Recent content on lolcads tech blog
Exploits built around heap-based memory corruptions will never be perfectly reliable. There are multiple factors contributing to this, one being that the heap is shared among all tasks (user processes and kernel threads) running on a machine. Thus, the task running the exploit cannot exercise perfect control over it. Much has already been written about the art of shaping the kernel heap and…
Introduction Existing network fuzzing solutions struggle on all fronts. Speed is a big problem because they use either real network connections or emulation/virtualization for snapshot-based fuzzing, both of which have a huge overhead. And, they struggle with deeply exploring the target since most of the tools out there are built on top of AFL. For our vulnerability research, we built a…
Introduction In the face of increasing amounts of cyber threats, organizations employ security information and event management (SIEM) systems as a way to collect and analyze information at a central place to detect and counteract against potential cyberattacks. One common way to detect malicious behavior using this information are Sigma rules and the corresponding Sigma detection format. Given…
Firmware reverse engineering comes with some unique challenges compared to the reversing of programs that run in the user space of some mainstream operating system. You will encounter one of them before Ghidra’s Code Browser even opens. Let’s illustrate it at a concrete example: I recently got myself some old Cisco devices off eBay as I was curious to have a look at their proprietary…
This post is about some work that I did on automatic profile generation for memory forensics of Linux systems. To be upfront about it: This work is somewhat half-finished – it already does something quite useful, but it could do a lot more, and it has not been evaluated thoroughly enough to be considered “production ready”. The reason I decided to publish it anyway is that I…
Cyber Adversary Emulation Cyber adversary emulation is an assessment method where tactis, techniques, and procedures (TTPs) of real-world attackers are used to test the security controls of a system. It helps to understand how an attacker might penetrate defenses, to evaluate installed security mechanisms and to improve the security posture by addressing identified weaknesses. Furthermore, it…
Bytecode Reuse Attack (Part 4) As last blog post on bytecode - based exploitation on Android, the next step following bytecode injection is discussed, namely: bytecode reuse . To answer the question about why an attacker needs bytecode reuse, although there already is bytecode injection, remember the arms race in (binary) exploitation. In a nutshell, a new exploitation technique triggers a…
Bytecode Injection (Part 3) With all the basics out of the way, this blog post shows the first bytecode - based exploitation technique on Android: bytecode injection ! This opens the door to many interesting exploits, where injected bytecode can function as a one - in - all solution or an intermediate stage. In order to fully understand this technique, it is recommended to read the introductory…
Fundamentals for Bytecode Exploitation (Part 2) Exploiting a vulnerability always requires a certain knowledge about the operating system, including how processes are launched, what libraries are used and how control - flow “works”. While the latter could be considered coming from the architecture, this is not always the case on Android, because the Android RunTime (ART) provides ways…
Introduction to Android Bytecode Exploitation (Part 1) Android resides among the most popular operating systems for mobile devices, which causes Android to also be among the most popular targets for exploitation. While Android is frequently updated to fix the latest CVEs, malicious actors already search for new vulnerabilities, as gaining control over millions of computationally powerful devices…
Attempting Timing Attacks against Scudo In this second blog post we will take a different approach for attacking Scudo , i.e. we will try to the measure execution times for calls to malloc and hope to be able to derive a portion of the internal state of the allocator (i.e. perform side channel attacks). The version of Scudo considered in this blog post is 161cca266a9d0b6deb5f1fd2de8ad543649a7fa1 .…
Binary Exploitation for Scudo Heap Allocator on Android In this series of blog posts, we will investigate how an attacker may leverage the internals of the Scudo Allocator in order to obtain an advantage on an Android OS. To that end, necessary prerequisites will be discussed and analysed for their likelihood. The focus will primarily be on malloc and free , although realloc and other functions…
Exploitation of Use - After - Free Modules In this post we will be discussing how to exploit a Use - After - Free bug in both UseAfterFreeExecModule and UseAfterFreeWriteModule . As the names of the modules suggest, they differ in terms of the impact the bug has. To that end, in UseAfterFreeExecModule we will be able to control a function pointer, whereas in UseAfterFreeWriteModule we are given a…
