Abysssec Research. 1) Advisory information. 2) Vulnerable version
|
|
|
- Egbert McKenzie
- 5 years ago
- Views:
Transcription
1 Abysssec Research 1) Advisory information Title : Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Version : Firefox Discovery : Vendor : Impact : Critical Contact : shahin [at] abysssec.com, info [at] abysssec.com Twitter CVE : CVE ) Vulnerable version Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux sparc Ubuntu Ubuntu Linux powerpc Ubuntu Ubuntu Linux i386 Ubuntu Ubuntu Linux amd64
2 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE SUSE Linux Enterprise SDK 11 SuSE SUSE Linux Enterprise SDK 10 SP3 SuSE opensuse 11.3 Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux -current S.u.S.E. SUSE Linux Enterprise Server 11 SP1 + Linux kernel S.u.S.E. SUSE Linux Enterprise Server 11 + Linux kernel S.u.S.E. SUSE Linux Enterprise Server 10 SP3 S.u.S.E. SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel S.u.S.E. SUSE Linux Enterprise Desktop 11 S.u.S.E. SUSE Linux Enterprise Desktop 10 SP3 S.u.S.E. opensuse 11.2 S.u.S.E. opensuse 11.1 RedHat Fedora 13 RedHat Fedora 12 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux AS 4 RedHat Enterprise Linux AS 3 RedHat Enterprise Linux Desktop version 4 RedHat Enterprise Linux 5 server RedHat Desktop 4.0 RedHat Desktop 3.0 Mozilla SeaMonkey Mozilla SeaMonkey Mozilla SeaMonkey Mozilla SeaMonkey Mozilla SeaMonkey Mozilla SeaMonkey 2.0 Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox
3 Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox Mozilla Firefox 3.5 Mozilla Firefox 3.6 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 5.2 Avaya Messaging Storage Server 5.1 Avaya Messaging Storage Server 5.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 SP1 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 5.2 Avaya Message Networking 3.1 Avaya Message Networking Avaya IQ 5.1 Avaya IQ 5 Avaya Intuity AUDIX LX R1.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2
4 Avaya Aura System Manager 1.0 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 3) Vulnerability information Class 1- Code execution Impact An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application. Remotely Exploitable Yes Locally Exploitable Yes 4) Vulnerabilities detail In this vulnerabilty the malformed page contain a call to a plugin exist in firefox which has many vulnerable parameters. The flaw exists in xul!nsplugininstanceowner::ensurecachedattrparamarrays (void) function. Here Is the vuleranble and patched version of the code: UnPatch FireFox 3.6.6: d8548ffffff lea eax,[ebp-0b8h] d 50 push eax e 8d45dc lea eax,[ebp-24h] push eax push ebx e8b2f6ddff call xul!nsplugininstanceowner::fixupurls (10601efa)
5 a00 push a 6a01 push c 6a01 push e 8d45dc lea eax,[ebp-24h] push eax bfd0b79e10 mov edi,offset xul!`string' (109eb7d0) e804a18aff call xul!nsstring::trim (100cc960) c 6a00 push e 6a01 push a01 push d8548ffffff lea eax,[ebp-0b8h] push eax e8f2a08aff call xul!nsstring::trim (100cc960) e 0fbfbdb0feffff movsx edi,word ptr [ebp-150h] c0 xor eax,eax d75dc lea esi,[ebp-24h] a e846e39dff call xul!tonewutf8string (10200bc5) f 0fb74b5e movzx ecx,word ptr [ebx+5eh] b5364 mov edx,dword ptr [ebx+64h] cf add ecx,edi a04 mov dword ptr [edx+ecx*4+4],eax ds:0023:06db7020= c 33c0 xor eax,eax e 8db548ffffff lea esi,[ebp-0b8h] e82ce39dff call xul!tonewutf8string (10200bc5) fb74b5e movzx ecx,word ptr [ebx+5eh] d 8b5368 mov edx,dword ptr [ebx+68h] a0 03cf add ecx,edi a2 ff85b0feffff inc dword ptr [ebp-150h] a a04 mov dword ptr [edx+ecx*4+4],eax