Posts

Featured Post

uTorrent CVE-2020-8437 Vulnerability And Exploit Overview

-
Image
The world’s most popular torrent client, uTorrent, contained a security vulnerability — later to be called CVE-2020-8437— that could be exploited by a remote attacker to crash and corrupt any uTorrent instance connected to the internet. As white-hat hackers, my friend (who wishes to remain anonymous) and I reported this vulnerability as soon as we found it and it was quickly fixed. Now, after ample time has been given for users to update, it’s safe to disclose an overview of the vulnerability and how to exploit it.
Torrent Protocol - What You Need To KnowTorrent downloads utilize simultaneous connections to multiple peers (other people downloading the same file), creating a decentralized download network that benefits the collective peer group. Each peer can upload and download data to and from any other peer, eliminating any single point of failure or bandwidth bottleneck, resulting in a faster and more stable download for all peers.
Peers communicate with each other using the BitTorr…
Post a Comment
Read more

How I Compile Reverse Engineering Exercises For Maximum Learning And Minimum Noise

-
Image
Imagine if your first reverse engineering exercise was to reconstruct an encrypted IAT – if you don’t fully know what that means, that’s the point: beginner reverse engineering exercises should be clear (and fun)!
Anything that can throw off the analysis of a reverse engineer, such as optimized inlined functions, shouldn’t be in beginner exercises. Secondly, I would like my exercises to run on as students' computers as possible. These are the goals I strive for when creating CyberQueens exercises, and here is how I configure my compiler to meet those goals.

Ensuring A Clear And Concise Executable is Compiled To prevent the compiler from adding any unintended opcodes or logic, which could confuse aspiring reverse engineers, set all of the following build properties:
To disable uninitialized memory checks (and other debugging) checks from being automatically compiled into the code, set the compilation target to Release. This can be done from VS’s main page, as seen in Figure 1.

To o…
Post a Comment
Read more

Windows Source Code Leaks & A Story Of Lost Source Code

-
Image
Disclaimer: The information presented in this blog post is for educational purposes only.

When researching or just tinkering with Windows and Microsoft executables, having the source code is a great advantage. This short article is a collection of links to Windows and Microsoft code.
Leaked Windows Source Code Links to leaked Windows source files:
Windows NT4 https://github.com/ZoloZiak/WinNT4Windows 2000 https://github.com/pustladi/Windows-2000Windows Research Kit https://github.com/Zer0Mem0ry/ntoskrnl Links aggregated from BlueHatIL talk “Fuzzing on the windshield”
Official Microsoft Published Source Code Microsoft has recently become significantly more Open Source oriented, and has even started actively developing Open Source projects and publishing some of its own code.
Links to published Microsoft code:
Microsoft .NET source https://referencesource.microsoft.com/Microsoft’s Github https://github.com/Microsoft Other Resources Other resources to help you with your Windows and Microso…
Post a Comment
Read more

Guy's 30 Reverse Engineering Tips & Tricks

-
Image
Good morning lovely people!

During April I challenged myself to tweet 1 reverse engineering tip every day. For your viewing pleasure, here I aggregated all 30 tips.

Be sure to follow me @va_start for my latest tweets and more reverse engineering extravaganza.
Leave a comment on this post or tag me on Twitter - I reply pretty quickly :)

If the tweets aren't displayed properly (for example if there are no pictures), temporarily turn off tracker protection, which blocks loading the required resources from twitter
Tips & Tricks Tip 1 *Reverse Engineering Tip 1/30*
long branch-less functions w/many xors & rols are usually hash functions. IDA view of MD5 func:#BinReversingTipspic.twitter.com/cLSGfxNupK — Guy🏂 (@va_start) April 1, 2020 Tip 2 -Reversing Tip 2/30-
Building on the last tip, after finding a hash function, google its constant to identify the exact hash algorithm. #BinReversingTipspic.twitter.com/MJJIBY9pde — Guy🏂 (@va_start) April 2, 2020 Tip 3 -Reversing Tip 3/30-
…
Post a Comment
Read more

Calling Arbitrary Functions In EXEs: Performing Calls to EXE Functions Like DLL Exports

-
Image
Motivation When reversing or fuzzing an executable, being able to run an arbitrary function with controlled data is extremely helpful. Through iteratively playing with the function's parameters and examining the output, we can better understand the function's logic.
Background A dll (Dynamic Linked Library) with our target function would allow us to conveniently review and test the function as we wish. The only problem is that usually the function we want to examine resides in an exe, not a dll. Converting¹ an exe to a dll is a solvable challenge. After all, both an exe and a dll share the same PE (Portable Executable) file format.  So let's explore, how can we convert¹ an exe to a dll?
Spoiler: there are a few more steps than just changing the extension 😉
¹ "convert to DLL" = fundamentally behave like a DLL.

I'll use this exe created from the following code and target the decode_string function for demonstration purposes throughout this post.

Challenges Th…
11 comments
Read more

Zero Day Discovery and Infosec Success Celebrations

-
Image
With the world in quarantine and isolation because of COVID-19, I decided to publish a blog post reminding us of more cheerful times.

Take yourself back to the last time you spent weeks hammering away at a seemingly impossible challenge, and quickly fast-forward to when you finished that problem.

Do you remember your intense excitement and satisfaction? How did you celebrate your success?
I asked security researchers how they celebrate finding 0days, APTs in the wild, new malware, and other big successes.  Here are the results. Thomas Roth @StackSmashingFounder of leveldown, co-founder of keylabsio
"I once had a celebratory cake for an 0day" "otherwise I tend to [celebrate] with a nice beer in the evening :)"
Ashley Shen @ashley_shen_920Security Engineer at Google Threat Analysis Group
"I usually celebrate with picking a restaurant from my do-eat list and have a good meal with friends :)"
Yahav Azran @Yahav_AzranIndependent Security Vulnerability Resear…
Post a Comment
Read more

Integer Overflow Reference: Min & Max Values

-
Image
A reference for when working with integers, and looking for integer overflows and underflows.

When an integer type, such as an int or unsigned short, overflows (the variable is given a value greater than the maximum value it can hold), the integer "wraps around" and becomes the minimum value the type can store.
Similarly, when an integer type underflows (the variable is given a value smaller than the maximum value it can hold), the integer "wraps around" and becomes the maximum value the type can store.

Use the chart below to find the minimum and maximum values each type can hold.
Size Chart
TypeSize In BytesMinimum ValueMaximum Valuechar1 byte-128+127unsigned char1 byte0+255short2 bytes-32,768+32,767unsigned short2 bytes0+65,535int4 bytes-2,147,483,648+2,147,483,647long4 bytes-2,147,483,648+2,147,483,647unsigned int4 bytes0+4,294,967,295unsigned long4 bytes0+4,294,967,295long long8 bytes-9,223,372,036,854,775,808+9,223,372,036,854,775,807unsigned long long8 bytes0…
Post a Comment
Read more