neilscomputerblog.blogspot.com
A1Logic Research: October 2012
http://neilscomputerblog.blogspot.com/2012_10_01_archive.html
Offensive and Defensive Information Security Research. Tuesday, October 23, 2012. Single Step Debugging Explained. Single Step debugging of machine instructions is a technique often used during vulnerability research and exploit development to debug a program at an atomic level. At this level of granularity, one can see the individual assembly instructions as they are being executed by the CPU chip, and the states of the registers and memory as each instruction is executed. Printf( "inside loop n". This ...
neilscomputerblog.blogspot.com
A1Logic Research: September 2014
http://neilscomputerblog.blogspot.com/2014_09_01_archive.html
Offensive and Defensive Information Security Research. Sunday, September 28, 2014. ShellShock: Vulnerability, Patch and Exploit Analysis. The vulnerability itself was the simple fact that Bash allowed the user to define functions and include multiple commands inside environment variables that are passed to Bash. This is dangerous in situations when the value of the environment variable passed to the new Bash instance is supplied by an unauthenticated and untrusted source. Char * env;. EX BADUSAGE is even...
neilscomputerblog.blogspot.com
A1Logic Research: October 2013
http://neilscomputerblog.blogspot.com/2013_10_01_archive.html
Offensive and Defensive Information Security Research. Tuesday, October 8, 2013. Low Fragmentation Heap ReAllocation for Use After Free Exploitation. 1) Application frees object on the heap. 2) Attacker reallocates objects on the heap. 3) Application erroneously dereferences freed pointer. When string attributes of HTML objects are assigned in JavaScript, the strings are often stored in the same Front End LFH that the freed objects were stored in.". I = 0 ; i numObjects; i ). X = 0; x primeAmount; x ).
neilscomputerblog.blogspot.com
A1Logic Research: Destroying ROP gadgets with Inline code
http://neilscomputerblog.blogspot.com/2014/06/destroying-rop-gadgets-with-inline-code.html
Offensive and Defensive Information Security Research. Monday, June 30, 2014. Destroying ROP gadgets with Inline code. Previous ROP (Return Oriented Programming) article. VirtualAlloc(NULL, 4096, MEM COMMIT, PAGE EXECUTE READWRITE);. VirtualAlloc(NULL, 4096, MEM COMMIT, PAGE EXECUTE READWRITE);. NotInlined();/ a call instruction will be placed here. Inlined();/ the function’s code itself will be placed here. Some additional code here. Imp VirtualAlloc(0121b000)] / inlined. Some additional code here.
neilscomputerblog.blogspot.com
A1Logic Research: October 2014
http://neilscomputerblog.blogspot.com/2014_10_01_archive.html
Offensive and Defensive Information Security Research. Friday, October 31, 2014. Thank you for your support all these years and for reading this Blog. I wanted to announce a few changes. First, I left my job on the Microsoft Security Response Center to work full time on my own Cyber Security consulting company, A1Logic (web: www.A1Logic.com. Posted by Neil Sikka. Links to this post. Subscribe to: Posts (Atom). Vulnerability Research-Exploit Development-Reverse Engineering-Infrastructure Security.
neilscomputerblog.blogspot.com
A1Logic Research: April 2013
http://neilscomputerblog.blogspot.com/2013_04_01_archive.html
Offensive and Defensive Information Security Research. Monday, April 29, 2013. ROP (Return Oriented Programming). Prerequisite Reading: previous “Stack Pivoting” article. Sub EAX, 4. Xor EAX, EAX. Add ECX, 8. The execution of a ROP exploit looks similar to the following once the fake call stack is injected in memory:. Execute stack pivot gadget to pass control to the fake call stack. Execute a ROP Gadget at the top of the fake callstack. Execute “useful instruction(s)". Execute a return instruction.
neilscomputerblog.blogspot.com
A1Logic Research: November 2013
http://neilscomputerblog.blogspot.com/2013_11_01_archive.html
Offensive and Defensive Information Security Research. Saturday, November 16, 2013. Previous “Low Fragmentation Heap ReAllocation for Use After Free Exploitation” article. Previous “Attacking V-Table Pointers” article. Below are some memory usage visualizations taken with the vmmap tool from SysInternals before and after the heap spray. The orange color represents the Backend Heap in the process’s address space. Two things to notice are the large growth in the orange segment of the graphs b...Below are g...
neilscomputerblog.blogspot.com
A1Logic Research: Visual Heap Spray
http://neilscomputerblog.blogspot.com/2013/11/visual-heap-spray.html
Offensive and Defensive Information Security Research. Saturday, November 16, 2013. Previous “Low Fragmentation Heap ReAllocation for Use After Free Exploitation” article. Previous “Attacking V-Table Pointers” article. Below are some memory usage visualizations taken with the vmmap tool from SysInternals before and after the heap spray. The orange color represents the Backend Heap in the process’s address space. Two things to notice are the large growth in the orange segment of the graphs b...Below are g...
neilscomputerblog.blogspot.com
A1Logic Research: February 2013
http://neilscomputerblog.blogspot.com/2013_02_01_archive.html
Offensive and Defensive Information Security Research. Monday, February 11, 2013. A common attack vector for software written in C is V-table pointer overwrites. When C objects are allocated on the heap, such as when the "new" keyword is used, they often get put next to other objects that are also on the heap. If there is an unbounded write to one of the objects on the heap before an object using V-tables, this type of attack is feasible. The following class definitions were modified from. B2 *b2 = new.
neilscomputerblog.blogspot.com
A1Logic Research: June 2013
http://neilscomputerblog.blogspot.com/2013_06_01_archive.html
Offensive and Defensive Information Security Research. Sunday, June 30, 2013. On Windows, the LFH (Low Fragmentation Heap) is commonly used to dynamically allocate small chunks of memory ( 16KB in size). Many programs use the LFH as it is intended for high performance allocation/free of small objects, even in a multithreaded environment. Debugging memory corruptions on the heap can often be complex, but the following Windbg tricks may help:. Heap -p -a MEMORY ADDRESS. Caller Based Conditional Breakpoint.