ac 8bce mov ecx,esi ae e81d9a92ff call xul!nsastring_internal::finalize (1014c2d0) b3 8d4ddc lea ecx,[ebp-24h] b6 e8159a92ff call xul!nsastring_internal::finalize (1014c2d0) bb ff85acfeffff inc dword ptr [ebp-154h] c1 0fbf85acfeffff movsx eax,word ptr [ebp-154h] c8 0fb74b60 movzx ecx,word ptr [ebx+60h] cc 3bc1 cmp eax,ecx ce 0f8ce7feffff jl xul!nsplugininstanceowner::ensurecachedattrparamarrays+0x746 (108227bb) Patch FireFox 3.6.7: 1081d72e 8d8548ffffff lea eax,[ebp-0b8h] 1081d push eax 1081d735 8d45dc lea eax,[ebp-24h] 1081d push eax 1081d push ebx 1081d73a e8195adfff call xul!nsplugininstanceowner::fixupurls ( ) 1081d73f 33c0 xor eax,eax 1081d741 8d75dc lea esi,[ebp-24h] 1081d744 e860ca9bff call xul!tonewutf8string (101da1a9) 1081d749 8b4b64 mov ecx,dword ptr [ebx+64h] 1081d74c 8904b9 mov dword ptr [ecx+edi*4],eax
6 1081d74f 33c0 xor eax,eax 1081d751 8db548ffffff lea esi,[ebp-0b8h] 1081d757 e84dca9bff call xul!tonewutf8string (101da1a9) 1081d75c 8b4b68 mov ecx,dword ptr [ebx+68h] 1081d75f 8904b9 mov dword ptr [ecx+edi*4],eax 1081d762 8d4ddc lea ecx,[ebp-24h] 1081d inc edi 1081d766 e875e98fff call xul!nsastring_internal::finalize (1011c0e0) 1081d76b 8bce mov ecx,esi 1081d76d e86ee98fff call xul!nsastring_internal::finalize (1011c0e0) 1081d772 8b85acfeffff mov eax,dword ptr [ebp-154h] 1081d feffff add eax,dword ptr [ebp-168h] 1081d77e 3b85b0feffff cmp eax,dword ptr [ebp-150h] 1081d acfeffff mov dword ptr [ebp-154h],eax 1081d78a 0f8530ffffff jne xul!nsplugininstanceowner::ensurecachedattrparamarrays+0x5c0 (1081d6c0) xul!nsplugininstanceowner::ensurecachedattrparamarrays (void) function temporarly hold value of PARAM tags. In the vulnerable section at address 0x f value of ecx register which is used as an index of acessing to memory in address 0x is filled with a 2bytes value but in the patche version it is filled with a 4byts value. and increasing the value of array cause an access violation to the memory. To see the flaw in firefox we installed the JVM plugin on the software. For the purpose of loading the plugin to memory, we embed an applet of java to the malformed page. PARAM tag is used as an internal tag for applet tag and it is used to pass parameteres to the applet. These PARAM tags are stores as an arry temporarly. If number of tags are greater than MAX(unsigned short), software faces an access violation in accessing the elements of the array. An implemention of PARAM tag: <APPLET code="audioitem" width="15" height="15"> <PARAM name="snd" value="hello.au Welcome.au"> Java applet that plays a welcoming sound. </APPLET> In this example Hello.au, Welcome.au files are passed to the applet as snd argument. According to the report we run Hello.au,Welcome.au command at windblg command line and here is the result: xul!nsplugininstanceowner::ensurecachedattrparamarrays (void) By setting a breakpoint at address xul!nsplugininstanceowner::ensurecachedattrparamarrays(void) we noticed that number of PARAM tag is used as an index for accessing element of array. So by creating
7 more PARAM tags the software faces Access violation exceiptopn at address 0x while accessing element of array. Here are the details of exception: (1b0.4b0): Access violation - code c (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=03d402a4 ebx=02a34dd0 ecx=ffff87ff edx=0561f000 esi=0012f308 edi=ffff87fa eip= esp=0012f160 ebp=0012f32c iopl=0 nv up ei ng nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl= xul!nsplugininstanceowner::ensurecachedattrparamarrays+0x813: a04 mov dword ptr [edx+ecx*4+4],eax ds:0023: =????????
