2,898 reputation
1716
bio website
location
age
visits member for 2 years, 4 months
seen 1 min ago

1d
comment Encode Windows excutable through msfencode
msfvenom can only encodes raw bytes not executables.
2d
comment Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?
Generate shellcode through msfvenom and pass the two bad chars (space and null) with -b. For example msfvenom -p <payload> -b '\x00\x20'
Jul
23
comment How does the DYLD privilege escalation vulnerability work on OS X?
Excellent answer. Just for reference, Metasploit PR for the above exploit should be landed soon. github.com/rapid7/metasploit-framework/pull/5758
Jul
21
awarded  Caucus
Jul
12
revised Is it possible to prevent a file type from being determined in a Linux system?
Append not overwirte
Jul
12
comment Custom Metasploit payload with UAC bypass
"appeared to overwrite the manually uploaded payload with whatever was set in FILENAME". That is a serious issue. Let me ask @mubix what is his take on this one since he is the author of that module.
Jul
9
comment Custom Metasploit payload with UAC bypass
Are you running it on the shell session? This module can only be run on a meterpreter session. github.com/rapid7/metasploit-framework/blob/…
Jul
6
reviewed Approve Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?
Jul
5
reviewed Approve Facebook password lowercase and uppercase
Jul
4
comment Metasploit new exploits failed
The msfconsole output already displays the version. You can manually run version command as well. Run msfupdate to pull down the latest version.
Jul
1
awarded  Revival
Jul
1
answered How does process migration work in Meterpreter
Jun
27
comment How do cryptographic algorithms help hackers to bypass Antivirus software?
There is no difference between an exe and an ASCII file as far as encryption algorithms are concerned. If you have studied AES, you will know the input is 16 bytes of data. This data could be anything: ASCII text, binary blobs from an exe file, anything. So encrypting an exe is the same as encryption any other type of data. For decryption, the decryption routine is executed first in memory and that is why AVs fail to detect it. The signature engine check the file BEFORE execution and not during execution.
Jun
27
reviewed Approve Client misunderstanding nmap
Jun
27
comment How do cryptographic algorithms help hackers to bypass Antivirus software?
For a computer system everything is a binary blob. If you have seen cryptography applied to a text file and all its contents have changed (encrypted), apply the same crypto to an executable binary blob and surely everything will change. AV signatures won't work. The only difference is you will attack the decryption stub to the start of the exe (the initial entry point) so that the encrypted payload is encrypted at runtime for execution.
Jun
25
comment Nil events in IPS reports today
A lot of times FUD (fear, uncertainty, doubt) reports get a lot of attention. It is good someone is giving advice based upon common sense. One thing I am curios about: OP is getting just 1-2 IPS events per day. We get like ~100 per hour.
Jun
23
comment Metasploit reverse_http(s) PAYLOAD for linux target
I think the reason of not choosing reverse_http(s) is due to the large size of the payload. If reverse_http(s) can be selected with the exploit (outside BAP), OP should be able to select those payloads within BAP as well. If not, then BAP won't show those payloads since it selects from compatible payloads.
Jun
21
reviewed Approve Is it Safe to Send an Invalid Password Back to the Client?
Jun
20
comment Is there a way to use VirusTotal.com offline?
VirusTotal is nothing more than a collection of all the AV engines that tests a submitted file. If you want to setup offline scans, you can configure VMs or docker images for the AVs you want to test against. The point and advantage of VT is all due to it being online since updates are pushed in real time. If there was presumably an offline version (there isn't any), it would be off little use anyway.
Jun
15
answered What is “Gateway Host Probe”?