vista

Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR

Published September 21, 2009 |

Introduction In all previous tutorials in this Exploit writing tutorial series, we have looked at building exploits that would work on Windows XP / 2003 server. The success of all of these exploits (whether they are based on direct ret overwrite or exception handler structure overwrites) are based on the fact that a reliable return […]

Posted in 001_Security, Exploit Writing Tutorials, Exploits | Tagged !aslrdynamicbase, 2003, 4141414, 8, access violation, add esp, address space layout randomization, adjust ebp, adjust esi, alwaysoff, alwayson, aslr, before function returns, buffer, buffer overflow, bypass, call, compiler, cookie, data execution prevention, dep, dword ptr, exception handler, exploit, gs, hack, handler, immdbg, immunity, jmp, jump, Kifastsystemcallret, ldrpchecknxcompatibility, linker, loaded module, mov al, moveimages, next seh, non exec, nseh, ntsetinformationprocess, nx, ollydbg, optin, optout, partial overwrite, plugin, prevention, processexecute, protection, protectvirtualmemory, pvefindaddr, pycommand, python, ret2libc, safeseh, saved ebp, saved eip, se handler, se structure, sehop, stack, stack overflow, switch, virtual function call, vista, windbg, windows 7, xd, xp

Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development

Published September 5, 2009 |

By Peter Van Eeckhoutte (corelanc0d3r)

In the first parts of this exploit writing tutorial, I have mainly used Windbg as a tool to watch registers and stack contents while evaluating crashes and building exploits. Today, I will discuss some other debuggers and debugger plugins that will help you speed up this process. A typical exploit writing toolkit arsenal should at […]

Posted in 001_Security, Exploit Writing Tutorials, Exploits | Tagged !aslrdynamicbase, !findtrampoline, address call, address jmp, aslr, buffer, byakugan, call esp, eip, esp, esp found, findreturn, found valid, hunt, identbuf, immdbg, immunity, jmp, jmp esp, jutsu, listbuf, memdiff, metasploit, msec, pattern_create, pattern_offset, pop, pycommand, ret, return address, rmbuf, safeseh, searchopcode, shellcode, valid return, vista

Installing Windows 7 from a USB key

Published June 28, 2009 |

By Peter Van Eeckhoutte (corelanc0d3r)

Microsoft has announced that it will support Windows 7 installations from a USB key. This will allow people to install Windows 7 on systems that do not have a DVD drive (yes, Windows 7 will also run quite fast on your old notebook that only has 1Gb of RAM and does not have a DVD […]

Posted in Windows Client OS | Tagged disk, diskpart, dvd, install, install windows, install-windows-from-usb-key, installation, installing, prepare, prepare usb, run diskpart, usb, usb drive, usb key, vista, vista computer, windows, windows watch, windows-via-usb-stick-installieren, yes windows

Fixing ‘Compatibility Mode grayed out’ or ‘Unable to enable Run as administrator’ on Vista / Windows 2008 Server

Published April 27, 2009 |

By Peter Van Eeckhoutte (corelanc0d3r)

Ever wondered how you can set Compatibility Mode on executables under Vista / Windows 2008 server when the settings (or even the entire tab) has been disabled ? Or make the application “run as administrator” permanently, and you’ve found that this setting is disabled ? All of the settings in the Compatibility tab can be […]

Posted in Windows Client OS, Windows Server | Tagged compatibility, compatibility mode, compatibility-greyed-out-windows-7, compatibility-mode-disabled, compatibility-mode-greyed-out, disabled, grayed out, greyed out, mode, registry, run as administrator, runasadmin, unable-to-change-out-of-vista-compatability-mode, value, vista, vista windows, windows 2008, Windows Server, windows-7-compatibility-mode-disabled, windows-7-compatibility-runasadmin

Windows XP L2TP over IPSec dialup client VPN to a Juniper ScreenOS firewall, using Certificates

Published January 11, 2009 |

By Peter Van Eeckhoutte (corelanc0d3r)

Before looking at the various configuration steps, we’ll have to take the following assumptions into account : – We don’t want to use the Netscreen Remote client, but we want to use the Windows XP built-in dialup VPN technology that allows us to build PPTP or L2TP/IPSec connections. Juniper screenOS does not support PPTP (which […]

Posted in 001_Security, Juniper, Networking, Windows Client OS, Windows Server | Tagged auth, certificate, dialup, dynamic-vpn-pptp-juniper, ias, ipsec, Juniper, juniper-l2tp-vpn, juniper-ssg-active-directory-2008, juniper-ssg-vpn-howto-corelan, l2tp, nessus-over-l2tp, radius, screen-os-ssg20, screenos, vista, vpn, window, windows-7-screenos-vpn-ikev2, xp

Icons Shortcuts and SendTo items in Windows XP/2003/Vista/2008

Published July 8, 2008 |

By Peter Van Eeckhoutte (corelanc0d3r)

Fixing missing icons & shortcuts : Send To “Compressed Folder” is missing : Click Start->Run In the “open” box, type “cmd” (without the quotes) Click ok Enter the following command and press “return” rundll32 zipfldr.dll,RegisterSendto (you should not get any warnings or errors) The first time you are trying to zip, you may be prompted […]

