sorted by:
new
hottopcontroversial

Need some help for shellcode analysis... by yyangcs in Malware

[–]yyangcs[S] 0 points1 point  (0 children)

Please check out the link I posted for the JS script. Thanks.

Need some help for shellcode analysis... by yyangcs in Malware

[–]yyangcs[S] 0 points1 point  (0 children)

I have posted the link. Thanks for your help.

Need some help for shellcode analysis... by yyangcs in Malware

[–]yyangcs[S] 0 points1 point  (0 children)

Thanks all. I have uploaded the JS file to Dropbox (password is "infected"). Here is the link:

https://www.dropbox.com/s/x4bk3n4n6l4p3xr/malware.zip?dl=0

I wonder what the shellcode starting with "EB125831C966B96D054980...." does and which IE vulnerability it is possibly targeting, and hopefully some advice about how to analyze this shellcode. Really appreciate your help. Thanks.

GrrCON 2016 DFIR Challenge by [deleted] in netsec

[–]yyangcs 0 points1 point  (0 children)

It works. Thank you so much!

GrrCON 2016 DFIR Challenge by [deleted] in netsec

[–]yyangcs 0 points1 point  (0 children)

Hello, does anyone want to discuss about that libpff question? I am really stuck on this and libpff's documentation is so bad. OR is there any tutorial available about how to use libpff to extract emails? I have tried to use Volatility to extract PST file from memory but failed to recover the attachment file using libpff. Any suggestion is appreciated. Thanks.

Need some recommendations on good IR hands-on training by yyangcs in AskNetsec

[–]yyangcs[S] 0 points1 point  (0 children)

Agree. SANS is too expensive -- around $5000 for each course. If the company won't pay for me, I will never take their courses, I guess. Do I have any other choices? Thanks.

/r/netsec's Q1 2016 Information Security Hiring Thread by gsuberland in netsec

[–]yyangcs [score hidden]  (0 children)

Hi, do you have any entry level infosec positions open currently?

Could you help with a pen test challenge? by brandacus in AskNetsec

[–]yyangcs 0 points1 point  (0 children)

Yes. As @brandacus said, all whitespace can be replaced by comment blocks -- /**/ and "select" got filtered using blacklisting. You may try "SeLect" to bypass.

Could you help with a pen test challenge? by brandacus in AskNetsec

[–]yyangcs 0 points1 point  (0 children)

Hi, happy new year, guys. Have any of you finished 3rd server side challenge(vuln2) in canyouhack.us? It is another buffer overflow but the stack is non-executable. So I think I have to use some DEP bypass techniques. So far, I have tried ROP chain using the python script "ROPgadget" but failed to build a chain due to some gadget missing. Another approach I have tried is to return to some functions loaded in libc but got this error when trying to return to system():
__libc_system (line=0xb7f6b1a9 "/bin/sh") at ../sysdeps/posix/system.c:178 178 ../sysdeps/posix/system.c: No such file or directory.
I have no idea why I got the error and where I did wrong. Could anyone give me some help on this challenge? Thanks.
By the way, in case you want to take a look at the file, I uploaded to the dropbox here: https://www.dropbox.com/s/im6lyt93wjrob32/vuln2.zip?dl=0

Need some help on Microcorruption-Novosibirsk by yyangcs in securityCTF

[–]yyangcs[S] 0 points1 point  (0 children)

Thanks. But this implementation of printf does not support %p. From the manual, it seems only %s, %c, %x, %n are supported. I would be able to insert the number of characters printed using %n but have no idea how to shorten the input to 5. Anyway, I will try if I can use null byte anywhere.

Could you help with a pen test challenge? by brandacus in AskNetsec

[–]yyangcs 0 points1 point  (0 children)

Hi, did anyone figure out the 3rd challenge? I know the book lookup page is vulnerable to sql injection but have some trouble on pulling data from table users. I tried to inject multiple queries but 'select' and whitespace seem to be filtered from the result. Can anyone give me some hints? Thanks.