Abysssec Research. 1) Advisory information. 2) Vulnerable version
Abysssec Research 1) Advisory information Title : Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability Version : Firefox 3.6.3 Analysis : http://www.abysssec.com Vendor : http://www.mozilla.com
Abysssec Research. 1) Advisory information. 2) Vulnerable version
Abysssec Research 1) Advisory information Title : Adobe Acrobat and Reader "newclass" invalid pointer vulnerability Version :
Abysssec Research. 1) Advisory information. 2) Not vulnerable version
Abysssec Research 1) Advisory information Title : Java CMM readmabcurvedata stack overflow Version : Java runtime
Abysssec Research. 1) Advisory information. 2) Vulnerable version. : Microsoft Excel SxView Record Parsing Memory Corruption
Abysssec Research 1) Advisory information Title Version Analysis Vendor Impact Contact Twitter CVE : Microsoft Excel SxView Record Parsing Memory Corruption : Excel 2002 SP3 : http://www.abysssec.com :
SA31675 / CVE
Generated by Secunia 10 September, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 4 Fixed Versions 5 References 5 Generated by Secunia
Autodesk AutoCAD DWG-AC1021 Heap Corruption
security research Autodesk AutoCAD DWG-AC1021 Heap Corruption Mar 2013 AutoCAD is a software for computer-aided design (CAD) and technical drawing in 2D/3D, being one of the worlds leading CAD design tools.
Overview of Compiler. A. Introduction
CMPSC 470 Lecture 01 Topics: Overview of compiler Compiling process Structure of compiler Programming language basics Overview of Compiler A. Introduction What is compiler? What is interpreter? A very
Abysssec Research. 1) Advisory information. 2) Vulnerability Information. Class 1- Stack overflow. Impact
Abysssec Research 1) Advisory information Title Version Analysis Vendor Impact Contact Twitter : Novell Netware NWFTPD RMD/RNFR/DELE Argument Parsing Buffer overflow : NWFTPD.NLM 5.09.02 (Netware 6.5 SP8)
WinDbg: trivial examining of the stack
WinDbg: trivial examining of the stack revision: 1 author: Alexandre Borges Hello readers, how are you? It has passed a long time since my last post. As I've explained previously, my time for writing is
CanSecWest 2011, March Understanding and Exploiting Flash ActionScript Vulnerabilities -- Haifei Li, Sr. Security Researcher
CanSecWest 2011, March 2011 Understanding and Exploiting Flash ActionScript Vulnerabilities -- Haifei Li, Sr. Security Researcher hfli@fortinet.com Why started this research Recent years we have seen an
Hunting Zero Days in Crash Dumps. hotwing
Hunting Zero Days in Crash Dumps hotwing /usr/bin/whoami D923AE0C-190D-4EDF-B07A-76AC571FBFD4 SCSKEX.cab filever /v SCSKEX.ocx --a-- W32i DLL ENU 4.0.31.7 shp 858,832 scskex.ocx Language 0x0409 (English
complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]
![complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]](/thumbs/76/72989659.jpg "complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]")
The following pages contain references for use during the exam: tables containing the x86 instruction set (covered so far) and condition codes. You do not need to submit these pages when you finish your
LdPinch Report. Feng Zhu Jinpeng Wei
LdPinch Report Feng Zhu (fzhu001@fiu.edu), Jinpeng Wei (weijp@cs.fiu.edu) 1 Malware General Information Malware Name: LdPinch (named by ThreatExpert) File size: 641,536 bytes File type: PE32 executable
SA28083 / CVE
Generated by Secunia 9 April, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Affected Versions 5 Fixed Versions 5 References 5 Generated by Secunia 9
A Simple Analysis of CVE
A Simple Analysis of CVE-2018-0802 By ITh4cker 0x00 Introduction This Vul has been confirmed a stack overflow in the patched EQNEDT32.exe by CVE-2017-11882,so it s a patch-bypass vul. In fact,when I analyzed
Writing Exploits with MSF3.0
Writing Exploits with MSF3.0 Saumil Shah hack.lu 2007 Luxembourg, October 18 2007 Setup and Instructions VMWare Player if you don t have VMWare Workstation Copy VM Image from CD, unzip the ZIP file Administrator
Basic Pentium Instructions. October 18
Basic Pentium Instructions October 18 CSC201 Section 002 Fall, 2000 The EFLAGS Register Bit 11 = Overflow Flag Bit 7 = Sign Flag Bit 6 = Zero Flag Bit 0 = Carry Flag "Sets the flags" means sets OF, ZF,
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics This document is only to be distributed to teachers and students of the Malware Analysis and Antivirus Technologies course and should only be used in accordance with
SA30285 / CVE
Generated by Secunia 17 December, 2008 6 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 5 Characteristics 6 Tested Versions 6 Fixed Versions 6 References 6 Generated by Secunia
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP Alexandros Kapravelos akaprav@ncsu.edu NOEXEC (W^X) 0xFFFFFF Stack Heap BSS Data 0x000000 Code RW RX Deployment Linux (via PaX patches) OpenBSD
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src
16.317: Microprocessor Systems Design I Fall 2014
16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Title: Reverse Engineering: Anti-Cracking Techniques. Date: April 12th Website:
Title: Reverse Engineering: Anti-Cracking Techniques Date: April 12th 2008 Website: http://www.astalavista.com Author: Nicolaou George Mail: ishtus@astalavista.com Author: Charalambous Glafkos Mail: glafkos@astalavista.com
A bit away from Kernel execution A write-what-where kernel memory overwrite tale.
