Posts:

In this post, we'll look at an application reversing challenge from HTS (hackthissite.org) resembling a real-life protection scheme. Put simple, the program creates a key for your username, and compares it to the one you enter. The goal of the HTS challenge is to create a key generator, but I just want to demonstrate how to retrieve the password. Read more

A lot has been said and written already about heap spraying, but most of the existing documentation and whitepapers focus on IE7 or older versions. Although there are a number of public exploits available that target IE8, the exact technique to do so has not been really documented in detail. Of course, you can probably derive how it works by looking at those public exploits. With this tutorial, I'm going to provide you with a full and detailed overview on what heap spraying is, and how to use it on old and newer platforms. I'll start with some "ancient" techniques (or classic techniques if you will) that can be used on IE6 and IE7. We'll also look at heap spraying for non-browser applications. Next, we'll talk about precision heap spraying, which is a requirement to make DEP bypass exploits work on IE8. I'll finish this tutorial with sharing some of my own research on getting reliable heap spraying to work on IE9. Read more

September is going to be a busy month. With Brucon approaching very fast and Derbycon on its way as well, it looks like I will be spending more time at cons than at work :) I'll have the pleasure to teach the Corelan Live Exploit Development Bootcamp trainings at Brucon and Derbycon. If you are a student, make sure to check the prerequisites so we're all set to make the training a success for everyone. Read more

On June 14, 2011 HD Moore announced the Metasploit Bounty contest, offering a cash incentive for specific vulnerabilities to be submitted as modules in the Metasploit Framework. Titled "30 exploits, $5000 in 5 weeks", a post on the Rapid7 blog lists the 30 "bounties" selected by the MSF team, waiting for someone to claim and submit a working exploit module. Read more

This document describes the various commands, functionality and behaviour of mona.py. Released on june 16, this pycommand for Immunity Debugger replaces pvefindaddr, solving performance issues and offering numerous new features. pvefindaddr will still be available for download until all of its functionality has been ported over to mona. Read more

Over the last few weeks, there has been some commotion about a universal DEP/ASLR bypass routine using ROP gadgets from msvcr71.dll (written by Immunity Inc) and the fact that it might have been copied into an exploit submitted to Metasploit as part of the Metasploit bounty. I'm not going to make any statements about this, but the ROP routine itself looks pretty slick. Read more

FINALLY ! After spending almost 6 months of designing, developing and testing, and after 'surviving' 2 presentations (at AthCon and Hack In Paris), I am extremely excited and proud to present, on behalf of the entire Corelan Team, the general availability of mona.py. With this announcement, we also declare pvefindaddr officially dead from this point forward. (This doesn't mean pvefindaddr is now entirely worthless, because not all functions have been ported into mona yet, but we won't be releasing any updates to pvefindaddr anymore and the entire project page/download page will eventually disappear) Read more

After having breakfast, chatting with ping and hanging out with @kokanin, @xme and @wimremes, it was time to start attending the various talks. So, as promised in yesterdays preview, what follows is the report of my first day at Black Hat Europe 2011. Read more

Yesterday, sickn3ss (one of the frequent visitors of the #corelan channel on freenode IRC) posted a really interesting question.

The question

While testing ROP gadgets, as part of the process of building a DEP bypass exploit for WM Downloader, Read more

Special Thanks:

To my wife for putting up with my crap. Also SolarWinds for keeping an open communication while fixing the issue. And of course… Corelan Team 😛

Audio:

Many thanks to DJ Great Scott for supplying me with Read more