Exploitation of EasyStackBufferOverflowModule This article describes exploitation of the EasyStackBufferOverflowModule . During exploitation, various Android - specific caveats are discussed. Assumptions We will assume that we have successfully grabbed a copy of the .apk file of damnvulnerableapp . Also, we will not discuss how to unpack an .apk file, but rather assume that we have access to…
Android Binary Exploitation In this post, we will examine security mechanisms that Android 12 employs in order to make binary exploitation a bit harder. Also, we will discuss how to get to certain information like shared - object files that are necessary for successful exploitation. The latter will be generalized to getting limited source code access to an app given a corresponding .apk file.…
PowerView is evil, but PowerVi and ew are legit, right? - Missing signature-based detections due to PowerShell Script Block Logging Fragmentation Update [15/08/2024]: In a short discussion on X the source code of the PowerShell Script Block Fragmentation was linked . Looking at the comment in the code, it becomes clear that the size of a script block fragment is intentionally set to a random value…
BPF Memory Forensics with Volatility 3 Introduction and Motivation Have you ever wondered how an eBPF rootkit looks like? Well, here’s one, have a good look: Upon receiving a command and control (C2) request, this specimen can execute arbitrary commands on the infected machine, exfiltrate sensitive files, perform passive and active network discovery scans (like nmap ), or provide a privilege…
Investigating Binary Exploitation for JNI on Android This post aims to be an introduction into a blog series about binary exploitation on Android. It tries to describe how the environment that runs vulnerable modules is set up and how the damnvulnerableapp supports the process of binary exploitation on Android. Warning The following app is intended to be vulnerable to specific attacks and can…
Encryption - a curse and a blessing at the same time Digital communication in today’s world has a particularly high status in our society. Financial transactions are conducted via online banking, private communication is increasingly limited to digital messenger services, and even health data is experiencing a shift to digital form. Due to the growth of such sensitive digital data, the need…
Make Frida Great Again In order to analyse binaries on e.g. Android systems, one is offered a plethora of tools to use to figure out what a binary is doing, whether it is malicious or just buggy. One way to figure out the behaviour of a binary is to utilise the strength of dynamic analysis. Under linux, i.e. Android in particular, Frida is a tool that is used for automated instrumentation of…
Intro This blog post reflects our exploration of the Dirty Pipe Vulnerability in the Linux kernel. The bug was discovered by Max Kellermann and described here . If you haven’t read the original publication yet, we’d suggest that you read it first (maybe also twice ;)). While Kellermann’s post is a great resource that contains all the relevant information to understand the bug, it…
In this blog post I will go in depth into the inner workings of CVE-2021-43247 , which was fixed on the 14th of December 2021. This bug was classified as “Windows TCP/IP Driver Elevation of Privilege Vulnerability”. The vulnerability itself was probably dormant for a long time, but became exploitable when the AF_UNIX address family was first introduced in 2019. I will also take this as…
Installing new .NET versions on a Windows 7 VM In this post, I will explain how to install .NET Framework 4.8 on a Windows 7 VM. Motivation Virtual Machines running Microsoft Windows are frequently used for dynamic analysis of Windows executables. Windows 7 is still used for analysis VM, although it is no longer supported by Microsoft and ships with an outdated .NET version. If a sample requires a…
Fuzzing Network Applications with AFL and libdesock Fuzzing network servers with AFL is challenging since AFL provides its input via stdin or command line arguments while servers get their input over network connections. As the popularity of AFL grew, many attempts have been made of fuzzing popular servers like apache and nginx using different techniques and hacky workarounds. However an…
Written in Go, Hugo is an open source static site generator available under the Apache Licence 2.0. Hugo supports TOML, YAML and JSON data file types, Markdown and HTML content files and uses shortcodes to add rich content. Other notable features are taxonomies, multilingual mode, image processing, custom output formats, HTML/CSS/JS minification and support for Sass SCSS workflows. Hugo makes use…
This is a tech blog of loosly coupled individuals that like to sometimes play CTFs but mostly just have fun with deeply technical topics such as (malware) reverse engineering, fuzzing, vulnerability research, forensics, … We hope you will find some valuable information on our site :) Get in touch if you want via Contact .
You can reach us at: Feel free to use our PGP key (fingerprint: CCD8 D75E 9A10 6BF4 3668 AB99 7E64 EF83 D585 CECA ) You can also report any issues (dead links, problems, …) via GitHub: https://github.com/lolcads/lolcads.github.io/issues