~/writing
Writing
Writeups on exploit development, shellcode, binary exploitation and networking. Posts from retired sites are rehosted here; a few originals (marked as external) still live with their publisher. Subscribe via RSS.
23 posts shown
201817
- Exploit Dev
Vulnserver KSTET: WS2_32 recv Function Re-Use
Defeating a 66-byte buffer constraint in Vulnserver's KSTET command by reusing WS2_32.recv to stage and execute a full reverse shell over the live socket.
- Reverse Engineering
Patching a Binary to Disable ASLR Using Python
Leveraging Python's pefile package to flip the ASLR bit in a binary and save the patched file — handy for deterministic addresses while developing (and for backdooring).
- Exploit Dev
QuickZip 4.60.019 SEH Buffer Overflow
A structured-exception-handler overwrite exploit for QuickZip 4.60.019, walked through end to end from crash to reliable code execution.
- Exploit Dev
Using Python's struct.pack in Exploit Development
Once you control EIP you have to overwrite it with an address in the right byte order. Using struct.pack to build precise little-endian payloads instead of hand-writing bytes.
- Shellcode / SLAE
Creating an AES-256-GCM Shellcode Crypter
A custom crypter that encrypts shellcode at rest and decrypts it at runtime with authenticated AES-256-GCM. SLAE-1134 assignment #7.
- Shellcode / SLAE
Creating 3 Polymorphic Shellcode Variants of Shell-Storm Samples
Rewriting published Shell-Storm payloads into functionally identical but byte-divergent polymorphic variants. SLAE-1134 assignment #6.
- Shellcode / SLAE
Analyzing Metasploit's linux/x86/adduser Payload
Disassembling and annotating Metasploit's adduser payload instruction by instruction to understand what it really does. SLAE-1134 assignment #5.3.
- Shellcode / SLAE
Linux x86 Two-Byte Shift Encoder
A custom shellcode encoder that shifts bytes to strip bad characters and defeat naive signatures. SLAE-1134 assignment #4.
- Shellcode / SLAE
Linux x86 Egghunter
A compact egghunter that scans memory for a tagged payload before transferring execution to it. SLAE-1134 assignment #3.
- Shellcode / SLAE
TCP IPv4 and IPv6 Linux x86 Reverse Shell
Hand-written x86 assembly for a reverse shell that connects back over either IPv4 or IPv6. SLAE-1134 assignment #2, also on Exploit-DB (45292).
- Shellcode / SLAE
TCP IPv4, IPv6 and Dual-Stack Linux x86 Bind Shell
Hand-written x86 assembly for a bind shell serving both IPv4 and IPv6 over a dual-stack socket. SLAE-1134 assignment #1, also on Exploit-DB (45291).
- CVE / Exploit Release
DynoRoot (CVE-2018-1111) Exploit Released
Announcing the release of my CVE-2018-1111 (DynoRoot) exploit, archived on Exploit-DB — a rogue DHCP server that lands root on RHEL/CentOS/Fedora, with a Metasploit module to follow.
- Binary Exploitation
Solving split — ROP Emporium Part 2
Continuing the ROP Emporium series with the 'split' challenge, building a ROP chain against the 32-bit (x86) binary one gadget at a time.
- Binary Exploitation
Solving ret2win — ROP Emporium Part 1
An introduction to return-oriented programming via ROP Emporium, written while preparing for Offensive Security's Cracking the Perimeter (OSCE).
- CTF Walkthrough
Hack The Box: Node
A walkthrough of the HTB 'Node' machine that dug into single-page applications and the MEAN (Mongo, Express, Angular, Node) stack on the way to root.
- CTF Walkthrough
Hack The Box: Solid State
Owning the HTB 'Solid State' box through a misconfigured mail server and a restricted-shell escape.
- Exploit Dev
Buffer Overflows: Remote Buffer Overflow MiniShare 1.4.1 (CVE-2004-2271)
An introduction to writing a buffer overflow for CVE-2004-2271 — a flaw in MiniShare 1.4.1 and earlier that lets a remote attacker run code via a long HTTP GET request.
20173
- CTF Walkthrough
Hack The Box: Legacy
The HTB 'Legacy' machine's SMB service is vulnerable to MS08-067, allowing arbitrary code execution in a SYSTEM context.
- CTF Walkthrough
Hack The Box: Lame
The HTB 'Lame' box runs a distcc instance vulnerable to remote code execution; from there a suid nmap install escalates to root.
- Privilege Escalation
Privilege Escalation — The Questions, Linux Edition Pt. 1
Too many walkthroughs cover the commands to run but never the questions worth asking. A look at why you hunt for certain information the moment you land on a Linux target.
20153
- Security
MetaSploit 101: Finding and Exploiting a MySQL User Account
Using Metasploit to locate an exposed MySQL instance, brute-force valid credentials, then log in and examine the database.
- Networking
When Can I Drop SYN Packets Safely?
With the rise of volumetric denial-of-service attacks, it matters more than ever to identify unusual and potentially malicious SYN packets — and know when it's safe to drop them.
- Networking
The Basics of the TCP 3-Way Handshake
SYN, SYN-ACK, ACK — the three-way handshake explained as the foundation for everything that rides on TCP.