Synthetic Call Stack Mode A silly solution to the problem would be to create two fake frames and link them back to the cut call stack. This would create a sort of apparently legit call stack, even without a suitable frame which unwinds calling POP RBP, but: You would lose the advantage of the desync technique The stack would be still unwindable The resulting call stack could seem legit just on the first glance, but it would probably not pass a strict check The result of the _synthetic spoof can be observed in the image below:
Figure 1: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) - Apparently Legit, non unwoundable call stack whereby the EXE module was completely removed (calling no parameters function getchar) Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1 Desync Stack Mode This mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one.
Figure 2: Windows 10 - Legit, unwoundable call stack whereby the EXE module was completely removed (calling 4 parameters function MessageBoxA) Utility In the repository, you can find also a little util to inspect runtime functions, which might be useful to analyse runtime function entries. UnwindInspector.exe -h
Unwind Inspector (https://www.kitploit.com/search/label/Inspector) v0.100000
Mandatory args:
-m : Target DLL
-f : Target Function
-a : Target Function Address
Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c
Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010)
Build In order to build the POC and observe a similar behaviour to the one in the picture, ensure to: Disable GS (/GS-) Disable Code Optimisation (/Od) Disable Whole Program Optimisation (Remove /GL) Disable size and speed preference (Remove /Os, /Ot) Enable intrinsic if not enabled (/Oi) Previous Work It's worth mentioning previous work done on this topic, which built the foundation of this work. Return Address Spoofing (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html): Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that. YouMayPasser (https://github.com/waldo-irc/YouMayPasser): This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo. VulcanRaven (https://github.com/WithSecureLabs/CallStackSpoofer/): A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring (https://www.kitploit.com/search/label/Mirroring) another real call stack. Unwinder (https://github.com/Kudaes/Unwinder/): A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits Huge shoutout to waldo-irc (https://twitter.com/waldoirc) and trickster0 (https://twitter.com/trickster012), which collaborated with me on this research. I owe everything to them. All the credit for the idea behind this goes to namaszo (https://twitter.com/namazso), which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother). [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now. Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment. Unwinding involving 128-bit registers was no tested. Calling functions that use 128-bit registers is not officially supported.
Download SilentMoonwalk (https://github.com/klezVirus/SilentMoonwalk)
Unwind Inspector (https://www.kitploit.com/search/label/Inspector) v0.100000
Mandatory args:
-m : Target DLL
-f : Target Function
-a : Target Function Address
Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c
Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010)
Build In order to build the POC and observe a similar behaviour to the one in the picture, ensure to: Disable GS (/GS-) Disable Code Optimisation (/Od) Disable Whole Program Optimisation (Remove /GL) Disable size and speed preference (Remove /Os, /Ot) Enable intrinsic if not enabled (/Oi) Previous Work It's worth mentioning previous work done on this topic, which built the foundation of this work. Return Address Spoofing (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html): Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that. YouMayPasser (https://github.com/waldo-irc/YouMayPasser): This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo. VulcanRaven (https://github.com/WithSecureLabs/CallStackSpoofer/): A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring (https://www.kitploit.com/search/label/Mirroring) another real call stack. Unwinder (https://github.com/Kudaes/Unwinder/): A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits Huge shoutout to waldo-irc (https://twitter.com/waldoirc) and trickster0 (https://twitter.com/trickster012), which collaborated with me on this research. I owe everything to them. All the credit for the idea behind this goes to namaszo (https://twitter.com/namazso), which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother). [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now. Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment. Unwinding involving 128-bit registers was no tested. Calling functions that use 128-bit registers is not officially supported.
Download SilentMoonwalk (https://github.com/klezVirus/SilentMoonwalk)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
How to sniff packets from Android phone using Ettercap?
Im trying to do a MitM attack where I use arp poisoning through Ettercap to capture packets from my android phone. When I scan for hosts, only the default 10.0.0 ip addresses show up.
Is there a way I can manually add my androids ip as a host and make it a target? Or how can I get my androids ip to show up?
Also, if I wanted to capture traffic that the android sends to the router and I made my android as the first target, what would I set as the second target?
Just to preface, this is for a school assignment and theres no ill intent. Thanks for any advice/suggestions!
submitted by /u/SarahP15
[link] [comments]
How to sniff packets from Android phone using Ettercap?
Im trying to do a MitM attack where I use arp poisoning through Ettercap to capture packets from my android phone. When I scan for hosts, only the default 10.0.0 ip addresses show up.
Is there a way I can manually add my androids ip as a host and make it a target? Or how can I get my androids ip to show up?
Also, if I wanted to capture traffic that the android sends to the router and I made my android as the first target, what would I set as the second target?
Just to preface, this is for a school assignment and theres no ill intent. Thanks for any advice/suggestions!
submitted by /u/SarahP15
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
How exploitable sensitive information in API is able to destruct business in disruption era — Part3
Well played, finally the rival has been through all of customer’s journey and draw the following flow:Continue reading on Medium »
Read more...
Well played, finally the rival has been through all of customer’s journey and draw the following flow:Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Protecting Your Laravel Application from Malicious File Uploads
https://cdn-images-1.medium.com/max/2600/1*8n8q3zEpTI5HA-HJWBuNBA.jpeg
In today’s digital world, web applications are increasingly targeted by cybercriminals who seek to exploit vulnerabilities in the…
Continue reading on Geek Culture »
Protecting Your Laravel Application from Malicious File Uploads
https://cdn-images-1.medium.com/max/2600/1*8n8q3zEpTI5HA-HJWBuNBA.jpeg
In today’s digital world, web applications are increasingly targeted by cybercriminals who seek to exploit vulnerabilities in the…
Continue reading on Geek Culture »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Stay Safe Online: Simple Steps for Protecting Your Privacy and Security on the Web
https://cdn-images-1.medium.com/max/2600/0*gvjs4GHilZfVoUIt
Essential Tips for Staying Safe Online: Protect Your Privacy and Security in the Digital Age
Continue reading on Medium »
Stay Safe Online: Simple Steps for Protecting Your Privacy and Security on the Web
https://cdn-images-1.medium.com/max/2600/0*gvjs4GHilZfVoUIt
Essential Tips for Staying Safe Online: Protect Your Privacy and Security in the Digital Age
Continue reading on Medium »
https://preview.redd.it/blxnmrxd4zta1.jpg?width=108&crop=smart&auto=webp&s=0f2387c047d890530e7deb59562ec38dd9290e2c The washer at my apartment is just like this one, except there is a card slot instead of a coin slot. I could not find any keyholes on it anywhere. Help!
submitted by /u/anon_2525
[link] [comments]
submitted by /u/anon_2525
[link] [comments]