Re: Blind Remote Buffer Overflow

[wilder () HQ ALERT SK (Pavol Luptak)]

On Tue, May 02, 2000 at 08:24:46AM +0200, matej wrote:
> On Mon, May 01, 2000 at 05:59:05PM -0700, Blue Boar wrote:
> > > Some people have mentioned some ways to try to find a vulnerability
> > > remotely. Now, lets say you using some way have determined you can rewrite
> > > EIP, PC (or whatever it's called on your architecture). What now to do to
> > > detect operating system and architecture?
> >
> > In many cases, you will have more than one shot at trying your
> > buffer overflow.  One possibility is just trying them all.  If the
> > service doesn't auto-restart, then try each arch a week apart, so the
> > admin doesn't get suspicious.
> ...or try in one shot 3 bufflows for 3 hw platforms :-)
>
> > > a number of variants (as an example: Linux/i386, Linux/sparc,
> > > Windows/i386) which all of them does something like "echo 3 | mail
> > > badguy () test com". Depending upon what mail you actually get back, you know
> > > that the architecture is at least quite compatible with the envioronents
> > > that returns an answer.
> >
> > Who knows their x86 and Sparc opcodes really well?
>
> on x86 I can find couple of such instructions - ranging from completely
> NOP-like, to some form of semi-NOPs. just think of 'mov eax, eax' or 'jmp
> $+length_of_instr', or take some of the semi-NOPs - 'and eax, eax' (changes
> flags, as well as 'or' etc), and think about some instruction pairs - like
> 'cmc; cmc' (complement cary, twice;-)

//offtopic:
Some time ago I had a discussion with my friend about _possibility_ to
make the pure ASCII shellcode (intel 80x86). Hovewer, the important
instructions (much of relative jumps, calls, int) are out of the range
of displayable ASCII characters. I hope it's not very difficult to program
instruction encoder/decoder (casual situation on 64-bit platforms with
many zeros in immediate adressing mode :) Four or five years ago I seen
on DOS platform the interesting encoder for MZ executable files to 
_runnable_ ASCII file (I don't remember name of this tool).

Regards,

W.

-- 
_______________________________________________________________________
[wilder () hq alert sk] [http://hq.alert.sk/~wilder] [talker: ttt.sk 5678] 


<HR NOSHADE>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>