Hacking Articles Tips Tricks Videos Tutorials

--binary - Don't output a FELF, output the raw loaded image with no
metadata
--base= - Force the output to start at ``, zero padding from
the base to the start of the first LOAD segment if needed.
`` is default hex, can be overrided with `0d`, `0b`,
`0x`, or `0o` prefixes.
Warning: This does not _relocate_ to base, it simply starts
the output at `` (adding zero bytes such that the
output image can be loaded at `` instead of the
original ELF base)
- Path to input ELF
- Path to output file
To install this tool run: cargo install --path . Now you can use elfloader from anywhere in your shell! Dev This project was developed live here: https://www.youtube.com/watch?v=x0V-CEmXQCQ Example There's an example in example_small_program, simply run make or nmake and this should generate an example.bin which is 8 bytes. : 133700b0: 8b000020 add x0, x1, x0 133700b4: d65f03c0 ret">pleb@gamey ~/elfloader/example_small_program $ make
cargo build --release
Finished release [optimized] target(s) in 0.03s
elfloader --binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 8 Nov 8 12:27 ./example.bin

pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program

target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64

Disassembly of section .text:

00000000133700b0 :
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret
Now you can write your shellcode in Rust, and you don't have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you! There's also an example with .bss and .rodata : 13370124: 90000000 adrp x0, 13370000 13370128: 90000008 adrp x8, 13370000 1337012c: 52800029 mov w9, #0x1 // #1 13370130: 91048000 add x0, x0, #0x120 13370134: 3904f109 strb w9, [x8, #316] 13370138: d65f03c0 ret pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data Elf file type is EXEC (Executable file) Entry point 0x13370124 There are 4 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120 0x0000000000000004 0x0000000000000004 R 0x1 LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124 0x0000000000000018 0x0000000000000018 R E 0x4 LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c 0x0000000000000000 0x0000000000000001 RW 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x0 Section to Segment mapping: Segment Sections... 00 .rodata 01 .text 02 .bss 03 ">pleb@gamey ~/elfloader/example_program_with_data $ make
cargo build --release
Finished release [optimized] target(s) in 0.04s
elfloader --binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data

___________________________
@hacking_Attack
@Hacking_Video

YouTube

Getting Rust running on Windows NT 4.0 MIPS64

In this stream we get Rust running on Windows NT 4.0 running on MIPS64. How cool is that!? We write an ELF to shellcode converter (https://github.com/gamozolabs/elfloader) and then a small network loader for downloading and executing these payloads inside…

4 viewsedited 12:58

Hacking Articles Tips Tricks Videos Tutorials

target/aarch64-unknown-none/release/example_program_with_data: file format elf64-littleaarch64

Disassembly of section .text:

0000000013370124 :
13370124: 90000000 adrp x0, 13370000
13370128: 90000008 adrp x8, 13370000
1337012c: 52800029 mov w9, #0x1 // #1
13370130: 91048000 add x0, x0, #0x120
13370134: 3904f109 strb w9, [x8, #316]
13370138: d65f03c0 ret
pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data

Elf file type is EXEC (Executable file)
Entry point 0x13370124
There are 4 program headers, starting at offset 64

Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120
0x0000000000000004 0x0000000000000004 R 0x1
LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124
0x0000000000000018 0x0000000000000018 R E 0x4
LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c
0x0000000000000000 0x0000000000000001 RW 0x4
GNU_STAC K 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x0

Section to Segment mapping:
Segment Sections...
00 .rodata
01 .text
02 .bss
03
Internals This tool doesn't care about anything except for LOAD sections. It determines the endianness (little vs big) and bitness (32 vs 64) from the ELF header, and from there it creates a flat image based on program header virtual addresses (where it's loaded), file size (number of initialized bytes) and mem size (size of actual memory (https://www.kitploit.com/search/label/Memory) region). The bytes are initialized from the file based on the offset and file size, and this is then extended with zeros until mem size (or truncated if mem size is smaller than file size). These LOAD sections are then concatenated together with zero-byte padding for gaps. This is designed to be incredibly simple, and agnostic to the ELF input. It could be an executable, object file, shared object, core dump, etc, doesn't really care. It'll simply give you the flat representation of the memory, nothing more. This allows you to turn any ELF into shellcode, or a simpler file format that is easier to load in hard-to-reach areas, like embedded (https://www.kitploit.com/search/label/Embedded) devices. Personally, I developed this for my MIPS (https://www.kitploit.com/search/label/MIPS) NT 4.0 loader which allows me to run Rust code. FELF0001 format This tool by default generates a FELF file format. This is a Falk ELF. This is a simple file format: - Rest of the file is the raw image, to be loaded at `base` and jumped into at `entry`">FELF0001 - Magic header
entry - 64-bit little endian integer of the entry point address
base - 64-bit little endian integer of the base address to load the image
- Rest of the file is the raw image, to be loaded at `base` and jumped
into at `entry`

Download Elfloader (https://github.com/gamozolabs/elfloader)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

5 viewsedited 12:58

Hacking Articles Tips Tricks Videos Tutorials

Pen Testing vs Sec Manager Role
https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/

I am 31 and I have been working in cyber sec for few years now and have the opportunity to move away from my analyst role to a managerial role in security. At the same time I always loved pen testing and finally got qualified for it. There is a possibility that I can get a pen testing role but it will an starting point again and salary would be the same as my current. I like to know your opinion about if it worth it to move into pen testing world or just continue my broad security role and go into a managerial role with higher salary. Of course interest is the key in this but I think maybe if I move to pen testing then again I go back to square one and I will need few years to get to were I am now in my field.. would it still worth it? There is not right or wrong just general idea and comments plz submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/) [comments] (https://www.reddit.com/r/Pentesting/comments/skc69q/pen_testing_vs_sec_manager_role/)

___________________________
@hacking_Attack
@Hacking_Video

Pen Testing vs Sec Manager Role

I am 31 and I have been working in cyber sec for few years now and have the opportunity to move away from my analyst role to a managerial role in...

7 viewsedited 13:20

Hacking Articles Tips Tricks Videos Tutorials

7 views14:45

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
Offensive Security Tool: Stratus Red Team

Black Hat Ethical Hacking

Offensive Security Tool: Stratus Red Team | Black Hat Ethical Hacking

Stratus Red Team is "Atomic Red Team" for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner.

9 views14:45

Hacking Articles Tips Tricks Videos Tutorials