rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: Windows Thread Suspension Internals Part 1
http://rce4fun.blogspot.com/2014/11/windows-thread-suspension-internals.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Thursday, November 27, 2014. Windows Thread Suspension Internals Part 1. It's been a while since I haven't shared anything concerning Windows internals and I'm back to talk in detail about how Windows thread suspension and resumption works. I'm going to discuss the mentioned topics in this blog post and incoming ones. Even though it can be discussed in one or two entries but I'm quite busy with studies. If we came from usermode (Curr...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: CSAW CTF 2014 - Ish Exploitation 300 Write-up
http://rce4fun.blogspot.com/2014/09/csaw-ctf-2014-ish-exploitation-300.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Monday, September 22, 2014. CSAW CTF 2014 - Ish Exploitation 300 Write-up. This time with a quick writeup . Well , I took some time to reverse the binary under IDA and I soon discovered that the vulnerability was a memory leak which leaks 16 bytes from the stack and the vulnerable function was cmd lotto. Here's the full exploit :. I'll publish a writeup for exploitation 400 ( saturn ) as soon as possible. Download binary : Here.
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: January 2014
http://rce4fun.blogspot.com/2014_01_01_archive.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Thursday, January 30, 2014. Creating and using your own 'heap' manager. First of all, I didn't want to write a long title so I've put word heap. Between apostrophes, simply because in this example we're not creating or managing a heap, but a (zeroed) chunk of memory which we reserve from the virtual address space of our application. (we'll commit from the reserved chunk as needed). Back to our topic : I spent much time in the previou...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: May 2014
http://rce4fun.blogspot.com/2014_05_01_archive.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Sunday, May 4, 2014. Windows Heap Overflow Exploitation. The vulnerability that we'll be exploiting together is a heap overflow vulnerability occurring in a custom heap built by the application. The vulnerable software is : ZipItFast 3.0. I've actually got the POC from exploit-db , you can check it right here :. Http:/ www.exploit-db.com/exploits/17512/. Oh , and there's also a full exploit here :. Then click on the Test button.
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: February 2014
http://rce4fun.blogspot.com/2014_02_01_archive.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Sunday, February 23, 2014. CodeGate CTF 2014 - Reverse 250 Clone Technique Write-up. The concept of this Crackme is really simple but reaching the right Track took me hours and hours because I was looking deeper into it and the answer was right in front of me :) . The challenge is named "Clone Technique" used in Naruto Manga , the process creates many instances of it (using CreateProcessW. The function will use both values in a loop ...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: September 2014
http://rce4fun.blogspot.com/2014_09_01_archive.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Monday, September 22, 2014. CSAW CTF 2014 - "saturn" Exploitation 400 Write-up. The description for this task was :. You have stolen the checking program for the CSAW Challenge-Response-Authentication-Protocol system. Unfortunately you forgot to grab the challenge-response keygen algorithm (libchallengeresponse.so). Can you still manage to bypass the secure system and read the flag? Nc 5485.89.65 8888. Let's carry on :. Next, we will...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: ASIS CTF Finals 2014 - Satellite Reloaded Reverse 250 Writeup
http://rce4fun.blogspot.com/2014/10/asis-ctf-finals-2014-satellite-reloaded.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Monday, October 13, 2014. ASIS CTF Finals 2014 - Satellite Reloaded Reverse 250 Writeup. I really enjoyed playing this CTF with Spiderz team and we ended at position 23. This reversing challenge was for 250 points , and here's a brief write-up about it :. After decrypting , we get the following large equation :. For example to make this statement true :. A[12] a[20]) and (! A[12] must equal : 0. A [20] must equal : 1. In the string s...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: CSAW CTF 2014 - "saturn" Exploitation 400 Write-up
http://rce4fun.blogspot.com/2014/09/csaw-ctf-2014-saturn-exploitation-400.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Monday, September 22, 2014. CSAW CTF 2014 - "saturn" Exploitation 400 Write-up. The description for this task was :. You have stolen the checking program for the CSAW Challenge-Response-Authentication-Protocol system. Unfortunately you forgot to grab the challenge-response keygen algorithm (libchallengeresponse.so). Can you still manage to bypass the secure system and read the flag? Nc 5485.89.65 8888. Let's carry on :. Next, we will...
rce4fun.blogspot.com
Reverse Engineering 0x4 Fun: October 2014
http://rce4fun.blogspot.com/2014_10_01_archive.html
Reverse Engineering 0x4 Fun. Reverse Engineering and Windows Internals. Monday, October 13, 2014. ASIS CTF Finals 2014 - Satellite Reloaded Reverse 250 Writeup. I really enjoyed playing this CTF with Spiderz team and we ended at position 23. This reversing challenge was for 250 points , and here's a brief write-up about it :. After decrypting , we get the following large equation :. For example to make this statement true :. A[12] a[20]) and (! A[12] must equal : 0. A [20] must equal : 1. In the string s...
thisissecurity.net
Win32/Atrax.A | This is Security :: by Stormshield
https://thisissecurity.net/2014/08/20/win32atrax-a
This is Security : by Stormshield. August 20, 2014 —. Atrax’s specification highlight us about anti-analyzer technics:. Anti-Analyzer (Protection against e.g. anubis.iseclab.org, malwr.com). If you need: Anti-VM (Please request it explicitly). The sample we studied was seen in the wild in April 2014 and submitted to the VirusTotal web site ( https:/ www.virustotal.com/en/file/adf246a57baecef5c8c85c60152e9b2f5060bf2e720ad1623cc95177e7259401/analysis/. Anubis http:/ anubis.iseclab.org/. Except Anubis, it b...
SOCIAL ENGAGEMENT