xpsp2_2k3_heap_exploitation - Page 2 - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Applications, Tools & Papers
xpsp2_2k3_heap_exploitation

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Applications, Tools & Papers Discuss about security applications, tools, papers, etc...

xpsp2_2k3_heap_exploitation

This is a discussion on "xpsp2_2k3_heap_exploitation" within the Applications, Tools & Papers part of the Computer Security: Discussions section; I think i can also contribute to some shellcode encoding perhaps info on how it is now done, ie- demonstrated with your Ipswitch.code (great stuff mind you, and GREALY related to this topic) for any coders looking at the ...

Reply

Page 2 of 2

2

#11 (permalink)

Old

22-06-05

hx

hx is offline

Member

Join Date: Jun 2005

Location: Australia

Posts: 37

Thanks: 0

Thanked 2 Times in 2 Posts

Rep Power: 12

hx is on a distinguished road

Default

Hey..thankyou class101.org , you guys do have CLASS

I think i can also contribute to some shellcode encoding perhaps info on how it is now done, ie- demonstrated with your Ipswitch.code (great stuff mind you, and GREALY related to this topic) for any coders looking at the source etc.
thankyou for the kind welcome, and i am unsure if any of my attachments/downs would be 'infected', as they are mainly linux coded or unix/bsd, and do show as inffected to win32 users i *think*, however,i will do my best to upload tested with avg etc or whatever ,and explanations of what and why the files are bad if any.. but i can contribute alot to this if its all knowledge about LAN stuff/networking and preveting people from gaining entry,tehen i reckon you guys are the BEST place to be online, and i like your guidlines,think that is great,as blocks the wankers asking "HoW CoMe i GeT erRoRs wheN i ComPiLe usiNG VS C++" etc..

Thanks guys, i look forward o helping asmuch i can, and also please look @ http://hxdef.czweb.org/ for other help on this topic, ill put it in links now,k enjoy (the topic is hotly discussed on that forum also,and MUCH work also into it, and NO i am NOT Holyfather,yet i know him,and think he is GREAT input for this stuff so hence the link),
cheers,
hx

Reply With Quote

Sponsor

Advertiser

#12 (permalink)

Old

22-06-05

hx

hx is offline

Member

Join Date: Jun 2005

Location: Australia

Posts: 37

Thanks: 0

Thanked 2 Times in 2 Posts

Rep Power: 12

hx is on a distinguished road

Default

indeed!

The presentation is great, however I plan to create a more complete essay on the subject whenever time allows. Watch out for it! Wink

Definately my man! thats sofar a GREAT read, although i REALLY must readup more on your good work on the shellcode encoding and in general with Windows SEH checks/bypassing, indeed the SP2 has caused some interesting "developments" with current pen testing , id like to also pointout my no.2 link www.whoppix.net , great work on that,have supported the site for now on 2years and watched it develop into a GREAT O/S,good work whitehats!
hx

Reply With Quote

#13 (permalink)

Old

23-06-05

evering is offline

Junior Member

Join Date: Jun 2005

Posts: 1

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

evering is on a distinguished road

Default

Re: xpsp2_2k3_heap_exploitation

Quote:

Originally Posted by class101

Quote:

Originally Posted by conover

The presentation material was never formally released, but it was presented at SyScan in Dec 2004

this basic presentations will helps you to understand how is working the heap protection on the recent windows os and will spot out some tricks to bypass it.

Content:

~/sample_exploit.w2k_to_xpsp1/[/*:m:99936]
Chunk_On_Lookaside_Overwrite.txt[/*:m:99936]
Cookie_Check_Disassembly.txt[/*:m:99936]
Defeat_Safe_Unlink.c[/*:m:99936]
Defeat_Safe_Unlinking.txt[/*:m:99936]
Heap_Corruption_Disassembly.txt[/*:m:99936]
LowFragHeap_Key_Disassembly.txt[/*:m:99936]
Safe_Unlink_Check.txt[/*:m:99936]
Windows Heap Exploitation.ppt[/*:m:99936]
XPSP2_ChunkOnLookaside_Overwrite.c[/*:m:99936]

can't compile the testbof.c without heap.h
could you offer this file?

Reply With Quote

#14 (permalink)

Old

24-06-05

hx

hx is offline

Member

Join Date: Jun 2005

Location: Australia

Posts: 37

Thanks: 0

Thanked 2 Times in 2 Posts

Rep Power: 12

hx is on a distinguished road

Default

API Hooking

http://hxdef.czweb.org/knowhow/hookingen.txt

^^
This is a VERY good paper for API Hooking,
Was brought to my attention by another member that this should have been in english, so it was madeso, enjoy!
Windows API Hooking papers by Holy_Father@phreaker.net
EN Translation. (Paper needs an update i think, however if you use forum public even will get minor updates there to).

As for the missing headerfile, that is something perhaps issed by c101?? notsure if it was missed or intentional ;> so cannot answr that, im only a new member.. but if it is an extern header,not supplied by any compiler, then yes, it should have been included with package (atleast a scaled-down version).
Regards,
hx

Reply With Quote

#15 (permalink)

Old

25-06-05

Guest

Posts: n/a

Default

definately true, that hf's work on windows and api hooking is superb. I've read all the articles in his knowhow area, and They've definately advanced my knowledge on windows internals.

Reply With Quote

#16 (permalink)

Old

30-06-05

hx

hx is offline

Member

Join Date: Jun 2005

Location: Australia

Posts: 37

Thanks: 0

Thanked 2 Times in 2 Posts

Rep Power: 12

hx is on a distinguished road

Default

Indeed.

Yes there has been MUCH research in this area, and AOT mor is being developed , as we seak, for specifically windows with sp2 , i cannot say much more at this time, but there will be some further api hooking doc presentations, possible some conversion table work for win2k3 server also, some advice and knowhow for it, as it is an extremly powerful and fun tool.
any followups on api hooking, well make your presentation and upload, i will be happy to read/compare notes

. and ofcourse, hf's site , is the main#1 for this stuff trust me, his research is very very useful, and yes, it will help ALOT with gaining the knowledge on the hookng.
regards,
hx

Reply With Quote

Sponsor

Advertiser

Reply

Page 2 of 2

2

« - | about sniffer »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47