blog post on Certificate Authorities, I have provided some information about the process to generate Exchange 2007 certificates.  This process has slightly changed in Exchange 2010, and Johan Delimon (pro-exchange.be) has written an excellent article about this : Generating Exchange 2010 Certificates (Exchange Management Shell) The 2 most important changes are : […]

Backup & Restore Windows Server based Print Servers

After having to recover a broken Windows Server based print server yesterday, I decided to write this small article on how to set up print server backups, and describe the simple process of recovering the print server after a crash (or even roll back printer drivers in case a newly installed driver messes up your […]

Metasploit Project acquired by Rapid7

Just a few moments ago, Neil Roiter has reported on SearchSecurity that The Metasploit Project (and the Metasploit Framework) has been acquired by Rapid7, a network vulnerability management vendor. This news has been confirmed by Rapid7 (see website) and by Metasploit (see blog) A podcast of a discussion (on the acquisition) between HD Moore and […]

Script to backup Cisco switches via telnet / tftp

A couple of days ago, I have released a small perl script to back up Cisco IOS based switches via telnet. I know there are a couple of similar scripts available on the internet, but most of them either use the “expect” functionality (which does not work all the time), or use SendKeys (which only […]

Fuzzing with Metasploit : Simple FTP fuzzer

Just wanted to drop a quick note about the release of another free script. This time I’ve written a simple FTP fuzzer (with a little help from HDMoore) in Metasploit. You can read more about it (and download the script) at http://www.corelan.be:8800/index.php/my-free-tools/security/metasploit/simple-ftp-fuzzer-metasploit-module/ This is why I like Metasploit so much… :-) Update : after running […]

Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR

Introduction In all previous tutorials in this Exploit writing tutorial series, we have looked at building exploits that would work on Windows XP / 2003 server. The success of all of these exploits (whether they are based on direct ret overwrite or exception handler structure overwrites) are based on the fact that a reliable return […]

Why Vista 32bit doesn’t use more than 3Gb of memory, even if you have more RAM installed

Found this link on twitter – a very interesting read indeed : http://www.geoffchappell.com/viewer.htm?doc=notes/windows/license/memory.htm

Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development

In the first parts of this exploit writing tutorial, I have mainly used Windbg as a tool to watch registers and stack contents while evaluating crashes and building exploits. Today, I will discuss some other debuggers and debugger plugins that will help you speed up this process. A typical exploit writing toolkit arsenal should at […]

Corelan Training

We have been teaching our win32 exploit dev classes at various security cons and private companies & organizations since 2011

Check out our schedules page here and sign up for one of our classes now!

Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Protected by Copyscape Web Plagiarism Tool

Corelan on Slack

You can chat with us and our friends on our Slack workspace:

  • Go to our facebook page
  • Browse through the posts and find the invite to Slack
  • Use the invite to access our Slack workspace
  • Categories