A bit away from Kernel execution A write-what-where kernel memory overwrite tale. By ar1vr (01/12/2011) picturoku.blogspot.com Página 1 Good arbitrary kernel memory overwrites are hard to find this days.
Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher
Reverse Engineering II: Basics Gergely Erdélyi Senior Antivirus Researcher Agenda Very basics Intel x86 crash course Basics of C Binary Numbers Binary Numbers 1 Binary Numbers 1 0 1 1 Binary Numbers 1
MWR InfoSecurity Security Advisory. Intersystems Caché CSP (Caché Server Pages) Stack Overflow. 17 th December 2009
MWR InfoSecurity Security Advisory Intersystems Caché CSP (Caché Server Pages) Stack Overflow 17 th December 2009 2009-12-17 Page 1 of 8 CONTENTS CONTENTS 1 Detailed Vulnerability Description... 5 1.1
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics Gergely Erdélyi Senior Manager, Anti-malware Research Protecting the irreplaceable f-secure.com Binary Numbers 1 0 1 1 - Nibble B 1 0 1 1 1 1 0 1 - Byte B D 1 0 1 1 1
Buffer Overflow Attack
Buffer Overflow Attack What every applicant for the hacker should know about the foundation of buffer overflow attacks By (Dalgona@wowhacker.org) Email: zinwon@gmail.com 2005 9 5 Abstract Buffer overflow.
SA33901 / CVE
Released by Secunia 23 February, 2009 6 pages Table of Contents Terms and Conditions 2 Introduction 3 Technical Details 3 Exploitation 5 Characteristics 5 Tested Versions 6 Fixed Versions 6 References
Q1: Multiple choice / 20 Q2: Data transfers and memory addressing
16.317: Microprocessor Systems Design I Fall 2014 Exam 1 October 1, 2014 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
16.317: Microprocessor Systems Design I Spring 2014
16.317: Microprocessor Systems Design I Spring 2014 Exam 1 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by
Lecture 2 Assembly Language
Lecture 2 Assembly Language Computer and Network Security 9th of October 2017 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 2, Assembly Language 1/37 Recap: Explorations Tools assembly
Q1: Multiple choice / 20 Q2: Protected mode memory accesses
16.317: Microprocessor-Based Systems I Summer 2012 Exam 2 August 1, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
16.317: Microprocessor Systems Design I Fall 2013
16.317: Microprocessor Systems Design I Fall 2013 Exam 1 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
MWR InfoSecurity Security Advisory. IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability. 4th March 2010
MWR InfoSecurity Security Advisory IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability 4th March 2010 2010-03-04 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998 Assembler Syntax Everything looks like this: label: instruction dest,src instruction label Comments: comment $ This is a comment
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
CVE EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK
CVE-2017-11882 EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK First words of thank to Embedy Company to discover the initial exploit and POC of 44 bytes máximum, Ridter
Instructions moving data
do not affect flags. Instructions moving data mov register/mem, register/mem/number (move data) The difference between the value and the address of a variable mov al,sum; value 56h al mov ebx,offset Sum;
System calls and assembler
System calls and assembler Michal Sojka sojkam1@fel.cvut.cz ČVUT, FEL License: CC-BY-SA 4.0 System calls (repetition from lectures) A way for normal applications to invoke operating system (OS) kernel's
Stack -- Memory which holds register contents. Will keep the EIP of the next address after the call
Call without Parameter Value Transfer What are involved? ESP Stack Pointer Register Grows by 4 for EIP (return address) storage Stack -- Memory which holds register contents Will keep the EIP of the next
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
Buffer-Overflow Attacks on the Stack
Computer Systems Buffer-Overflow Attacks on the Stack Introduction A buffer overflow occurs when a program, while writing data to a buffer, overruns the buffer's boundary and overwrites memory in adjacent
T Reverse Engineering Malware: Static Analysis I
T-110.6220 Reverse Engineering Malware: Static Analysis I Antti Tikkanen, F-Secure Corporation Protecting the irreplaceable f-secure.com Representing Data 2 Binary Numbers 1 0 1 1 Nibble B 1 0 1 1 1 1
The Microprocessor and its Architecture
The Microprocessor and its Architecture Contents Internal architecture of the Microprocessor: The programmer s model, i.e. The registers model The processor model (organization) Real mode memory addressing
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions?
