..:: Corelan Cybersecurity Research ::.. - Part 7Corelan Cybersecurity Research

Installing Watobo on BackTrack 5

Published July 23, 2011 |

Watobo author Andy Schmidt made 2 great videos about installing Watobo on Windows and on BackTrack 5.
I created a rather simple and short shell script to install Watobo on BT5. Nothing new, nothing sensational, just to alleviate the installation process.
Continue reading →

Posted in 001_Security, Pentesting, Web Application Security | Tagged andy schmidt, back-track-5-scripts, backtrack, backtrack-5, backtrack-5-gem1-8-install, backtrack-5-script, backtrack-5-scripts, backtrack-5-scripts-download, backtrack-scripts, backtrack-shell-scripts, blacktrack-team-sharing, install, install-ciso-di-backtrack-5, install-watobo-in-backtrck, jak-zainstalowac-ssh-c-ubiquity-backtrack, script, watobo, watobo-backtrack-install, watobo-was-created-by, www-remote-exploit-orgbacktrack_download-html

mona.py – the manual

Published July 14, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

This document describes the various commands, functionality and behaviour of mona.py.

Released on june 16, this pycommand for Immunity Debugger replaces pvefindaddr, solving performance issues and offering numerous new features. pvefindaddr will still be available for download until all of its functionality has been ported over to mona.
Continue reading →

Posted in 001_Security, Exploit Writing Tutorials | Tagged automation, corelan, corelanc0d3r, documentation, exploit, exploit development, immunity, immunity debugger, metasploit, mona, mona.py, pattern, plugin, pycommand, python, rapid7, rop, rop automation, rop gadget, suggest

ROP your way into B-Sides Las Vegas 2011

Published July 12, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

Ahh.. Vegas.. What happens in Vegas, stays in Vegas right ?

With a variety of cons ahead (BlackHat, Defcon, B-Sides, …) there is plenty of things that can and will happen at Vegas. Will you be there to witness & enjoy it ?

Getting to Vegas is just one part of the story. Getting access to one of the cons is the second part, but in case of B-Sides, there are no tickets left anymore.
So, in case you were not able to get one of the free tickets to B-Sides LV, there’s good news !

We have 2 tickets for B-Sides LV (august 3 & 4, 2011)… and we’re giving them away…but not without a little ‘battle’…
Continue reading →

Posted in Cons and Seminars | Tagged b-sides, bsides, bsides-las-vegas, chain, gadget, game, intitlelas-vegas-php-web-development-wordpress-development, las vegas, las-vegas-regional-occupational-program, metasploit-return-oriented-programming, programming-for-metasploit, regional-occupational-program-in-las-vegas, regional-occupational-program-las-vegas, return oriented programming, rop, rop-las-vegas, ropdb, vegas, what-happens-in-vegas-stays-in-vegas, what-u-do-in-vegas-stay-in-vegas-wallpaper

Universal DEP/ASLR bypass with msvcr71.dll and mona.py

Published July 3, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

Over the last few weeks, there has been some commotion about a universal DEP/ASLR bypass routine using ROP gadgets from msvcr71.dll (written by Immunity Inc) and the fact that it might have been copied into an exploit submitted to Metasploit as part of the Metasploit bounty.

I’m not going to make any statements about this, but the ROP routine itself looks pretty slick.
Continue reading →

Posted in 001_Security, Exploit Writing Tutorials, Exploits | Tagged aslr, bounty, bypass, chain, corelan, dep, exploit, finding-universal-offsets-immunity, gadget, httpswww-corelan-beindex-php20110703universal-depaslr-bypass-with-msvcr71-dll-and-mona-py, immunity, metasploit, mona.py, mscvr-dll, msvcr71, return oriented programming, rop, rop-mona-py, universal-rop-bypass, white phosphorus

Mona 1.0 released !

Published June 16, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

FINALLY !
After spending almost 6 months of designing, developing and testing, and after ‘surviving’ 2 presentations (at AthCon and Hack In Paris), I am extremely excited and proud to present, on behalf of the entire Corelan Team, the general availability of mona.py.

