akde/infosec

Click Here

  • The Windows Portable Executeable (EXE)

    See also the Bina­ry analy­sis post Win­dows uses as for­mat for the exe­cute­able files the PE Portable Exe­cute­able for­mat. This is a bina­ry for­mat which can be used as a Eng­lish (light ‘xkcd’) — Imgur has a graph­i­cal overview.

  • Basic x86/x64 assembly registers and commands

    Registers General purpose registers Reg­is­ter x86 Reg­is­ter x64 Name Descrip­tion EAX RAX Accu­mu­la­tor For results of cal­cu­la­tions and return codes EBX RBX Base reg­is­ter Gen­er­al purpose ECX RCX Count reg­is­ter For num­ber of iter­a­tions, often used for loops EDX RDX Data reg­is­ter For data of cal­cu­la­tions or a point­er to large data ESI RSI Source index Point­er to a…

  • Immunity Debugger

    Keyboard functions CTRL+S Find sequence of commands SHIFT+F9 Pass exception

  • ASLR Address Space Layout Randomization

    ASLR Address Space Lay­out Ran­dom­iza­tion is a tech­nique which ran­dom­izes address­es in the stack and heap. If address­es of func­tions are ran­dom­ized (e.g. from shared libraries like libc), then an attack­er can­not use a pre­de­fined exploit with hard-cod­ed addresses. Linux Dis­able ASLR: echo 0 > /proc/sys/kernel/randomize_va_space Enable ASLR: echo 2 > /proc/sys/kernel/randomize_va_space In GDB, ASLR is…

  • Stack protection

    The stack can be pro­tect­ed against buffer overflows. Stack protection with canaries Like in a coal mine, a canary can pro­vide an indi­ca­tion if some­thing goes wrong. Here, a canary is a defined val­ues which is added between the buffer (where an attack­er will start writ­ing the pay­load) and the SFP Stack Frame Point­er and…

  • ROP Return-oriented programming

    On the return-to-libc post, we described the process of inject­ing a sys­tem call with para­me­ters via envi­ron­ment vari­ables to start a new process. But this requires to exe­cute anoth­er pro­gram (which maybe no avail­able on the target). Instead of call­ing sys­tem we can call oth­er instruc­tions from some­where in the mem­o­ry. But it would be…

  • ret2lib

    Assume that we detect­ed a buffer over­flow vul­ner­a­bil­i­ty, but we don’t have enough space on the stack for our shellcode or the bina­ry’s stack is marked as not-exe­cutable (DEP enabled). Then we can try to call a com­mon library which is also loaded (wie the plt). Walkthrough of a ret2lib attack Before we start, dis­able ASLR as…

  • gdb

    Gen­er­al pur­pose debugger. Hint: gbd dis­ables ASRL by default.  Commands Gen­er­al set disassembly-flavor intel/att Process han­dling run runs a pro­gramm with­out parameters run `python -c 'print("a")'‘ runs a pro­gram with a parameter run < <(python -c 'print("a")') runs a pro­gram and enters the giv­en string into STDIN c continue si step one instruction Break­points break $f…

  • Shellcode

    See also the Buffer Over­flow post Execute shellcode Sce­nario: You have shell­code. You want to run it to ana­lyze it in a debugger. On Windows Add the shell­code after the break­point with i686-w64-mingw32-cc s.c -o s.exex86_64-w64-mingw32-cc s.c -o s.exe and run it in a debugger. On Linux Add the shell­code after the break­point with gcc [-m32] s.c…

  • Modifying PE files

    PE Portable Exe­cu­tung or DLL Dynam­ic Link­ing Libraries can be edit­ed to remove or add capa­bil­i­ties or own code. Read and modify a PE file The fol­low­ing Python3 script reads a file, prints out a head­er, mod­i­fied it to remove ASLR and write a new file with­out this flag. f = pefile.PE('filename.exe') print(hex(f.OPTIONAL_HEADER.DllCharacteristics)) // print as hex to…

  • Linux Binary protection

    Simple protection A pack­er can be used to “opti­mize” / “com­press” a bina­ry which on the oth­er hand also makes it hard­er to debug. A pack­er removes une­ses­sary infor­ma­tion and the mini­fi­ca­tion can lead also to obfus­ca­tion to some extend. A stan­dard tool is UPX. Min­i­mize a bina­ry with upx -9 bin.elf. Advanced protection Obfus­ca­tion…

  • Hardening ELF files

    This post describes meth­ods to transform/obfuscate/minimize Lin­ux ELF files. sstrip The sec­tions are used for debug­ging and not nec­ces­sary for a pro­gram’s exe­cu­tion. The com­mand sstrip removes all sec­tions from the file. sstrip bin.elf After the com­mand, it can be ver­i­fied with readelf --sections bin.elf that there are not sec­tions are in the file.

  • The Linux Executable and Linking Format (ELF)

    Concepts A seg­ment is a piece of a infor­ma­tion which is mapped into the mem­o­ry (of a process). A ELF bina­ry can have zero or mul­ti­ple seg­ments. It defines also where the OS should put it into the mem­o­ry. Each seg­ment has a Pro­gram Head­er which describes the sec­tions within. A sec­tion is a dis­tinc­tive…

  • Binary patching

    Overwrite functions with LD_PRELOAD The LD_PRELOAD envi­ron­ment vari­able allows to inject a library which is loaded before the pro­gram libraries. This means that it is pos­si­ble to redi­rect the exe­cu­tion flow to an inject­ed func­tion via an own library object.

  • Reverse Engineering tools for the Linux ELF

    This page col­lects tools for the Lin­ux Exe­cutable and Link­ing For­mat (ELF) with some basic commands. checksec.sh Shows which exploits mit­i­ga­tions a pro­gram has. (Source) ./checksec.sh --file file.elf GDB See the gdb post. Objdump Obj­dump shows infor­ma­tion about a bina­ry (object) file. Show the assem­ble code from a ELF file. objdump -d bin.elf Show all sym­bols (e.g.…

  • radare2

    Address­es with­in the mem­o­ry are ref­er­enced with @ General Start­ing with direct­ly analysing all ref­er­enced code. r2 -A $file ... e emu.str = true Start­ing with enabled debug­ger (only when I want to exe­cute the program) r2 -AA -e dbg.follow.child=true -e dbg.forks=true -d $file ... e emu.str = true Fork para­me­ter: If the process forks, the debug­ger halts Type…

  • Analyzing data / forensic

    General tools Imaging tools dd, of course. Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped. dd if=/dev/sda of=/external/file.md5 bs=512 ewfacquire sudo ewfac­quire /dev/sda Advan­tages: aff4 advanced forensic…

  • Decompiler / Disassembler

    Check also IDEs like Intel­liJ, Visu­al Stu­dio, Eclipse, …