administrivia today start assembly probably won t finish all these slides Assignment 4 due tomorrow any questions? exam on Wednesday today s material not on the exam 1 Assembly Assembly is programming
Q1: Multiple choice / 20 Q2: Memory addressing / 40 Q3: Assembly language / 40 TOTAL SCORE / 100
16.317: Microprocessor-Based Systems I Summer 2012 Exam 1 July 20, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
CSE509 System Security
CSE509 System Security Software Security Nick Nikiforakis nick@cs.stonybrook.edu Things we are going to discuss Basic x86 assembly instructions Stack workings GDB syntax Overflows Stack Heap Shellcode
CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs
CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)
CSC 8400: Computer Systems. Machine-Level Representation of Programs
CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages
The Geometry of Innocent Flesh on the Bone
The Geometry of Innocent Flesh on the Bone Return-into-libc without Function Calls (on the x86) Hovav Shacham hovav@cs.ucsd.edu CCS 07 Technical Background Gadget: a short instructions sequence (e.x. pop
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration. Xeno Kovah
Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah 2014-2015 xeno@legbacore.com All materials is licensed under a Creative Commons Share Alike license. http://creativecommons.org/licenses/by-sa/3.0/
Data Exfiltration Techniques
Data Exfiltration Techniques Introduction In this article we will see how malware encode or encrypt data that s exfiltrated to the Command and Control Server from infected machines. This is often done
Flash JIT Spraying info leak gadgets
Flash JIT Spraying info leak gadgets Author: Fermin J. Serna - fjserna@gmail.com - @fjserna URL: http://zhodiac.hispahack.com/my-stuff/security/flash_jit_infoleak_gadgets.pdf PoC: http://zhodiac.hispahack.com/my-stuff/security/flash_jit_infoleak_gadgets/
CMSC 313 Lecture 12. Project 3 Questions. How C functions pass parameters. UMBC, CMSC313, Richard Chang
Project 3 Questions CMSC 313 Lecture 12 How C functions pass parameters UMBC, CMSC313, Richard Chang Last Time Stack Instructions: PUSH, POP PUSH adds an item to the top of the stack POP
Registers. Ray Seyfarth. September 8, Bit Intel Assembly Language c 2011 Ray Seyfarth
Registers Ray Seyfarth September 8, 2011 Outline 1 Register basics 2 Moving a constant into a register 3 Moving a value from memory into a register 4 Moving values from a register into memory 5 Moving
Buffer-Overflow Attacks on the Stack
Computer Systems Buffer-Overflow Attacks on the Stack Introduction A buffer overflow occurs when a program, while writing data to a buffer, overruns the buffer's boundary and overwrites memory in adjacent
16.317: Microprocessor Systems Design I Fall 2015
16.317: Microprocessor Systems Design I Fall 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
Sneha Rajguru & Prajwal Panchmahalkar
Sneha Rajguru & Prajwal Panchmahalkar Sneha Rajguru Security Consultant, Payatu Technologies Pvt Ltd. @sneharajguru Prajwal Panchmahalkar Red Team Lead Security Engineer, VMware @pr4jwal Introduction to
Apology of 0days. Nicolás Waisman
Apology of 0days Nicolás Waisman Who Am I? Senior Security Researcher and Regional Manager at Immunity, Inc. Research and Development of reliable Heap Overflow exploitation for CANVAS attack framework
Q1: Multiple choice / 20 Q2: Memory addressing / 40 Q3: Assembly language / 40 TOTAL SCORE / 100
16.317: Microprocessor-Based Systems I Fall 2012 Exam 1 October 3, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
16.317: Microprocessor Systems Design I Fall 2013
16.317: Microprocessor Systems Design I Fall 2013 Exam 2 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile
Ghiribizzo s Cracking Tutorial
