Tag Info

New answers tagged

1

Almost certainly, but it may not translate to a reliable exploit. As you are controlling ESI, EDI and ECX you are most likely controlling a byte copy operation and I'm assuming the crash is caused because you're trying to read/write to an address like 0x41414141. At worst you can hard code some addresses where ESI points at the start of your shell code, ...


13

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


3

You might try demonstrating server problems that occurred in well-tested servers and make the claim "If after all of the testing and examination they were insecure, how can we expect to do better?" The first example that pops into my head is the Shellshock bug. When combined with CGI from the Apache Web server, it allowed remote execution. This was not due ...


7

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...


0

Here a good way to check for Shellshock as well one of the easiest way to fix is: sudo apt-get update && sudo apt-get install --only-upgrade bash Usage: bash .sh #!/bin/bash EXITCODE=0 # CVE-2014-6271 CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' | wc ...


4

IIS is one of many applications that get HTTP requests passed to it from HTTP.sys, so HTTP.sys can be loaded without IIS running or even being installed. Windows implements an HTTP listener as part of the network subsystem via a kernel mode driver (HTTP.sys). HTTP.sys is what's actually listening for HTTP requests and passing it on to the application ...


1

This reddit give us some information based in the reported exploits. As you may see, it is a problem regarding validation in the "Range" HTTP Header. Some users reported getting immediate BSoD after issuing the mentioned requests to their web servers. Correction: So, as it seems, you do NOT have to be running IIS to be affected by this vulnerability. ...


0

The query string after the domain name of the uri scheme are probably some kind of tracking id as well. There's probably a large cross domain database that correlates the clicks with whatever that could be installed on your computer.


0

I haven't worked with spam filtering scripting but this is something that I had known for a while, hoping this helps! One of the Apache Projects, named SpamAssassin could come in handy. It is a Spam filter for mail servers but I am guessing you will be able to work with it to some how suite your use-case on the client side. One thing particularly of ...


0

http://0x1F.8847525?-zcNQec8Mqyay9MwQufAZyDUlLviGZxNBtAvdjUQniA4jIwSjug… Components of URI schemes (with hierarchical part expanded): <scheme name> : [ <userinfo> @ ] <host> [ : <port> ] [ / <path> ] [ ? <query> ] [ # <fragment> ] All these URIs have is a scheme name, host, and query. While it is quite rare ...


0

Your question is somewhat unclear. Does the site already have Open Redirect vulnerability (https://www.owasp.org/index.php/Open_redirect)? If it does you proceed as tim already have said. If it doesn't and you are interested in general methods of getting your malicious code into its pages, then either you hack into the site ("getting shell"), or find some ...


1

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...



Top 50 recent answers are included