Synthetic Call Stack Mode A silly solution to the problem would be to create two fake frames and link them back to the cut call stack. This would create a sort of apparently legit call stack, even without a suitable frame which unwinds calling POP RBP, but: You would lose the advantage of the desync technique The stack would be still unwindable The resulting call stack could seem legit just on the first glance, but it would probably not pass a strict check The result of the _synthetic spoof can be observed in the image below:

Figure 1: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) - Apparently Legit, non unwoundable call stack whereby the EXE module was completely removed (calling no parameters function getchar) Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1 Desync Stack Mode This mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one.

Figure 2: Windows 10 - Legit, unwoundable call stack whereby the EXE module was completely removed (calling 4 parameters function MessageBoxA) Utility In the repository, you can find also a little util to inspect runtime functions, which might be useful to analyse runtime function entries. UnwindInspector.exe -h

Unwind Inspector (https://www.kitploit.com/search/label/Inspector) v0.100000

Mandatory args:
-m : Target DLL
-f : Target Function
-a : Target Function Address
Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c

Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010)
Build In order to build the POC and observe a similar behaviour to the one in the picture, ensure to: Disable GS (/GS-) Disable Code Optimisation (/Od) Disable Whole Program Optimisation (Remove /GL) Disable size and speed preference (Remove /Os, /Ot) Enable intrinsic if not enabled (/Oi) Previous Work It's worth mentioning previous work done on this topic, which built the foundation of this work. Return Address Spoofing (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html): Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that. YouMayPasser (https://github.com/waldo-irc/YouMayPasser): This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo. VulcanRaven (https://github.com/WithSecureLabs/CallStackSpoofer/): A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring (https://www.kitploit.com/search/label/Mirroring) another real call stack. Unwinder (https://github.com/Kudaes/Unwinder/): A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits Huge shoutout to waldo-irc (https://twitter.com/waldoirc) and trickster0 (https://twitter.com/trickster012), which collaborated with me on this research. I owe everything to them. All the credit for the idea behind this goes to namaszo (https://twitter.com/namazso), which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother). [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now. Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment. Unwinding involving 128-bit registers was no tested. Calling functions that use 128-bit registers is not officially supported.

Download SilentMoonwalk (https://github.com/klezVirus/SilentMoonwalk)

hacking: security in practice
How to sniff packets from Android phone using Ettercap?

Im trying to do a MitM attack where I use arp poisoning through Ettercap to capture packets from my android phone. When I scan for hosts, only the default 10.0.0 ip addresses show up.

Is there a way I can manually add my androids ip as a host and make it a target? Or how can I get my androids ip to show up?

Also, if I wanted to capture traffic that the android sends to the router and I made my android as the first target, what would I set as the second target?

Just to preface, this is for a school assignment and theres no ill intent. Thanks for any advice/suggestions!

submitted by /u/SarahP15
[link] [comments]

hacking: security in practice
"OG username" thefts on AOL (2001/2002)

https://external-preview.redd.it/FK9tqpVRybsmvkX_3dacgzmK-ZeRTZIk9EBZDrI0MUk.jpg?width=108&crop=smart&auto=webp&s=b9d4969e87d2b9871a26379cdcbab460d797d292 submitted by /u/endless
[link] [comments]

How exploitable sensitive information in API is able to destruct business in disruption era — Part3

Well played, finally the rival has been through all of customer’s journey and draw the following flow:Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Russian SolarWinds Culprits Launch Fresh Barrage of Espionage Cyberattacks

The threat group behind the SolarWinds supply-chain attacks is back with new tools for spying on officials in NATO countries and Africa.

Dark Reading: Attacks/Breaches
Why xIoT Devices Are Cyberattackers' Gateway Drug for Lateral Movement

Detailing how extended IoT (xIoT) devices can be used at scale by attackers to establish persistence across networks and what enterprises should start doing about the risk.

Dark Reading: Attacks/Breaches
Software-Dependency Data Delivers Security to Developers

Google has opened up its software-dependency database, adding to the security data available to developers and tool makers. Now developers need to use it.

Dark Reading: Attacks/Breaches
Security Is a Revenue Booster, Not a Cost Center

Focusing on what customers and partners need from a company can help CISOs show the real financial benefits of improving cybersecurity.

Dark Reading: Attacks/Breaches
Bugs in Manarium Play-to-Earn Platform Showcase Crypto-Gaming Insecurity

Researchers plug in winning scores to make off with NFTs without actually playing the GameFi platform's minigames.

Hacking on Medium
Protecting Your Laravel Application from Malicious File Uploads

https://cdn-images-1.medium.com/max/2600/1*8n8q3zEpTI5HA-HJWBuNBA.jpeg
In today’s digital world, web applications are increasingly targeted by cybercriminals who seek to exploit vulnerabilities in the…

Continue reading on Geek Culture »

Hacking on Medium
Stay Safe Online: Simple Steps for Protecting Your Privacy and Security on the Web

https://cdn-images-1.medium.com/max/2600/0*gvjs4GHilZfVoUIt
Essential Tips for Staying Safe Online: Protect Your Privacy and Security in the Digital Age

Continue reading on Medium »

bWAPP OS Command Injection

OS Command Injection Nedir?Continue reading on Medium »
Read more...