Tagged Questions
1
vote
1answer
177 views
Win server 2003 sp2 'local' Privilege escalation via thin client
Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
3
votes
2answers
232 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
1
vote
1answer
183 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
4
votes
1answer
277 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
0
votes
1answer
262 views
Windows exploits that still work? [closed]
I was reading how exploits usually work and how they have been used in the past etc etc.
I wanted to know, if there are still some exploits that can work with minimal user allowed access?
For ...
-4
votes
1answer
354 views
How to exploit a windows server when you have read-only filesystem access [closed]
I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat.
I have no access to source code or file ...
1
vote
1answer
53 views
Dangers of a vulnerability in a local installer?
I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.
Other than the fact that if ...
1
vote
1answer
157 views
A simple example for showing the use of Data Execution Prevention (DEP) security feature
I am finding it really hard to figure out why we need a DEP!
Microsoft states this about DEP:
The primary benefit of DEP is to help prevent code execution from data
pages.
Typically, code ...
1
vote
1answer
251 views
Shellcode for higher file privileges
I'm learning exploits from the book Hacking: The Art of Exploitation. The shellcode below was written to enable higher privilege access to files.
\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80
...
7
votes
2answers
328 views
Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?
On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...
