Recent content on bordplate.no
For the Ratchet & Clank (2002) multiplayer mod project, I've always wanted to somehow fully sync the world state between the clients, but it's hard to do in a way that's stable and reliable. Adapting single-player games for multiplayer is always difficult because of core assumptions made during development that are hard to unravel when adding extra players. Enemies are hardcoded to look for…
For the multiplayer mod I've made for Ratchet & Clank (2002), I wanted to recreate the behavior that the vanilla in-game elevators have. Basically, I wanted to have a platform the player can stand on they move with. The game doesn't move the player with mobys (Insomniac's name for "game objects") without extra work and configuration. It took me far too long to figure out how to properly configure…
A Buffer Overflow is a bug class in a program typically written in a memory unsafe language like C or C++. Buffer Overflow bugs from user-input can often allow someone to overwrite some data in memory they weren't supposed to. Before we dive into how to exploit Buffer Overflow bugs, we will do a quick introduction to Assembly. Assembly is a language that describes raw machine code. Assembly is the…
A couple of months ago, I found a DACL permissions overwrite vulnerability in the Check Point Endpoint Security VPN client. This vulnerability allows any user on a Windows system to set permissions for any file to Full Control for the Authenticated Users security group (the only limitation being that the SYSTEM user needs to have access to edit permissions on the file, so some system files owned…
Recently, I enountered a vulnerability in the CrashPlan clients for Windows, Mac (and possibly Linux, but I didn't bother to test it there) that allows for privilege escalation. The vulnerability is in the handling of Proxy Auto-Config (PAC) files. PAC-files are used for automatic proxy-configuration and is widely deployed in various software and operating systems. In short, PAC-files are…
Prerequisites Windbg A burning wish to debug a service at startup-time instead of just attaching to the process after it has started. This guide is mainly for Windows 10. Same or very similar procedure works for pretty much all major versions (at least from XP and up) of Windows, but the gflags application might look a bit different for some versions of Windows. Set global flags Open gflags.exe at…
Return-oriented Programming (ROP) is a binary exploitation technique that leverages existing code in the binary in order to execute attacker code. To follow this post it might be useful to have at least a little understanding of x86 assembly. As most modern computers running on Intel chips are 64-bit, this guide is also using 64-bits. Note however, that because of limitations of JavaScript and the…
I'm contemplating adding simple Lua-scripting to an export-module in software I'm developing, but it needs to be secure. The Lua module for PHP seems to assume the Lua code is coming from a trusted space, not user input. I explored a bunch of different ways to properly secure it and I believe I landed on a satisfying solution in the end. Running Lua without any modifications Purely running Lua…
We recently had a 3rd party come in and create a service for us that was tied up to a small set of different systems. The system had a public facing part for our customers and it quickly became a crucial system to keep online. During a quick check of their work it was discovered that a critical SQL injection bug had found a place in there. Keeping a system running with SQL injection that could…
An easy and powerful way to gain SYSTEM -privileges can be to abuse a service in Windows. We all know they run as the user SYSTEM , so gaining code execution in any one of them can gain you a "root shell" on the system. Sometimes, a developer or some intern who creates the installer package for some software, will accidentally give Everyone full access to the service executable. Overwrite the file…
For a long time I've been casually wondering about how ROP really works and what it is. I understand buffer overflows and shellcode in stacks and heaps, but a simple explanation to ROP was apparently hard to find. I was reading about something else when it hit me how this concept works, but further reading was still a bit hazy to me. While it is a powerful way to avoid Data Execution Prevention…