With this announcement, we also declare pvefindaddr officially dead from this point forward. (This doesn’t mean pvefindaddr is now entirely worthless, because not all functions have been ported into mona yet, but we won’t be releasing any updates to pvefindaddr anymore and the entire project page/download page will eventually disappear)
Continue reading →

Posted in 001_Security, Exploit Writing Tutorials, Exploits, Uncategorized | Tagged eip, exploit, gadget, immunity, immunity debugger, immunitydbg-mona-example, immunitydbg-search-for-rop, mona, mona-corelan, mona-corelan-bad-characters, mona-download, mona-py-search-for-pointers, mona-py-youku, mona.py, monapy, pvefindaddr, pycommand, return oriented programming, rop, rop automation

Hack Notes : Ropping eggs for breakfast

Published May 12, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

Introduction I think we all agree that bypassing DEP (and ASLR) is no longer a luxury today. As operating systems (such as Windows 7) continue to gain popularity, exploit developers are forced to deal with increasingly more memory protection mechanisms, including DEP and ASLR. From a defense perspective, this is a good thing. But we […]

Posted in Exploit Writing Tutorials, Exploits | Tagged code reuse, corelan-rop, egg, egghunter, how-to-hack-notes, how-to-hack-windows-7-note, hunter, memcpy, memmove, metasploit, payload, return oriented programming, rop, rop-chain-what-is, shellcode, shellcode-virtualalloc-pastebins, strcpy, strncpy, virtualalloc, virtualprotect

HITB 2011 CTF – Reversing Vectored Exception Handling (VEH)

Published April 3, 2011 |

By Corelan Team (fancy)

Today we will have a look at a CTF binary from HITB pre qualifications CTF 2011. This is an interesting binary to reverse because Vectored Exception Handling (VEH) was used in the challenge…
Continue reading →

Posted in 001_Security, Malware and Reversing, Uncategorized | Tagged -exploit-handler-part-6-1, 2011-hitb, corelan, ctf, ctf-hitb, ctf-reversing-unsolved-binaries, debug, exception, fancy, handler, hitb, hitb-2011, hitb-2011-ctf, hitb-2011-schedule, reversing-ctf, vectored, vectored-exception-handling, vectored-exception-handling-exploiting, vectoredexceptionhandle, veh

Honeynet Workshop 2011

Published March 30, 2011 |

By Corelan Team (ekse)

March 21th I was in Paris for the annual Honeynet Workshop. For the first time this year there was a conference day accessible to the general public. Moreover, I didn’t have to pay the registration fee since I successfully completed one of the Honeynet Forensics challenges. The day was split in 4 sessions and had talks covering the Honeynet projects, malware, and ethical and legal considerations of tracking botnets and eventual take-downs.
Continue reading →

Posted in 001_Security, Cons and Seminars, Malware and Reversing, Uncategorized | Tagged 2011, angeloa dell'area, bayesian, bytecode, capture-hpc, christian seifert, ctf, david watson, dionanea, ekse, form grabbing, georg wicherski, glastopf, google, honeyclient, honeynet, honeypot, lance james, libscizzle, lukas rist, malicous, malware, multicap, nepenthes, oxff, packet, phoneyc, python, qemu, reassemble, sandbox, sebek, sniffing, spidermonkey, spyeye, streams, summer of code, tillman werner, vmware, wireshark, workshop, zeus

Pastenum – Pastebin/pastie enumeration tool

Published March 22, 2011 |

By Elliott Cutright

When conducting a pen-test, the process typically starts with the reconnaissance phase, the process of gathering information about your target(s) system, organization or person.
Today, we want to present a tool that can be added to your reconnaissance toolkit.
Continue reading →

Posted in 001_Security, Pentesting, Scripts | Tagged backtrack-3-free-download, backtrack3-free-download, colored, enumerate, gem, gscraper, json, mechanize, nokogiri, nullthreat, pastebin, pastenum, pastie, pentest, query, reconnaissance, ruby, rvm, scrape, uri-query_params

BlackHat Europe 2011 / Day 02

Published March 18, 2011 |

By Peter Van Eeckhoutte (corelanc0d3r)

Having missed the IOActive party last night, I woke up fresh and sharp and ready for some kick-ass debugger stuff so I decided to start my second day at BlackHat Europe 2011 with attending the Cisco IOS fuzzing & debugging talk.
Continue reading →

Posted in 001_Security, Cons and Seminars | Tagged 2011, alfredo ortega, barcelona, blackhat, blackhat europe, cisco ios, denial of service mitigation, DoS, floodgates, fuzzing, graph, loic, malware, pie chart, roboo, sebastian muniz, stuxnet, tom parker, visualize, wim remes

Corelan Cybersecurity Research

:: Knowledge is not an object, it's a flow ::

mona.py – the manual

ROP your way into B-Sides Las Vegas 2011

Universal DEP/ASLR bypass with msvcr71.dll and mona.py

Mona 1.0 released !

Hack Notes : Ropping eggs for breakfast

HITB 2011 CTF – Reversing Vectored Exception Handling (VEH)

Honeynet Workshop 2011

Pastenum – Pastebin/pastie enumeration tool

BlackHat Europe 2011 / Day 02

Corelan Training

Donate

Corelan Team Merchandise

Corelan on Slack

Actions

Categories

Hi there!

We have good news for you!