Posts

What is a canary, how does it work, and what does that mean if I want to write a modern exploit.

Image
Canaries were  once regularly used  in  coal mining as an early warning system . Toxic gases such as carbon monoxide or asphyxiant gases such as methane  in the mine  would kill the bird before affecting the  miners . Signs of distress from the bird indicated  to  the  miners  that conditions  were  unsafe . Let's start with some history Oh the good old days. I remember a time when hackthissite.org , and  Smash The Stack  were fresh, and BOF's were often as easy as shoving your shellcode where the buffer was supposed to be and overwriting the return pointer with where that buffer was... Then they had to go and ruin the fun by widely adopting ASLR (Address Space Layout Randomization), DEP (Data execution protection), and  canaries  (stack cookies). Now in these dark times not only do we have to ROP with return to libc, we have to chain that with a memory leak vulnerability if we have any hope of  smashing the stack. While I plan to do posts soon covering all of these exciti

Better visualization of data formats using assembly POC's to better implement them in C

Image
Are you tired of staring at hex dumps, white papers and manual pages? Want to feel like you truly know how a data type like a file format, or a disk partition LOOKS like. Well I can't help you with the manual pages and white papers, ( https://staff.washington.edu/dittrich/misc/fatgen103.pdf , http://www.eit.lth.se/fileadmin/eit/courses/eitn50/Projekt1/FAT12Description.pdf ) but here is a great example of implementing a fat12 floppy image in assembly. ;//////////////////////////////////////////////////////////////////////////////// ;// THE SCOTCH-WARE LICENSE (Revision 0): ;// <aaronryool@gmail.com> wrote this file. As long as you retain this notice you ;// can do whatever you want with this stuff. If we meet some day, and you think ;// this stuff is worth it, you can buy me a shot of scotch in return ;//////////////////////////////////////////////////////////////////////////////// ; This assembles to a floppy disk image [bits 16] [org 0x7C00] ;;;;;;;;;;;;;;;;;

Flat Memory Manager example

//////////////////////////////////////////////////////////////////////////////// // THE SCOTCH-WARE LICENSE (Revision 0): // <aaronryool/gmail.com> wrote this file. As long as you retain this notice you // can do whatever you want with this stuff. If we meet some day, and you think // this stuff is worth it, you can buy me a shot of scotch in return //////////////////////////////////////////////////////////////////////////////// # include < stdlib.h > # include < stdio.h > # include < multiboot.h > /***************************************** Flat memory manager from scratch :D *****************************************/ uint32_t MEM_POOL = 0 ; uint32_t MEM_POOL_END = 0 ; uint32_t MEM_POOL_SIZE = 0 ; typedef struct mem_entry { bool free ; uint32_t prev ; uint32_t ptr ; uint32_t next ; } mem_entry_t ; void mem_initialize ( multiboot_uint32_t magic , multiboot_info_t * mbi ) { multiboot_memory_map_t * mmap ; MEM_POOL_