Last Friday I presented at Ruxmon on windows exploitation under newer platforms, bypassing arguably the two most painful mitigations at the moment, DEP & ASLR.

For those that don’t know, Ruxmon is a monthly security meeting based upon the security conference, Ruxcon.

It was great to get up, overcome some fears and gain some constructive feedback and in

The other day I had an interview with myne-us over at securabit discussing a quick and dirty revamp I did of the aurora exploit. It was nice to meet myne-us and I have since become a regular podcast listener of securabit! thanks guys.

You can view the blog entry here, enjoy !

We have talked previously about stack based buffer overflows and format strings vulnerabilities. Now it is time to take it a step further and play with the windows heap manager!

Unlink() to execute a write 4 primitive

Previously, with stack overflows, we have gained control of the execution pointer (EIP) some how whether that be through the exception handler or directly. Today we are going to discuss a se

More recently I have researched methods on bypassing two security protection mechanisms under windows that have proven quite difficult. Whist this is nothing new, I will provide the understanding I have of the techniques and show you a brief demonstration of the approach I took. We will discuss this techniques in relation to stack based buffer overflows only for now. What is interesting is that each one protection mechanism individually a

代码:

#include <stdio.h>
#include <windows.h>

const unsigned __int64 prime[2] = {2,3};
const int primeNumTblSize = sizeof(prime) / sizeof(prime[0]);

void PrintFactorization( unsigned __int64 srcNum, unsigned __int64 baseNum )
{
  unsigned __int64 yinzi[64] = {0};
  int mi[64] = {0};
  int numOfYinzi = 0;

Ok so you can exploit EIP and SEH overwrites and your getting bored of the rather simple process of this… and one day your fuzzing away and then boooom ! you see:

I am going to talk briefly about what Unicode is and how you can write customi

A little while ago I found a 0day attack on Oracle 11g database that has a somewhat high impact (however low likleyhood). The vulnerability is within the parsing of the ‘file’ field inside a parameter file specified on the command line to Oracles export utility. The export utility is not ran as privileged code, however the vulnerability was technically imteresting to exploit.

So what is the situation? A specially