Tag Info

New answers tagged

1

The rdesktop client supports resource sharing with the -r switch. A local directory from the connecting PC can be shared with the remote server under a special share under \tsclient\<sharename> -r disk:<sharename>=<path>,... Redirects a path to the share \tsclient\ on the server (requires Windows XP or newer). The share name is ...


1

I'm posting this new answer to my question because one part of my original question was not completely addressed. Specifically, what kind of tool could be used to make so many connection attempts, seemingly more quickly than the minimum delay time I had set in my pam configuration. Well, it looks like a tool like hydra (see www.thc.org) was used. To check ...


2

One thing to bear in mind is that various shared resources can be enabled, sometimes by default - certainly in the Windows RDP client (I'm afraid I don't know the Linux client, but it's clear the protocol allows these shared resources.) For example, the clipboard is automatically shared between client and server by default, and local printers are made ...


3

Mints97's answer is great, but I think there may be more to it than that. An especially wonderful (read: terrible) problem with Windows is that it supports complete Unicode character set in filenames, including (and this is the worst), U-202E. While I am sure it has some good innocuous uses, but it can allow people to maliciously change the filename in a ...


12

From a theoretical standpoint, you are connecting to a remote machine and it is sending data back to your machine. While in the normal context, this is just display, location type data, it is possible that some sequence of bits could be processed in such a way that it causes an exploit in your rdesktop or other tool used to make the remote connection. With ...


2

The problem is that not all spam is meant to exploit anything. Spam can simply advertise or be a part of a phishing attempt (which isn't an exploit). The thing to see here is that the URLs attempt to hide where they go and what they do. THAT is the thing that determines the fact they they are trouble. If you wanted an automated way to deal with these URLs, ...


2

No, they are not invalid URLs and the URL themselves are not exploits. If they point to exploit files it's hard to tell. They are obfuscated URLs intended to avoid spam filters. If you try to ping, for example, 0x5B.15251742, you will see that the address is translated to 91.232.185.30. The rest of the URL is a hash, and probably there are a few files with ...


0

There was a widely publicized exploit a few years ago, which used a bug in a particular, widely distributed jpeg library. The net effect of this exploit was to allow executing arbitrary code on the victims machine, when nominally all they were doing was trying to view an image. Also, for example, there was an exploit for rich text files (rtf format) which ...


0

I remember back in the good old days when viewing or loading a .ico file with the api's that shipped with windows used to allow for direct code execution if crafted maliciously enough. And the entire concept behind the wmf file format was calling graphics routines directly . ( hence the creation of the device independent bitmap format, aka .bmp files ) So ...


0

Well you start up with analyzing the file format. And then take a while guess on how different software will react. For example JPEG - http://en.wikipedia.org/wiki/JPEG - uses special markers to delimit the start and end of image. Now one would bet that software that deals with JPEG will only look for the start and end of image markers and plot everything ...


28

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions. .pif is legacy from MS-DOS, like .com. It's ...


2

The problem with buffer overruns is that a buffer is overrun -- this is nonsensical, i.e. it is a bug, after which application code behaviour ceases to follow the pre-ordained plan. The classical, let's even say primitive, method to exploit a buffer overflow is to overwrite the return address slot of a function, so that execution is derailed into a location ...


2

You wrote, "The image file format was pif", but the article states "FireEye researchers found a collection of chats and documents while researching malware hidden in PDF documents." The program information file format was used on Microsoft Windows systems, though files in that format are rarer now than they once were. There were vulnerabilities associated ...


9

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed. Note that this is very ...


0

This seems more like a Direct Object Reference vulnerability than a SQL Injection vulnerability. The proper way to secure this would be to check that the current session has permissions to perform the requested action on the server side. The details of how this would be down depends on how you have implemented authorization in your application, but reading ...


1

It looks like observer chat so I would guess it is most likely the result of a password compromise. Either the tournament password or one of the official observer accounts used to televise/stream/shoutcast the game.


2

Given the fact that the hackers had access to the servers and their data, then they had direct access to the HTML files. Protection against such an attack is very broad in scope, because you have to protect yourself against all forms of intrusion into your network.


1

If Android's safety features are intact (and nothing in the article suggests that they would be compromised), the adware can do only two things: use the permissions the "mother app" was equipped with trick the user into installing other apps, in order to deliver new payload and/or gain new permissions Then the malicious software in the "mother app" or ...


0

This topic was likewise confusing me. There's only one or two sentences in that Phrack issue that even mention intelligently controlling the length of the buffer overrun (probably because this is a typical technique). Paj28 appears to have the right answer, but it's still a little vague as to how one would acquire an accurate enough side-channel to make ...


1

The problem is that a vulnerable Flash version is a conduit into your system. There will be no way to see if your system was compromised via Flash. At best you will be able to see that you have some kind of infection/corruption in general, but you won't be able to tell how it happened.


0

Well inadequacy is relative, in that you don’t know what they’re doing, but if you’re willing to do the research then you can find out i guess? Sandbox the browser using something like Sandboxie, which will then tell you what its trying to access, you could also install Wireshark on a machine and point all traffic going out from that machine to the machine ...


0

I have participated in Live and online CTF competitions. It depends what sort of CTF you would like to organize, and what sort of challenges there will be, I mainly categorize them into two categories. Web Application System/Network Now if you want to organize a CTF involving web applications only that has vulnerabilities and users are required to ...


1

You can find a lot of CTF event in this website as a reference about how they organize it, their CTF's type, and what kind of challenges offered. For a more detailed and technical stuff about CTF challenges, I recommend you to read some CTF writeup by active CTF teams. As an example, Dragon Sector is an active team and usually make some writeup after ...


3

Exploits are typically platform dependent, although the vulnerability might not be. In this case it depends on whether the crash is in firefox, or some underlying library. If we're talking about a JPG for instance, the crash may be resulting from an error in libjpg, in which case it is probably not going to be cross platform. However, if the crash is in ...


0

There are a lot of detailed accounts available of Capture the Flag at DEF CON which might provide the insight you're looking for, and you can try asking specific questions about organization in the DEF CON Community Forums. They do it up.



Top 50 recent answers are included