Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker - PowerPoint PPT Presentation

Sep 12, 2023 •309 likes •530 views

1 Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia No class on Oct 28 If you are interested in, check out EKOPARTY CTF 2016 Due: Lab08 is out and its due on Nov 3 (two weeks!)

1 Lec08: Remote Exploit Taesoo Kim
2 Scoreboard
3 NSA Codebreaker Challenges
4 Administrivia • No class on Oct 28 • If you are interested in, check out EKOPARTY CTF 2016 • Due: Lab08 is out and its due on Nov 3 (two weeks!) • NSA Codebreaker Challenge → Due: Dec 1
5 Lab06: ROP
6 Discussion: Lab07 • What's the most "annoying" bug or challenge? • What's the most "interesting" bug or challenge? • So, ROP is too powerful?
7 Discussion: pop • What was the problem? • How did you solve?
8 Discussion: pop
9 Discussion: puzzle • What was the problem? • How did you solve?
10 Discussion: upto-retaddr • How much did you try? • Where did you stuck?
11 Discussion: find-gadget • What was the problem? • How did you solve?
12 Discussion: sprintf • How much did you try? • Where did you stuck?
13 Discussion: rop-sorting • How much did you try? • Where did you stuck?
14 Discussion: inc1 • How much did you try? • Where did you stuck?
15 Discussion: fmtstr-relro • How much did you try? • Where did you stuck?
16 Take-outs from ROP • DEP/ASLR are not perfect solutions • DEP: ret-to-lib, ROP • ASLR: code leakage • What about stack canary? (what if we placed it together?) • Lots of known defenses (did you attend today's talk?)
17 Today's Tutorial • In-class tutorial: • Socket programming in Python • Your first remote exploit!
18 Remote Challenges • Use techniques learned from Lab01-Lab07 • But targeting the remote server (e.g., online services)
19 DEMO: about how remote challenges work • nc • exploit.py
20 In-class Tutorial • Step1: nc • Step2: brute force attack • Step3: guessing attack $ git git@clone tc.gtisc.gatech.edu:seclab-pub cs6265 or $ git pull $ cd cs6265/lab08 $ ./init.sh $ cd tut $ cat README
Lec08: Remote Exploit Taesoo Kim

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 Administrivia In-class CTF on Nov 16-17

1 Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 Administrivia In-class CTF on Nov 16-17 (24 hours)! Due: form your team and submit your CTF challenge by Nov 13! Due: Lab07 is out and its due on Nov 2 (two weeks!) NSA

596 views • 33 slides

OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June

OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June 30, 2007 Mbuf buffer overflow Buffer overflow Researching the OpenBSD 008: RELIABILITY FIX a new vulnerability was found: The m dup1()

587 views • 23 slides

Zero Exploit Tolerance By Jamie Butler and Cody Pierce Confidential and Proprietary Who we are

Zero Exploit Tolerance By Jamie Butler and Cody Pierce Confidential and Proprietary Who we are The exploit problem Modern software vulnerabilities Hardware-assisted exploit Agenda prevention Prior research

674 views • 45 slides

aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development for Dummies

Ein Blick in die Hexenkche der Exploit Entwickler aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 2 27/03/2018 // Exploit Development for Dummies

613 views • 48 slides

Q: Exploit Hardening Made Easy Edward J. Schwartz, Thanassis Avgerinos, and David Brumley

Q: Exploit Hardening Made Easy Edward J. Schwartz, Thanassis Avgerinos, and David Brumley Carnegie Mellon University 8/15/2011 1 Downloading Exploits I found a Exploit control flow hijack exploit online! Evil Ed Windows 7 8/15/2011 2

837 views • 58 slides

------------ GOOD LUCK ON THE EXAM ----------------- 1) In Buffer Overflow exploit, which of the

------------ GOOD LUCK ON THE EXAM ----------------- 1) In Buffer Overflow exploit, which of the following registers gets overwritten with return address of the exploit code? A. EIP B. ESP C. EAP D. EEP Ans: A 2)Which type of scan does not

431 views • 18 slides

Remote Access Plus Enterprise Remote Access Sofuware - Product Overview Covers all your

Remote Access Plus Enterprise Remote Access Sofuware - Product Overview Covers all your troubleshooting needs ! On Premises Available on cloud Feature Highlights Advanced remote desktop sharing Voice, video and text chat Remote

222 views • 11 slides

Automatic Exploit Generation an Odyssey Sophia DAntoine CanSecWest 2016 Introduction

Automatic Exploit Generation an Odyssey Sophia DAntoine CanSecWest 2016 Introduction Programs have become increasingly difficult to exploit larger, changing surface area mitigations more bytes to siphon through 10/22/2015

652 views • 46 slides

Remote Working Toolkit Remote Work Best Practices Remote work provides a unique & exciting

Remote Working Toolkit Remote Work Best Practices Remote work provides a unique & exciting opportunity: with just a few tweaks to your homelife and routine, your productivity and personal well-being can be maximized. This document

324 views • 6 slides

TheReleaseofProofofConcept CodeintotheWild An exploit

TheReleaseofProofofConcept CodeintotheWild An exploit isapieceofsoftware,achunkof data,orsequenceofcommandsthattake

