Figure 1: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) - Apparently Legit, non unwoundable call stack whereby the EXE module was completely removed (calling no parameters function getchar) Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1 Desync Stack Mode This mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one.
Figure 2: Windows 10 - Legit, unwoundable call stack whereby the EXE module was completely removed (calling 4 parameters function MessageBoxA) Utility In the repository, you can find also a little util to inspect runtime functions, which might be useful to analyse runtime function entries. UnwindInspector.exe -h
Unwind Inspector (https://www.kitploit.com/search/label/Inspector) v0.100000
Mandatory args:
-m : Target DLL
-f : Target Function
-a : Target Function Address
Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c
Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010)
Build In order to build the POC and observe a similar behaviour to the one in the picture, ensure to: Disable GS (/GS-) Disable Code Optimisation (/Od) Disable Whole Program Optimisation (Remove /GL) Disable size and speed preference (Remove /Os, /Ot) Enable intrinsic if not enabled (/Oi) Previous Work It's worth mentioning previous work done on this topic, which built the foundation of this work. Return Address Spoofing (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html): Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that. YouMayPasser (https://github.com/waldo-irc/YouMayPasser): This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo. VulcanRaven (https://github.com/WithSecureLabs/CallStackSpoofer/): A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring (https://www.kitploit.com/search/label/Mirroring) another real call stack. Unwinder (https://github.com/Kudaes/Unwinder/): A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits Huge shoutout to waldo-irc (https://twitter.com/waldoirc) and trickster0 (https://twitter.com/trickster012), which collaborated with me on this research. I owe everything to them. All the credit for the idea behind this goes to namaszo (https://twitter.com/namazso), which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother). [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now. Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment. Unwinding involving 128-bit registers was no tested. Calling functions that use 128-bit registers is not officially supported.
Download SilentMoonwalk (https://github.com/klezVirus/SilentMoonwalk)
Unwind Inspector (https://www.kitploit.com/search/label/Inspector) v0.100000
Mandatory args:
-m : Target DLL
-f : Target Function
-a : Target Function Address
Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c
Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010)
Build In order to build the POC and observe a similar behaviour to the one in the picture, ensure to: Disable GS (/GS-) Disable Code Optimisation (/Od) Disable Whole Program Optimisation (Remove /GL) Disable size and speed preference (Remove /Os, /Ot) Enable intrinsic if not enabled (/Oi) Previous Work It's worth mentioning previous work done on this topic, which built the foundation of this work. Return Address Spoofing (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html): Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that. YouMayPasser (https://github.com/waldo-irc/YouMayPasser): This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo. VulcanRaven (https://github.com/WithSecureLabs/CallStackSpoofer/): A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring (https://www.kitploit.com/search/label/Mirroring) another real call stack. Unwinder (https://github.com/Kudaes/Unwinder/): A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits Huge shoutout to waldo-irc (https://twitter.com/waldoirc) and trickster0 (https://twitter.com/trickster012), which collaborated with me on this research. I owe everything to them. All the credit for the idea behind this goes to namaszo (https://twitter.com/namazso), which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother). [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now. Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment. Unwinding involving 128-bit registers was no tested. Calling functions that use 128-bit registers is not officially supported.
Download SilentMoonwalk (https://github.com/klezVirus/SilentMoonwalk)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
How to sniff packets from Android phone using Ettercap?
Im trying to do a MitM attack where I use arp poisoning through Ettercap to capture packets from my android phone. When I scan for hosts, only the default 10.0.0 ip addresses show up.
Is there a way I can manually add my androids ip as a host and make it a target? Or how can I get my androids ip to show up?
Also, if I wanted to capture traffic that the android sends to the router and I made my android as the first target, what would I set as the second target?
Just to preface, this is for a school assignment and theres no ill intent. Thanks for any advice/suggestions!
submitted by /u/SarahP15
[link] [comments]
How to sniff packets from Android phone using Ettercap?
Im trying to do a MitM attack where I use arp poisoning through Ettercap to capture packets from my android phone. When I scan for hosts, only the default 10.0.0 ip addresses show up.
Is there a way I can manually add my androids ip as a host and make it a target? Or how can I get my androids ip to show up?
Also, if I wanted to capture traffic that the android sends to the router and I made my android as the first target, what would I set as the second target?
Just to preface, this is for a school assignment and theres no ill intent. Thanks for any advice/suggestions!
submitted by /u/SarahP15
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
How exploitable sensitive information in API is able to destruct business in disruption era — Part3
Well played, finally the rival has been through all of customer’s journey and draw the following flow:Continue reading on Medium »
Read more...
Well played, finally the rival has been through all of customer’s journey and draw the following flow:Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Protecting Your Laravel Application from Malicious File Uploads
https://cdn-images-1.medium.com/max/2600/1*8n8q3zEpTI5HA-HJWBuNBA.jpeg
In today’s digital world, web applications are increasingly targeted by cybercriminals who seek to exploit vulnerabilities in the…
Continue reading on Geek Culture »
Protecting Your Laravel Application from Malicious File Uploads
https://cdn-images-1.medium.com/max/2600/1*8n8q3zEpTI5HA-HJWBuNBA.jpeg
In today’s digital world, web applications are increasingly targeted by cybercriminals who seek to exploit vulnerabilities in the…
Continue reading on Geek Culture »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Stay Safe Online: Simple Steps for Protecting Your Privacy and Security on the Web
https://cdn-images-1.medium.com/max/2600/0*gvjs4GHilZfVoUIt
Essential Tips for Staying Safe Online: Protect Your Privacy and Security in the Digital Age
Continue reading on Medium »
Stay Safe Online: Simple Steps for Protecting Your Privacy and Security on the Web
https://cdn-images-1.medium.com/max/2600/0*gvjs4GHilZfVoUIt
Essential Tips for Staying Safe Online: Protect Your Privacy and Security in the Digital Age
Continue reading on Medium »
https://preview.redd.it/blxnmrxd4zta1.jpg?width=108&crop=smart&auto=webp&s=0f2387c047d890530e7deb59562ec38dd9290e2c The washer at my apartment is just like this one, except there is a card slot instead of a coin slot. I could not find any keyholes on it anywhere. Help!
submitted by /u/anon_2525
[link] [comments]
submitted by /u/anon_2525
[link] [comments]
hacking: security in practice
Hello guys give your opinion about this roadmap
1- I completed a 4hr course about OSI model (all layers , all protocols) + noted every info on a note book
2- I begun studying a 20 hr+ udemy course involves : Footprintng , scanning, website penetration , wireless hacking , Man in middle , coding keylogger and backdoor . I will take my time with this course and note every info on a notebook
3- Practice this info on hack this site missions
is this good ? any recommendations are appreciated :)
submitted by /u/Mr_Jaber
[link] [comments]
Hello guys give your opinion about this roadmap
1- I completed a 4hr course about OSI model (all layers , all protocols) + noted every info on a note book
2- I begun studying a 20 hr+ udemy course involves : Footprintng , scanning, website penetration , wireless hacking , Man in middle , coding keylogger and backdoor . I will take my time with this course and note every info on a notebook
3- Practice this info on hack this site missions
is this good ? any recommendations are appreciated :)
submitted by /u/Mr_Jaber
[link] [comments]
Reddit
r/hacking on Reddit: Hello guys give your opinion about this roadmap
Posted by u/Mr_Jaber - No votes and no comments