31–40 of 111 posts
This is proper programming. None of this namby-pamby web scripting that passes for development these days.
So many programming jobs feel like busy work with no interesting problems nowadays, I often wonder if it's only gonna get worse with time.
Earlier quoted context omitted.
Well, once the bug is identified, yes. I wonder how do you find a bug like that, I guess you keep reading the disassembly of the trapping code until you find the problem. I don't think he could have used QEMU or some other form of debugging.
He does mention a bit more in a hidden comment: "NTOSKRNL.EXE + debug symbols + IDA helped me understand how the remote break-in is supposed to work. I knew that something in the remote break-in code path before the first debug packet is sent is going to reboot my machine. So I patched "JMP SHORT $" instructions into the relevant code-path. If I placed it before the crash point, the machine hangs. If I placed it afte…
I wonder if patching memory worked in the debugger, if not this would have to be done by manually editing the kernel file with IDA or something, and rebooting the machine. But in either case this is a good way to find the problem.
Earlier quoted context omitted.
Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…
Ping of death isn't just something for the old days: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
"... to trigger the vulnerable code path, an application on the target must be bound to a raw socket."
Isn't that unlikely unless the victim runs a network capture tool like Wireshark or similar?
Earlier quoted context omitted.
You might have forgotten them, but there were also books printed on paper.
H4x0r doesn't need book. H4x0r try 4nd err0r. Books were just knowledge. Debugging was skill. At certain point in knowledge-gain, you develop a good skill and after that point, you don't need books anymore. Maybe from time to time. I still have a suse6 printed manual.. I can't see it in the cellar, but It've been HUUGE
Don't forget to read the how buried in the hidden comments at the end!
IMO they should just add paging to it than hiding if the space is the concern.
I build a port check way back to determine if services are up. It crashed half the company by simply opening a few tcp ports to the machines. Ridiculous days :)
Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…
I build a port check way back to determine if services are up. It crashed half the company by simply opening a few tcp ports to the machines. Ridiculous days :)
Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…
I build a port check way back to determine if services are up. It crashed half the company by simply opening a few tcp ports to the machines. Ridiculous days :)
Remember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is sup…
1: https://en.wikipedia.org/wiki/Back_Orifice
2: https://techcrunch.com/2023/09/27/russian-zero-day-seller-of...