190 reputation
112
bio website
location
age
visits member for 2 years, 9 months
seen Nov 12 '12 at 17:58

Jul
11
awarded  Notable Question
Jul
2
awarded  Curious
May
10
awarded  Popular Question
Sep
21
awarded  Popular Question
Jul
16
awarded  Popular Question
Jul
12
awarded  Benefactor
Jul
12
comment PHP 5.3.9 Vulnerability Help
controlling eip was pretty easy. problem was corrupting the stack, so I took your advice and ended up using rop gadgets. metasploit had a pretty good rop finder.
Jul
12
accepted PHP 5.3.9 Vulnerability Help
Jul
6
awarded  Promoter
Jul
4
revised PHP 5.3.9 Vulnerability Help
added 267 characters in body
Jul
4
revised PHP 5.3.9 Vulnerability Help
spelling
Jul
4
comment PHP 5.3.9 Vulnerability Help
@Rory Alsop Well many of the sources I've looked at all seem to suggest that code execution is definitely possible, but there really isn't a "guide" I can follow since this vulnerablity isn't a true stack or heap overflow. I thought about a ret2text type of attack but I'm not sure what I could achieve with only control of EIP and EDI registers. I'm not looking for a specific solution, just general ideas of how to approach the problem. To answer your 2nd question I know how to exploit traditional vulnerabilities like stack overflows or dangling pointers so I have some knowledge in this area.
Jul
4
asked PHP 5.3.9 Vulnerability Help
Jun
26
comment ASLR in Ubuntu 11.10
Yeah in Schacham's paper he states that when an Apache process crashes and the parent process fork()s a new child in its place, the child has the same randomization data as before so brute forcing does become more realistic even w/ the 8190 byte request cap Apache imposes.
Jun
26
accepted ASLR in Ubuntu 11.10
Jun
23
asked ASLR in Ubuntu 11.10
May
2
comment Checking if Mod_Rewrite is Enabled Remotely
Because it was a good answer.
May
1
accepted Checking if Mod_Rewrite is Enabled Remotely
May
1
comment Checking if Mod_Rewrite is Enabled Remotely
Yes but in the case that a buggy version of it is used, mod_rewrite needs to nonetheless be enabled.
May
1
comment Checking if Mod_Rewrite is Enabled Remotely
Exploits that rely on mod_rewrite being enabled like www.securityfocus.com/bid/19204. One ideally wouldn't want to run such an exploit during a pentest unless you were sure mod_rewrite was enabled.