Tagged Questions
3
votes
2answers
235 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
7
votes
3answers
379 views
How to gain a shell?
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the ...
6
votes
3answers
425 views
Remote return into libc attack
It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
3
votes
1answer
78 views
How can one gain additional privileges from being able to read kernel memory?
Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of ...
5
votes
5answers
904 views
Suggested reading list: OS exploits
In computer security, my areas of interest include x86 processors, binary exploitation and reverse engineering. I'm also interested in the certain aspects of the minix and the linux kernel(memory ...
11
votes
5answers
451 views
What is the potential impact of the alleged OpenBSD IPSEC attack?
Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have.
For instance, does ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
