Reputation
2,936
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
1 7 16
Newest
 Caucus
Impact
~126k people reached

1d
comment msfvenom doesn’t generate raw shellcode output properly
@Alex Talked to HD regarding this and actually this is the expected behavior. Raw output is displayed on stderr and since it will have non-printable characters, it won't be displayed on screen. You either have to generate the payload in a particular format (python, c, ruby etc) or redirect the output to a file. msfvenom -p <payload> -o output.bin should work fine for raw. Still you will need a hex editor to examine the output.
1d
comment msfvenom doesn’t generate raw shellcode output properly
Yes. I can reproduce this at my end. Will generate an issue at the Metasploit github pages. Please use -f python for now to generate the payload for your python script. It is working fine.
1d
comment Reverse Engineer and Exploits researching
Related security.stackexchange.com/questions/47097/…
Aug
30
comment Do actual penetration testers actually use tools like metasploit?
Yes. Back in the days when ultimet and inmet came out, I tested them but now the built-in stageless meterpreter is better since it provide connection resiliency features (as I mentioned in the first comment). Also, since you can generate stageless meterpreter in raw format from within Metasploit through msfvenom, you can perform all sorts of action such as manually editing assembly or encrypting the payload through Veil
Aug
30
comment Limited Buffer Size for shellcode on 64 bits machine
The problem isn't the 24 bytes limit. If you send it more bytes, those bytes would still end up somewhere on the stack that you can call through jmpq instruction. However, execution from stack is disabled due to DEP. In order to bypass ASLR, you need a memory leak which can point to a system library and from there to construct the ROP.
Aug
18
comment Is there any open source ransomware?
Not sure why the down vote. That is what the OP asked for. Also I believe a lot of other software can be used for nefarious purposes as well. It is only a matter of intent.
Aug
18
answered Is there any open source ransomware?
Aug
17
comment What artifacts to acquire when looking for IoC?
A malicious DLL injected into explorer.exe or browser process is going to be missed by all the artifacts you are gathering. The IoCs are highly dependent on the particular family and variant of malware you are hunting. Usually the rule of thumb is to not be as generic as svchost.exe nor as specific as MD5 of the exe.
Aug
8
comment Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?
@begueradj It seems like you didn't study the working of EMET thoroughly. You think the failure to detect the flash exploit through EMET is a perfect example of EMET failure. That is not the purpose of EMET at all. It detect generic exploit techniques such as stack pivots, ROP chains, exception handling overwrites etc. The reason I am mentioning these is because OP asked whether EMET will be able to provide protection in this case? And my answer is unless the exploit is specifically crafted to bypass EMET, it should be blocked by EMET.
Jul
25
comment Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?
Generate shellcode through msfvenom and pass the two bad chars (space and null) with -b. For example msfvenom -p <payload> -b '\x00\x20'
Jul
23
comment How does the DYLD privilege escalation vulnerability work on OS X?
Excellent answer. Just for reference, Metasploit PR for the above exploit should be landed soon. github.com/rapid7/metasploit-framework/pull/5758
Jul
21
awarded  Caucus
Jul
12
revised Is it possible to prevent a file type from being determined in a Linux system?
Append not overwirte
Jul
12
comment Custom Metasploit payload with UAC bypass
"appeared to overwrite the manually uploaded payload with whatever was set in FILENAME". That is a serious issue. Let me ask @mubix what is his take on this one since he is the author of that module.
Jul
9
comment Custom Metasploit payload with UAC bypass
Are you running it on the shell session? This module can only be run on a meterpreter session. github.com/rapid7/metasploit-framework/blob/…
Jul
6
reviewed Approve Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?
Jul
5
reviewed Approve Facebook password lowercase and uppercase
Jul
4
comment Metasploit new exploits failed
The msfconsole output already displays the version. You can manually run version command as well. Run msfupdate to pull down the latest version.
Jul
1
awarded  Revival
Jul
1
answered How does process migration work in Meterpreter