Tag Info

Hot answers tagged

32

Probably not. In order to respond to HTTP requests, the operating system must be able to run a TCP/IP stack, process packets, and complete a TCP handshake, all requiring the system to utilize or spawn threads in memory, call libraries, etc. Therefore, the system would still be susceptible to protocol attacks it may not be patched for (TCP sequence ...


13

Do you have experience with CLI (command line interface), like Windows command prompt? If so, why not get a Raspberry Pi? The Pi is going to be smaller, faster, and more efficient than your old laptop. You can get a Pi for ~$50. Then you download (or get pre-installed SD card with ) their NOOBS software and install Raspbian OS, which is a Debian fork, ...


8

I also am questioning how this machine can run Win98 (which wasn't exactly an efficient OS in its day), but it cannot run Linux. How about taking a Linux Live CD (bootable "frozen" OS), editing the ISO to include the web pages you want to serve, removing local storage (pull out the hard drive), then boot off of the Linux Live CD and reboot daily? Even if ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


5

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


3

Your problem is ASLR randomly choosing where your program is loaded. You can turn off ASLR in Linux using sudo sysctl -w kernel.randomiz_va_space=0. Here's my program. I'm using RAX instead of EAX, and an unsigned long * rather than an int *. #include <stdio.h> #include <stdlib.h> unsigned long *get_stack_ptr(void) { __asm__( "mov ...


2

Is it already secure? Yes, you did use prepared statements correctly, and with all we know right now, that should be secure (assuming you don't use some odd multibyte character set). If security issues in PDO are found in the future, you will probably hear about it, and if you regularly update your software, it should be fixed in reasonable time. ...


2

Protecting the root account makes cleanup much easier: if an attacker can't tamper with the kernel or most of the programs, it's much harder to hide malicious code. It also means they can't tamper with the antivirus and other protection systems.


2

I am going to answer your question with a barrage of other questions. Well does your app actually need to hit the open internet ? or can it simply exist on a company intranet? The majority of 'java exploits' are simply ways that java's sandbox can get broken out of and of little consequence to legitimate java applications since it is really a apples and ...


2

In the end, it's not the OS that's the issue, but the application and the service running it. If your firewall is locked down tight, if the computer is physically secured, and the ONLY thing you are doing to serving a static page, then it comes down to the web server and what "else" the static page could do. It CAN be done, but the web server you choose to ...


2

This is simply a bad idea unless you just want to try it for fun. Anyone who suggests it could be done is making too many assumptions. There isn't enough information to make a call. Probably the main issues include Win98 is old, is no longer patched and is likely vulnerable to many existing penetration techniques which were not even thought of back ...


2

Get rid of that old box! It's too much hassle. Buy a Raspberry Pi B+. It's fast for your needs, cheap to buy, and within five to ten months it will earn the investment back by saving electricity. That old box maybe uses up to $10 a month for electricity, the RPi maybe $1.


1

Considering that a modern computer (or even a smartphone) can compute circles around a 15 year old laptop one would need to ask "why?", esp. as the old hardware is expected to fail more-or-less anytime. If this is a "because I can" project, then have at it and good luck. If you simply want your own webserver, it is very easy to set one up on your current ...


1

The basic idea is correct. Just want to explain what is the purpose of staged payloads. Every exploit has a limited space through which it can carry user code. Meterpreter DLL is around 900KB which won't fit in any common buffer overflow exploits. That is the size of only the bare bone meterpreter DLL. When it is loaded with extensions (stdlib, sniffer etc), ...


1

int 0x80 is a really old way to make system calls. I'm not sure if it is even supported anymore. You might want to look for syscall/systenter instruction in the image. Ofcourse this depends on what underlying hardware and OS you are using. If you are using any hardware/hardware vm emulator and software newer than from 1995, you should probably be looking for ...


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.


1

There are ways to triage likely bugs automatically, such as the !exploitable plugin for windbg, but it is only an indication of whether a bug is exploitable, not a proven analysis.


1

If this is public application and you can install it on your computer so you can debug it with any debug software you want, for example with immunity debugger and than you can analyse the crush and see what happen in the cpu registers and memory when the crush happen and find a way to inject your code (shellcode) in the right place so the application will ...


1

This is mainly an addition to armani's answer. As Win98 has not been maintained for years, you cannot expect the OS TCP/IP stack to be exempt of bugs. But you certainly can find a recent (decent) OS accepting to run on an old computer. NanoBSD for example declares that it can be customized to low requirements : it is possible to cut the system down, so it ...


1

How about KolibriOS and write your own web-server? Or Tinfoil Hat Linux and maintain it? (shouldn't take too long, just upgrade everything to the latest versions and hack around with dependencies until you get it to compile) Most importantly before I can provide other suggestions, what are you hardware specifications; and personal skill level?


1

windows is a close source OS so, your work is hard. you need learn basically about windows Architecture and you need learn Assembly with c/c++ language for attack. specially Assembly. also about this sentence : i used book about nmap, Metasploit, exploit writing etc..., but they contained too much information about too many OS's this tools ...


1

This video demonstrates a complete re-soldering of a laptop BIOS chip in 10 minutes: https://www.youtube.com/watch?v=HMAxv6lgSuw Joanna Rutkowska (girl behind the Blue Pill rootkit) discusses the feasibility of a "Ring -3" rootkit of the SMM which resides on the BIOS chip: ...


1

The rdesktop client supports resource sharing with the -r switch. A local directory from the connecting PC can be shared with the remote server under a special share under \tsclient\<sharename> -r disk:<sharename>=<path>,... Redirects a path to the share \tsclient\ on the server (requires Windows XP or newer). The share name is ...


1

I'm posting this new answer to my question because one part of my original question was not completely addressed. Specifically, what kind of tool could be used to make so many connection attempts, seemingly more quickly than the minimum delay time I had set in my pam configuration. Well, it looks like a tool like hydra (see www.thc.org) was used. To check ...



Only top voted, non community-wiki answers of a minimum length are eligible