0
votes
3answers
260 views

Windows DLL Injection

In the past recent years of mine, I have been doing a lot of DLL injection with a few indie games and MMORPGs. I fully understand how to do it, and how it works for allowing these games to work not as ...
1
vote
1answer
67 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
1
vote
1answer
144 views

Exploiting XP SP3 with local privilege escalation

I'm trying to exploit my virtual machine (windows xp sp3) by cve-2013-5065. I created exe from python script and ran on my virtual machine. It successfully spawned new shell but cmd.exe was not with ...
1
vote
1answer
215 views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
0
votes
2answers
227 views

Can I exploit Windows kernel from user-mode application?

In this document is detailed technique of exploiting Windows kernel. But writer is talking about accessing kernel memory & doing exploit from user-mode application at the same time. Can I do this ...
11
votes
7answers
988 views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
0
votes
1answer
347 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
1
vote
1answer
347 views

Examples for practicing reverse engineering/disassembly of win32 .executables

I remember back in the day, there used to be a website where users would post hackits in the form of win32 exes for users to crack. Usually the goal was to defeat some sort of DRM, such as a nag ...
6
votes
1answer
90 views

What are Non-linear/backward overwrites?

I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term non-­linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by ...
1
vote
1answer
305 views

Win server 2003 sp2 'local' Privilege escalation via thin client

Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
3
votes
2answers
519 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
2
votes
1answer
374 views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
4
votes
1answer
308 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
-4
votes
1answer
477 views

How to exploit a windows server when you have read-only filesystem access [closed]

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat. I have no access to source code or file ...
1
vote
1answer
57 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
3
votes
1answer
253 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
1
vote
1answer
316 views

Shellcode for higher file privileges

I'm learning exploits from the book Hacking: The Art of Exploitation. The shellcode below was written to enable higher privilege access to files. \x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80 ...
7
votes
2answers
557 views

Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?

On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...