Posted in Windows Client OS, Windows Server | Tagged 2000, 2003, 2008, all-users-send-to-windows-2003, desktop-icon-missing-from-quick-launch-serve-2003, how-sendto-xp-items, icons, internet explorer, internet-explorer-icon-missing-in-xp-quick-launch, lock computer, microsoft-nlb-and-juniper-ssg, missing, send-to-compress-shortcut-missing-xp, send-to-shortcut-missing, shortcut, ssg-nlb, user32.dll, vista, windows-2008-sendto, xp

IP Autotuning in Vista

Published April 13, 2008 |

By Peter Van Eeckhoutte (corelanc0d3r)

At any given time, the amount that TCP can send is governed by three factors: the congestion window, the receive window and the number of bytes available to send. Without using TCP window scaling (which is disabled by default in previous versions of Windows), the maximum receive window a receiver can advertise is 64K bytes. […]

Posted in Windows Client OS | Tagged autotuning, autotuning-registry-key, autotuninglevel-icmp, corelans-tcp-over-usb, how-to-set-autotuning-in-vista-to-high, interface, inurlbeindex-phpactionregister, ip, ip autotuning, is-disable-tcp-auto-tuning-dangerous, juniper-firewall-receive-window-auto-tuning, maxreceivewindowsize-64k, netsh, receive-window-auto-tuning-juniper, script-disable-vista-autotuning, tcp-auto-tuning-netgear, tcp-ip-auto-tuning-netgear-router, tcpwindowsize, vista, vista-wifi-autotuning

System/Disk Backup in Vista using command line script

Published April 13, 2008 |

By Peter Van Eeckhoutte (corelanc0d3r)

Microsoft has implemented a really neat feature in Vista Business, Enterprise and Ultimate, allowing you to perform a full disk or even system backup, while the system is running. This new backup tool used Block Level backup and uses Volume Shadow Copy to backup open files (however, it is advised to close your applications while […]

Posted in Windows Client OS | Tagged backup, backup-vista-command-line, command-prompt-backup-vista-how, command-prompt-vista-take-back-up, complete-backup-vista-from-the-command-line, diskpart, enable-backup-in-command-line-in-vista, how-to-back-up-windows-files-using-cmd-prompt, how-to-creat-system-bakcup-in-vistas-using-ccmd, run-vista-backup-from-command-line, script, vaio-eisa-partition-copy-gparted, vista, vista-full-system-backup, vista-home-basic-backup-command-line, volume shadow copy, wbadmin, wbadmin-removable-drive-support-backup-storage-location-error, wbadmin-syntax-backup-vhd-name, windows-script-to-do-backup-files-to-a-cd

Open a command prompt with system rights in Vista (and XP)

Published April 13, 2008 |

By Peter Van Eeckhoutte (corelanc0d3r)

First of all, download psexec from the Microsoft website. http://www.microsoft.com/technet/sysinternals/utilities/psexec.mspx From and elevated/admin command prompt (cmd.exe, “run as administrator”), run psexec –s cmd.exe C:\>whoami peter C:\>psexec -s cmd.exe PsExec v1.83 – Execute processes remotely Copyright (C) 2001-2007 Mark Russinovich Sysinternals – www.sysinternals.com Microsoft Windows [Version 6.0.6000] Copyright (c) 2006 Microsoft Corporation. All […]

Posted in Windows Client OS | Tagged cmd-with-system-privileges-win-xp, cmd-with-system-rights, command prompt, command-prompt-system-right, elevate-command-prompt-exploit-vista, elevated-cmd-exploit, how-to-open-elevated-command-prompt-psexec, metasploit-command-prompt-system-rights, open-command-prompt-system, psexec, psexec-elevated-command-prompt, psexec-start-elevated-command-prompt, psexec-v1-83-download, psexec-with-elevated-cmd-exe, psexec-xp-whoami, russinovich, sysinternals, system permissions, vista, xp

Run explorer window with administrator rights in Vista

Published April 13, 2008 |

By Peter Van Eeckhoutte (corelanc0d3r)

Easy, don’t you think ? Right click explorer(.exe), choose “run as administrator” and you’re set ? Nope – doesn’t work ! And this is why The UAC (User Account Control) feature in Vista provides a user with two tokens when he logs on… a token that is bound to his real user rights, […]

Posted in Windows Client OS | Tagged administrator, corelan-windows-uac, explorer, explorer-exe-administrative-right, explorer-vista-administrator, run-as-administrator-explorer-vista, run-explorer-as-administrator-in-windows-2008-r2, run-explorer-as-administrator-server-2008, run-explorer-as-administrator-vista, run-explorer-as-administrator-windows-2008-r2-server, run-explorer-with-administrative-rights, running-explore-as-an-admin, separate process, vista, vista-explorer-administrator, vista-open-explorer-administrator, vista-run-explorer-as-administrator, windows-2008-open-as-administrator, windows-2008-run-explorer-administrator, xp

Corelan Cybersecurity Research

:: Knowledge is not an object, it's a flow ::

Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development

Installing Windows 7 from a USB key

Fixing ‘Compatibility Mode grayed out’ or ‘Unable to enable Run as administrator’ on Vista / Windows 2008 Server

Windows XP L2TP over IPSec dialup client VPN to a Juniper ScreenOS firewall, using Certificates

Icons Shortcuts and SendTo items in Windows XP/2003/Vista/2008

IP Autotuning in Vista

System/Disk Backup in Vista using command line script

Open a command prompt with system rights in Vista (and XP)

Run explorer window with administrator rights in Vista

Corelan Training

Donate

Corelan Team Merchandise

Corelan on Slack

Actions

Categories

Hi there!

We have good news for you!