Tag Info

Hot answers tagged

32

The author had made the mistake of being ambiguous and confused the readers a bit. I must admit, like you, I was confused at first, until I saw the PCAP dump. First of all, the box indeed doesn't have wget The attacker didn't use that one echo statement, he used a series of echo statements. I counted about 107 echo statements progressively building the ...


18

I'm the guy who wrote the code which compromises the dvrs, and as said above, there is a script which simply connects and "echo"s the binary into a file, where it can be executed. As we are only echoing the raw bytes into the file and also excluding any new lines (-n), the result is an identical file. You can generate a set of the echo lines yourself by ...


7

The x86-compatible CPU are aptly named: they are compatible with each other. This means that the same OS code will work on all of them. So, from the point of view of the code which runs on the processor (which includes the operating system itself), things do not vary (much) depending on the brand. Things change depending on the generation: the newer systems ...


5

Why would you need a specific FP ? The saved FP is there to be loaded back into the corresponding register by the vuln() function when it exits; but that function does not access it in any way, so it could have any value. The loading back of FP is for the benefit of whatever code will execute immediately afterwards: normally the caller of vuln() (who wants ...


5

I am the author of the post, and indeed, "1" is correct. The easiest way to find all the packets that make up the "wget" upload is the wireshark filter "tcp.stream eq 1" (see link in original article for the pcap). The just "follow TCP stream" and filter the part from 142.0.45.42 to 192.168.1.100. "Save as" (raw) and you got a text file with the content. ...


4

Very precise timing information is very helpful when doing side-channel attacks. Some famous example (in lab conditions) include stealing an encryption key used by some other process, on data we do not see (neither cleartext nor ciphertext). This can work on detection of L1 cache misses, or of jump (mis)prediction in the CPU. Forbidding access to the cycle ...


4

The example in the article is just one of many echo statements that are used to progressively build the file. Because it uses the >> redirection operator, it does not clobber the existing contents of the file but appends to it instead. Quoting from the article: Turns out that the attacker appears to use a wrapper script that uses a series of ...


3

Yes and no. Strictly speaking, TrustZone is only a processor feature that provides isolation between tasks via the MMU and the memory bus. You can think of it as a poor man's virtualization: there's just the hypervisor (the TZ secure world) and the regular operating system (the TZ normal world). This architecture allows sensitive data to be manipulated ...


2

If you are having an issue with null bytes, then try to encode the shellcode before using to eliminate the null bytes. I assume you have got metasploit and able to use the encoder. Here is how it works. shell = (" \x77\x... your shellcode") file = open('shellcode.bin','w') file.write(shell) file.close() or you can also use echo -e "shellcode" >> ...


2

You should look at the BlackHat talk ARM Exploitation ROPmap. In short you can find ROP gadgets with any assembler variant, just the rules are a little different for ARM. Before tools like mona we used objdump and grep!



Only top voted, non community-wiki answers of a minimum length are eligible