Another post about linked lists.

http://www.osronline.com/article.cfm%5Earticle=499.htm

How a group of hackers (FIN7) used SHIM databases to inject a malicious DLL in services.exe. I really liked this method, the SHIM implementation and SHIM databases made by Microsoft patch executables through in-memory patches, when the .exe is loaded into memory (the same for drivers), this malware uses a SDB file with the 2nd stage code inside, and modifies the registry keys that store the SDB path for an application, this way when services.exe is loaded, Windows checks if there is any .sdb file for it, if so, the application is patched with the code inside it, in this case the code patched is ScRegisterTCPEndpoint function, when the function is called, the program decompresses and reads the shellcode stored in the registry HKLM\SOFTWARE\Microsoft\DRM, then it sleeps for 4 minutes and loads a new process named svchost.exe with the malware's DLL.

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html

Simple tutorial about how to use the PEB to control EIP. In the example, he abuses a Heap Overflow vulnerability, where he can write any data to any address through FLINK and BLINK pointers (this can work too if you can overwrite a pointer that deals with memory writing after the overflow), but the main part are the FastPebLockRoutine and FastPebUnlockRoutine pointers from PEB, which pointer to RtlEnterCriticalSection and RtlLeaveCriticalSection respectively. If you can write anything at any address, then you can overwrite one of these function pointers with a pointer to your shellcode (since he controls both EAX and ECX registers), these functions are called by ExitProccess() and some exception handler functions, that's why he does not care about that exception being generated after the PEB overwriting. This method works well in Windows XP, but because of ASLR, their addresses are randomized, the only way to bypass this is knowing somehow one of these addresses, then it can be used in modern exploitations.

https://www.exploit-db.com/papers/13178

Contains lots of techniques used to detect debuggers.

https://anti-debug.checkpoint.com/

Yet another Heap Overflow discussion, but i'm uploading this because of some interesting topics like Vectored Exception Handling in Heap Exploitation, PEB overwrite and SetUnhandledExceptionFilter overwrite in order to control the program's execution. All these topics can be found in the Heap Overflows section of The Shellcoders Handbook, and despite are simple topics, i think you need to bear in mind that they exist.

Test your abilities.

https://pwnable.tw/challenge/

Simple and short tuto about stripped binaries, main commands here are objdump and file (an interesting approach would be r2, which you could replace the "file" command with "iI" and it returns a lot of information). I'm sending some stuff about stripped binaries later.

https://medium.com/@zlkidda/day-1-quest-for-my-first-zero-day-dealing-with-stripped-binaries-8501460e2781

You can find this link inside the post above. Besides the "file" command, he uses the entrypoint to find the main() address.

https://tr0id.medium.com/working-with-stripped-binaries-in-gdb-cacacd7d5a33

In this site you can learn more about exploitation in general, it has 4 topics, sorted by names (Phoenix, Nebula, Fusion, Main Sequence CTF-Like, and Protostar). Here their descriptions:

Phoenix
Phoenix introduces basic memory corruption issues such as buffer overflows, format strings and heap exploitation under “old-style” Linux system that does not have any form of modern exploit mitigation systems enabled. It has both 32 bit and 64 bit levels available, for both X86 and ARM systems.

Phoenix is the next progression from Nebula.

Fusion
Fusion continues the memory corruption, format strings and heap exploitation but this time focusing on more advanced scenarios and modern protection systems.

Fusion is the place to start if you are familiar with Linux exploitation and wish to learn more about exploitation prevention systems.

Main Sequence
Main Sequence is the Capture The Flag event from Ruxcon 2012. It provides a variety of challenges such as penetration tool usage, binary analysis, basic cryptographic analysis, client side exploitation, password cracking and general website hacking.

Protostar
Protostar has effectively been replaced by Phoenix - it is kept here for archival reasons. Protostar introduces basic memory corruption issues such as buffer overflows, format strings and heap exploitation under “old-style” Linux system that does not have any form of modern exploit mitigation systems enabled.


https://exploit.education/

A brief video about static analysis, besides file command, he used ldd to list requiring libraries for that executable. He found out main function using the "entry" pointer, which calls main and its arguments, but using static analysis he couldn't find external functions like printf and fgets, so he provided two ways to find these functions, first you can use GDB and trace syscalls (since prints and file management functions use syscalls), or you can use function signatures, most known method is F.L.I.R.T, provided by IDA.

