001_Security

BlackHat EU 2012 – Day 1

  Introduction – Back in Amsterdam ! After a 2 year detour in Barcelona, BlackHat Europe has returned to Amsterdam again this year. After spending a few hours on the train, checking in at The Grand Hotel Krasnapolsky,  getting my ‘media’ badge (thank you BlackHat) & grabbing a delegate bag, and finally working my way […]

Debugging Fun – Putting a process to sleep()

Recently I played with an older CVE (CVE-2008-0532, http://www.securityfocus.com/archive/1/489463, by FX) and I was having trouble debugging the CGI executable where the vulnerable function was located.
Continue reading

Exploit writing tutorial part 11 : Heap Spraying Demystified

A lot has been said and written already about heap spraying, but most of the existing documentation and whitepapers focus on IE7 or older versions.
Although there are a number of public exploits available that target IE8, the exact technique to do so has not been really documented in detail.
Of course, you can probably derive how it works by looking at those public exploits.

With this tutorial, I’m going to provide you with a full and detailed overview on what heap spraying is, and how to use it on old and newer platforms.
I’ll start with some “ancient” techniques (or classic techniques if you will) that can be used on IE6 and IE7.
We’ll also look at heap spraying for non-browser applications.
Next, we’ll talk about precision heap spraying, which is a requirement to make DEP bypass exploits work on IE8.
I’ll finish this tutorial with sharing some of my own research on getting reliable heap spraying to work on IE9.
Continue reading

Many roads to IAT

A few days ago a friend approached me and asked how he could see the import address table under immunity debugger and if this could be done using the command line.

I figured this would be a good time to take a look at what the IAT is, how we can list the IAT and what common reversing hurdles could be with regards to the IAT.
Continue reading

WoW64 Egghunter

Traditional Egghunter An Egghunter is nothing more than an assembly routine to find shellcode somewhere in memory. We typically deploy an Egghunter when there is no more room in our buffer that we can use to initially redirect EIP to. If we are able to load our shellcode elsewhere in process memory, the Egghunter will […]

Corelan T-Shirt Contest – Derbycon 2011

September is going to be a busy month.

With Brucon approaching very fast and Derbycon on its way as well, it looks like I will be spending more time at cons than at work :)

I’ll have the pleasure to teach the Corelan Live Exploit Development Bootcamp trainings at Brucon and Derbycon. If you are a student, make sure to check the prerequisites so we’re all set to make the training a success for everyone.
Continue reading

Metasploit Bounty – the Good, the Bad and the Ugly

On June 14, 2011 HD Moore announced the Metasploit Bounty contest, offering a cash incentive for specific vulnerabilities to be submitted as modules in the Metasploit Framework. Titled “30 exploits, $5000 in 5 weeks”, a post on the Rapid7 blog lists the 30 “bounties” selected by the MSF team, waiting for someone to claim and submit a working exploit module.
Continue reading

mona.py – the manual

This document describes the various commands, functionality and behaviour of mona.py.

Released on june 16, this pycommand for Immunity Debugger replaces pvefindaddr, solving performance issues and offering numerous new features. pvefindaddr will still be available for download until all of its functionality has been ported over to mona.
Continue reading

ROP your way into B-Sides Las Vegas 2011

Ahh.. Vegas.. What happens in Vegas, stays in Vegas right ?

With a variety of cons ahead (BlackHat, Defcon, B-Sides, …) there is plenty of things that can and will happen at Vegas. Will you be there to witness & enjoy it ?

Getting to Vegas is just one part of the story. Getting access to one of the cons is the second part, but in case of B-Sides, there are no tickets left anymore.
So, in case you were not able to get one of the free tickets to B-Sides LV, there’s good news !

We have 2 tickets for B-Sides LV (august 3 & 4, 2011)… and we’re giving them away…but not without a little ‘battle’…
Continue reading

Corelan Training

We have been teaching our win32 exploit dev classes at various security cons and private companies & organizations since 2011

Check out our schedules page here and sign up for one of our classes now!

Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Protected by Copyscape Web Plagiarism Tool

Corelan on Slack

You can chat with us and our friends on our Slack workspace:

  • Go to our facebook page
  • Browse through the posts and find the invite to Slack
  • Use the invite to access our Slack workspace
  • Categories