Ghiribizzo s Cracking Tutorial NuMega s BoundsChecker 5.xx NuMega s BoundsChecker 5.xx NuMega s BoundsChecker is a tool for software development but is also useful for crackers. NuMega have been nice enough
Fall 2014 CODEBREAKER CHALLENGE 2.0
Fall 2014 CODEBREAKER CHALLENGE 2.0 1 Challenge Scenario An international terrorist organization has recently revised the operational security (OPSEC) procedures used to communicate with their members
Ekran System System Requirements and Performance Numbers
Ekran System System Requirements and Performance Numbers Table of Contents System Requirements... 3 Performance Numbers... 6 Database Statistics... 8 2 System Requirements Ekran System claims different
CMSC 313 Lecture 12 [draft] How C functions pass parameters
![CMSC 313 Lecture 12 [draft] How C functions pass parameters](/thumbs/88/117067553.jpg "CMSC 313 Lecture 12 [draft] How C functions pass parameters")
CMSC 313 Lecture 12 [draft] How C functions pass parameters UMBC, CMSC313, Richard Chang Last Time Stack Instructions: PUSH, POP PUSH adds an item to the top of the stack POP removes an
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler return-oriented programming Hovav Shacham presented by: Fabian
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD /12/2014 Slide 1
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD 21252 rkarne@towson.edu 11/12/2014 Slide 1 Intel x86 Aseembly Language Assembly Language Assembly Language
Process Layout and Function Calls
Process Layout and Function Calls CS 6 Spring 07 / 8 Process Layout in Memory Stack grows towards decreasing addresses. is initialized at run-time. Heap grow towards increasing addresses. is initialized
x86 assembly CS449 Spring 2016
x86 assembly CS449 Spring 2016 CISC vs. RISC CISC [Complex instruction set Computing] - larger, more feature-rich instruction set (more operations, addressing modes, etc.). slower clock speeds. fewer general
Chen XiaoBo Defeating windows 7 browser memory protection
Chen XiaoBo Xiao_Chen@McAfee.com Defeating windows 7 browser memory protection 0days in 2010 Aurora CVE-2010-0867 Adobe Flash/Arobat CVE-2010-1297 Microsoft Lnk CVE-2010-2568 Adobe Acrobat Reader CVE-2010-2883
MODE (mod) FIELD CODES. mod MEMORY MODE: 8-BIT DISPLACEMENT MEMORY MODE: 16- OR 32- BIT DISPLACEMENT REGISTER MODE
EXERCISE 9. Determine the mod bits from Figure 7-24 and write them in Table 7-7. MODE (mod) FIELD CODES mod 00 01 10 DESCRIPTION MEMORY MODE: NO DISPLACEMENT FOLLOWS MEMORY MODE: 8-BIT DISPLACEMENT MEMORY
The cache is 4-way set associative, with 4-byte blocks, and 16 total lines
Sample Problem 1 Assume the following memory setup: Virtual addresses are 20 bits wide Physical addresses are 15 bits wide The page size if 1KB (2 10 bytes) The TLB is 2-way set associative, with 8 total
Error Sensitivity of Linux on PowerPC (G4) & Pentium (P4)
Error Sensitivity of Linux on PowerPC (G4) & Pentium (P4) W. Gu, Ravi K. Iyer Center for Reliable and High-Performance Computing Coordinated Science Laboratory University of Illinois at Urbana-Champaign
CS/ECE/EEE/INSTR F241 MICROPROCESSOR PROGRAMMING & INTERFACING MODULE 4: 80X86 INSTRUCTION SET QUESTIONS ANUPAMA KR BITS, PILANI KK BIRLA GOA CAMPUS
CS/ECE/EEE/INSTR F241 MICROPROCESSOR PROGRAMMING & INTERFACING MODULE 4: 80X86 INSTRUCTION SET QUESTIONS ANUPAMA KR BITS, PILANI KK BIRLA GOA CAMPUS Q1. IWrite an ALP that will examine a set of 20 memory
StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]
![StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]](/thumbs/74/70578943.jpg "StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]")
StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org] These notes are intended for anyone wishing to study the working elements of this protection.