https://www.youtube.com/watch?v=CgGha_zLqlo

|Links about write-ups and articles|:

https://telegra.ph/Links-about-write-ups-and-articles-07-16

|Awesome-like links|:

https://telegra.ph/Awesome-like-links-09-12

|Math|:

https://www.ck12.org/

https://ocw.mit.edu/courses/mathematics/ (MIT free courses)

https://math.mit.edu/academics/undergrad/roadmaps.php (MIT roadmaps, divided by 1-2-3 tiers)

https://www.khanacademy.org/math (Khan Academy)

https://www.mathsisfun.com/calculus/index.html

https://tutorial.math.lamar.edu/ (Paul's Online Notes, very useful, many resources)

https://plus.maths.org/content/ (various articles regarding math)

http://passyworldofmathematics.com/

https://openstax.org/subjects/math

https://www.wolfram.com/mathematica/ (Calculus, Algebra, Applied Mathematics)

https://www.freemathhelp.com/

http://math.andrej.com/

https://courses.lumenlearning.com/physics/

https://www.cliffsnotes.com/study-guides

https://byjus.com/maths/calculus/#basics

http://institute.hirophysics.com/

https://www.emathzone.com/

|C++|:

https://www.tutorialspoint.com/cplusplus

https://www.cplusplus.com/doc/tutorial/

https://www.softwaretestinghelp.com/cpp-tutorials/ (includes tutorial with data structures)

https://www.geeksforgeeks.org/cpp-tutorial/

https://www.falstad.com/mathphysics.html (educational applets for math and physics)

|Cryptography|

https://crypto.stanford.edu/

https://www.tutorialspoint.com/cryptography/index.htm

|Integrated Circuits (IC) and Hardware|:

http://www.siliconpr0n.org/wiki/doku.php

https://www.sparkfun.com/engineering_essentials

http://www.righto.com/?m=1

https://apachepersonal.miun.se/~gorthu/

https://www.cl.cam.ac.uk/~sps32/

https://perso.telecom-paristech.fr/pacalet/HWSec/

https://www.electronics-tutorials.ws/sitemap

http://cpuville.com/Educational/Educational-home.html

http://hwsecuritybook.org/recommended-reading-materials/

https://www.electronicshub.org/tutorials/

http://users.ece.utexas.edu/~valvano/

https://www.fpga4fun.com/

https://github.com/KarenWest/hardwareSecurity

|Resources|:

https://www.computer-pdf.com/

https://opensecuritytraining.info/IntroductionToReverseEngineering.html

http://index-of.es/EBooks/

https://github.com/EbookFoundation/free-programming-books

https://b-ok.lat/

https://pdfroom.com/

Vim:

https://vim.rtorr.com/

https://vimhelp.org/

prog:

https://danluu.com/programming-blogs/

Interesting article of Format String exploitation. Since the printf uses a direct address from stack, we can manipulate that string to show whatever we want, but we can also force the function to access a memory location (in this case she used %n arg) and overwrite the return pointer address with the address of our shellcode.

https://osandamalith.com/2018/02/01/exploiting-format-strings-in-windows/

SANS Cyber Security roadmap.

https://www.sans.org/cyber-security-skills-roadmap

Topics: Exploitation and reverse engineering. #book #exploit #reversing

Summary: 27 Chapters, 745 pages.
Year: 2007

This ebook shows you how exploits work with examples, demonstrating many techniques to abuse a vulnerability or bypass mitigations around known Operating Systems.

Topics: exploitation bypasses #exploit #reversing

This article shows some common bypasses for Stack Cookies, SAFESEH and SEHOP, DEP and ASLR. In order to bypass stack cookies, you need to exploit SEH or overwrite some pointer controlled by you that is called before the cookie verification function (like a pointer to a object), you can guess the cookie value too, but it is not common. For SAFESEH, you can use addresses outside the modules compiled with SEH, or search for modules without the SAFESEH flag. For SEHOP, you need to make a fake SEH (see https://t.me/p_file/10). For DEP, you use techniques like JOP and ROP to call Windows API and allocate memory or set memory as writable, you can also search in memory for your data, it may be located on a heap or a space with execute permission.
Lastly, you can partially overwrite the return pointer to bypass ASLR, or search for modules without ASLR flags.

https://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/

Topics: Emulation, programming, NES and C++. #emulation #programming #playlist

This playlist has 8 parts and teach you the main steps to make an emulator for NES.

https://www.youtube.com/playlist?list=PLrOv9FMX8xJHqMvSGB_9G9nZZ_4IgteYf

You can use these two links for additional information.

http://emulator101.com/

https://wiki.nesdev.com/w/index.php/Programming_guide

Topics: Programming, C++ #programming #cpp

The C++ Tutorial, this guide provides you the C++ concepts with advices and good practices.

https://www.learncpp.com/

Topics: Programming and DevOps. #programming #roadmap

An useful roadmap of the concepts you need to know to become a DevOps.

https://www.github.com/kamranahmedse/developer-roadmap/tree/master/img%2Fdevops.png

Topics: Reverse Engineering, Static Analysis #reversing

Since static analysis is often complicated in middle or bigger sized programs, it's important to exclude the standard functions of the scope of analysis, FLIRT is a solution made by Hex Rays in order to identify these standard functions and libraries used by an executable, this way the static process becomes easier and faster.

https://hex-rays.com/products/ida/tech/flirt/in_depth/