http://www.msreverseengineering.com/blog/2018/1/23/a-walk-through-tutorial-with-code-on-statically-unpacking-the-finspy-vm-part-one-x86-deobfuscation #malware #re #ida #dukeBarman
Möbius Strip Reverse Engineering
A Walk-Through Tutorial, with Code, on Statically Unpacking the FinSpy VM: Part One, x86 Deobfuscation — Möbius Strip Reverse Engineering
1. Introduction Normally when I publish about breaking virtual machine software protections, I do so to present new techniques. Past examples have included: Writing an IDA processor module to unpack a VM Logging VM execution with DLL injection Compiler…
REVERSE ENGINEERING WITH RADARE - FUNDAMENTALS AND BASICS https://pixl.dy.fi/posts/2018-01-22-reverse-engineering-basics-with-radare-fundamentals-and-basics/ #radare2 #re #dukeBarman
Forwarded from canyoupwn.me
Anti-debug with VirtualAlloc’s write watch
https://codeinsecurity.wordpress.com/2018/01/24/anti-debug-with-virtualallocs-write-watch/
https://codeinsecurity.wordpress.com/2018/01/24/anti-debug-with-virtualallocs-write-watch/
codeinsecurity
Anti-debug with VirtualAlloc’s write watch
A lesser-known feature of the Windows memory manager is that it can maintain write watches on allocations for debugging and profiling purposes. Passing the MEM_WRITE_WATCH flag to VirtualAlloc R…
SMB exploit (fixed in MS17-010+) now ported to Windows 2000 up to Windows Server 2016, and all versions in between. Reliable, doesn't cause BSOD like EternalBlue either. I've tried on Win2000 and XP. https://github.com/rapid7/metasploit-framework/pull/9473 #expdev #darw1n
GitHub
MS17-010 EternalSynergy / EternalRomance / EternalChampion aux+exploit modules · Pull Request #9473 · rapid7/metasploit-framework
MS17-010 Windows SMB Remote Command and Code Execution modules for all vulnerable targets Windows 2000 through 2016 (and of course the standard home/workstation counterparts).
auxiliary/admin/smb/...
auxiliary/admin/smb/...
Google Chrome V8 Use-After-Free Vulnerability + Exploit by Zhao Qixun (CVE-2017-15399) https://bugs.chromium.org/p/chromium/issues/detail?id=776677 #expdev #uaf #darw1n
Но PoC для use after free баги в Jit V8 (CVE-2017-15399) можно было найти и раньше.
Вспоминаем недавнюю утилиту https://github.com/andreyka/chromium_bug_search и повторяем сценарий, но уже для этой CVE.
ID тикета мы бы получили из новости об этом релизе https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html, которая была опубликована 6 Ноября.
Указываем ID тикета и что мы ищем ошибку в v8:
В итоге попадаем в коммит https://chromium.googlesource.com/v8/v8/+/5f960dfc06a7c95af69e2b09f772b2280168469b, где видим готовый JS PoC - https://chromium.googlesource.com/v8/v8/+/5f960dfc06a7c95af69e2b09f772b2280168469b/test/mjsunit/regress/wasm/regress-776677.js, который был опубликован 23 Октября
Вспоминаем недавнюю утилиту https://github.com/andreyka/chromium_bug_search и повторяем сценарий, но уже для этой CVE.
ID тикета мы бы получили из новости об этом релизе https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html, которая была опубликована 6 Ноября.
[776677] High CVE-2017-15399: Use after free in V8
Указываем ID тикета и что мы ищем ошибку в v8:
python console.py -b 776677 -p v8 -r master
[+] Commit found:
https://chromium.googlesource.com/v8/v8/+/5f960dfc06a7c95af69e2b09f772b2280168469b
В итоге попадаем в коммит https://chromium.googlesource.com/v8/v8/+/5f960dfc06a7c95af69e2b09f772b2280168469b, где видим готовый JS PoC - https://chromium.googlesource.com/v8/v8/+/5f960dfc06a7c95af69e2b09f772b2280168469b/test/mjsunit/regress/wasm/regress-776677.js, который был опубликован 23 Октября
GitHub
GitHub - andreyka/chromium_bug_search: Simple commit search utility for Chromium Google Source.
Simple commit search utility for Chromium Google Source. - andreyka/chromium_bug_search
ARM Exploitation for IoT (Introduction) https://www.exploit-db.com/docs/english/43906-arm-exploitation-for-iot.pdf #OKOB2016
В феврале в московском офисе Яндекса состоится первая в этом году встреча
Участие бесплатное, но нужно заранее зарегистрироваться. Количество мест ограничено.
https://events.yandex.ru/events/yagosti/09-feb-2018/
it sec pro course. На встрече выступят эксперты из Digital Security, Qrator Labs и Positive Technologies. Они расскажут о разработке смарт-контрактов, уязвимостях Meltdown и Spectre, атаках по протоколу DHCP, а также о построении формальных моделей уязвимостей.Участие бесплатное, но нужно заранее зарегистрироваться. Количество мест ограничено.
https://events.yandex.ru/events/yagosti/09-feb-2018/
We have a music channel. Perhaps it will be interesting to someone? https://xn--r1a.website/R0_Music
Cutter 1.2 and radare2 2.3.0 (Codename: DirtyHarry) are out
- https://github.com/radare/radare2/releases/tag/2.3.0
- https://github.com/radareorg/cutter/releases/tag/v1.2
#radare2 #reverse
- https://github.com/radare/radare2/releases/tag/2.3.0
- https://github.com/radareorg/cutter/releases/tag/v1.2
#radare2 #reverse
GitHub
Release Codename: DirtyHarry · radareorg/radare2
Builds: http://radare.mikelloc.com/get/2.3.0/
Changelog:
Release 2.3.0 - use latest acr 1.4
Analysis:
Better use of search.in and anal.in and zoom.in - sivaramaa
Initial work on CPU specific regis...
Changelog:
Release 2.3.0 - use latest acr 1.4
Analysis:
Better use of search.in and anal.in and zoom.in - sivaramaa
Initial work on CPU specific regis...
Windows Drivers fuzzer https://twitter.com/KeyZ3r0/status/958924764336201728 #exploit #windows #dukeBarman
Twitter
K0shl
I opened my Windows Driver Fuzzer--kDrvier Fuzzer in github based on ioctlbf framework, I gained approach 100 CVEs by kDriver Fuzzer in last 3 month!😀😀 And I wrote my kDriver Fuzzer tech. detail in Chinese😁 https://t.co/bT32kB3SjV
https://github.com/Coalfire-Research/iOS-11.1.2-15B202-Jailbreak/blob/master/iOS_jailbreak_writeup.pdf #jailbreak #ios #exploit #dukeBarman
GitHub
iOS-11.1.2-15B202-Jailbreak/iOS_jailbreak_writeup.pdf at main · Coalfire-Research/iOS-11.1.2-15B202-Jailbreak
iOS 11.1.2 (15B202) Jailbreak. Contribute to Coalfire-Research/iOS-11.1.2-15B202-Jailbreak development by creating an account on GitHub.
Hexrays upgraded free IDA from v5 to v7 (supports only x64 code) https://www.hex-rays.com/products/ida/support/download_freeware.shtml #re #dukeBarman
Hex-Rays
IDA Free: Disassembler & Decompiler at No Cost
Free disassembler and decompiler to learn reverse engineering. Core IDA features at no cost for students and non-commercial use. Download and start today.
Decompiler internals: microcode (IDA IR) https://www.hex-rays.com/products/ida/support/ppt/recon2018.ppt #re #ida #ir #dukeBarman