398 views • 24 slides

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA)

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA) Basic Rules Remote Connection AKE RA Encoding Rules 2 Remote Access Basic Rules Source devices may permit remote access to content

326 views • 15 slides

COLLARTS SOURCING REMOTE INTERNSHIPS WHAT IS A REMOTE INTERNSHIP? COLLARTS REMOTE INTERNSHIPS

COLLARTS SOURCING REMOTE INTERNSHIPS WHAT IS A REMOTE INTERNSHIP? COLLARTS REMOTE INTERNSHIPS A remote internship is a class of internship where you do not have to be physically present in the office or site while doing the internship. You

151 views • 13 slides

COUNTERS REMOTE LDL-xxx-06/26 LNL-xxx-27 LGL-xxx-27 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06

REMOTE COLLECTION COUNTERS REMOTE LDL-xxx-06/26 LNL-xxx-27 LGL-xxx-27 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06 Possibility of connecting in one line with low multidecks LDL-xxx-07 LDL-xxx-07 LDL-xxx-07 LDL-xxx-07 LDL-xxx-07

1k views • 82 slides

Heap Models For Exploit Systems IEEE Security and Privacy LangSec Workshop 2015 Julien Vanegue

Heap Models For Exploit Systems IEEE Security and Privacy LangSec Workshop 2015 Julien Vanegue Bloomberg L.P. New York, USA. May 24, 2015 Big picture : The Automated Exploitation Grand Challenge A Security Exploit is a program taking

451 views • 23 slides

Remote Access and SSH a t t e n t i i g r e e n ! P a y t o t e x t o n n T h e s e c o r r e c t

Remote Access and SSH a t t e n t i i g r e e n ! P a y t o t e x t o n n T h e s e c o r r e c t i d o n e a f t h e l e c t u r e ! t e r a r e o n s 1 Remote Access Modern computing requires the use of a variety of resources located on

652 views • 44 slides

Remote Procedure Calls Dan Savel, dxs221 EECS 338, Spring 2011 What is a Remote Procedure Call?

Remote Procedure Calls Dan Savel, dxs221 EECS 338, Spring 2011 What is a Remote Procedure Call? Executing a procedure in an application running on a remote server Transport Protocol and Serialization are abstracted away to work

309 views • 20 slides

Tutorial on Adversarial Machine Learning with CleverHans Nicholas Carlini University of

@NicolasPapernot Tutorial on Adversarial Machine Learning with CleverHans Nicholas Carlini University of California, Berkeley Nicolas Papernot Pennsylvania State University Did you git clone https://github.com/carlini/odsc_adversarial_nn ?

493 views • 46 slides

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 Outline Why are timing

Discussion: Remote Timing Attacks are Practical 600.624 2/11/05 Outline Why are timing attacks important? Clarifications Zero-One Gap / Neighborhood Size etc. Problems Questions Extensions Contribution Discussion

645 views • 26 slides

Remote Timing Attacks are Still Practical Billy Brumley Nicola Tuveri Aalto University School of

Remote Timing Attacks are Still Practical Billy Brumley Nicola Tuveri Aalto University School of Science, Finland {bbrumley,ntuveri}@tcs.hut.fi Synopsis New remote timing attack vulnerability in OpenSSLs implementation of Montgomerys

487 views • 25 slides

AOS Linux Tutorial Remote Access and Transferring Files Michael Havas Dept. of Atmospheric and

AOS Linux Tutorial Remote Access and Transferring Files Michael Havas Dept. of Atmospheric and Oceanic Sciences McGill University September 28, 2010 Outline 1 Remote Access SSH From Linux or OS X SSH from Windows Transferring Files SSH

394 views • 20 slides

Uncovering Zero-Days and advanced fuzzing How to successfully get the tools to unlock UNIX and

Uncovering Zero-Days and advanced fuzzing How to successfully get the tools to unlock UNIX and Windows Servers About the presentation Whoami Introduction 0days and the rush for public vulnerabilities And Advanced fuzzing techniques

432 views • 31 slides

Security Analysis of Emerging Smart Home Applications Earlence Fernandes, Jaeyeon Jung, Atul

Security Analysis of Emerging Smart Home Applications Earlence Fernandes, Jaeyeon Jung, Atul Prakash IEEE Security and Privacy 24 May 2016 Smart Door Locks CO Sensors Connected Ovens Smart Plugs IP Cameras Emerging Smart Home Frameworks

502 views • 35 slides

A WMI S HELL A new way to get shells on remote Windows machines using only the WMI service LEXSI

A WMI S HELL A new way to get shells on remote Windows machines using only the WMI service LEXSI > CLIENT Andrei Dumitrescu Security Consultant, LEXSI S UMMARY Introduction Authenticated remote code execution (RCE) methods on

817 views • 32 slides

Scheduling Operating System Services PhD Planner Research Area: Operating Systems, Distributed

Scheduling Operating System Services PhD Planner Research Area: Operating Systems, Distributed Systems Stefan Bonfert | Ulm University Advisor: Stefan Wesner | Ulm University Slide 2 Scheduling Operating System Services | Stefan Bonfert

474 views • 15 slides