Memory corruption vulnerability exposure can be mitigated through memory hardening practices
Memory corruption vulnerability exposure can be mitigated through memory hardening practices OS vendors have a unique opportunity to fight memory corruption vulnerabilities through hardening the memory
Assembly Language for Intel-Based Computers, 4 th Edition. Chapter 2: IA-32 Processor Architecture Included elements of the IA-64 bit
Assembly Language for Intel-Based Computers, 4 th Edition Kip R. Irvine Chapter 2: IA-32 Processor Architecture Included elements of the IA-64 bit Slides prepared by Kip R. Irvine Revision date: 09/25/2002
EECE.3170: Microprocessor Systems Design I Summer 2017
EECE.3170: Microprocessor Systems Design I Summer 2017 Lecture 8: Key Questions June 5, 2017 1. (Review) Describe the structure of a typical x86 stack frame. EECE.3170: Microprocessor Systems Design I
Title: Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs)
Title: Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs) Document last modified on: 17th September 2009 Date of discovery of vulnerabilities: December
EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution
1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can
ADDRESSING MODES. Operands specify the data to be used by an instruction
ADDRESSING MODES Operands specify the data to be used by an instruction An addressing mode refers to the way in which the data is specified by an operand 1. An operand is said to be direct when it specifies
Datapoint 2200 IA-32. main memory. components. implemented by Intel in the Nicholas FitzRoy-Dale
Datapoint 2200 IA-32 Nicholas FitzRoy-Dale At the forefront of the computer revolution - Intel Difficult to explain and impossible to love - Hennessy and Patterson! Released 1970! 2K shift register main
Rev101. spritzers - CTF team. spritz.math.unipd.it/spritzers.html
Rev101 spritzers - CTF team spritz.math.unipd.it/spritzers.html Disclaimer All information presented here has the only purpose of teaching how reverse engineering works. Use your mad skillz only in CTFs
Rootkits n Stuff
Rootkits n Stuff www.sigmil.org What a rootkit is(n t) IS Software intended to conceal running processes, files, etc from the OS A way to maintain control of a system after compromising it. ISN T A buffer
Dropping the MIC (Medium Integrity Calculator)
Dropping the MIC (Medium Integrity Calculator) Pwning Internet Explorer 4 Fun Abdul-Aziz Hariri, Security Researcher Matt Molinyawe, Security Researcher Jasiel Spelman, Security Researcher Agenda Introduction
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
aes_x86_v2.asm Page 1
1: 2: ; --------------------------------------------------------------------------- 3: ; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved. 4: ; 5: ; LICENSE TERMS 6: ; 7: ; The
Robust Shell Code Return Oriented Programming and HeapSpray. Zhiqiang Lin
CS 6V81-05: System Security and Malicious Code Analysis Robust Shell Code Return Oriented Programming and HeapSpray Zhiqiang Lin Department of Computer Science University of Texas at Dallas April 16 th,
The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 The IA-32 Stack and Function Calls CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 2 Important Registers used with the Stack EIP: ESP: EBP: 3 Important Registers used with the Stack EIP:
MWR InfoSecurity Security Advisory. IBM WebSphere MQ - rrilookupget Remote Denial of Service Vulnerability. 4th March 2010
MWR InfoSecurity Security Advisory IBM WebSphere MQ - rrilookupget Remote Denial of Service Vulnerability 4th March 2010 2010-03-04 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...
CS3210: Booting and x86
CS3210: Booting and x86 Lecture 2 Instructor: Dr. Tim Andersen 1 / 34 Today: Bootstrapping CPU -> needs a first instruction Memory -> needs initial code/data I/O -> needs to know how to communicate 2 /
CSE P 501 Compilers. x86 Lite for Compiler Writers Hal Perkins Autumn /25/ Hal Perkins & UW CSE J-1
CSE P 501 Compilers x86 Lite for Compiler Writers Hal Perkins Autumn 2011 10/25/2011 2002-11 Hal Perkins & UW CSE J-1 Agenda Learn/review x86 architecture Core 32-bit part only for now Ignore crufty, backward-compatible
Peter Van Eeckhoutte s Blog
http://wwwcorelanbe:88 - Page 1 / 83 Peter Van Eeckhoutte s Blog :: [Knowledge is not an object, it s a flow] :: Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, HW DEP and ASLR Peter
CS Bootcamp x86-64 Autumn 2015
The x86-64 instruction set architecture (ISA) is used by most laptop and desktop processors. We will be embedding assembly into some of our C++ code to explore programming in assembly language. Depending
Peter Van Eeckhoutte s Blog
http://www.corelan.be:88 - Page 1 / 79 Peter Van Eeckhoutte s Blog :: [Knowledge is not an object, it s a flow] :: Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, HW DEP and ASLR Peter