Adobe Flash exploit allows websites to access your webcam without permission

Your webcam can be a powerful tool for communicating with your freinds and family members.  But when that power is put into someone else's hands, it can have dangerous consequences. A new exploit of Adobe's Flash media application could potentially allow websites to access your webcam without your permission, opening the door for any number of unknown people to peep into your world.

The exploit — which only affects Macs thus far — can be performed on web surfers using Safari and Firefox web browsers. The gaping hole in Adobe's security features was discovered by a Stanford computer science major named Feross Aboukhadijeh, who brought it to the attention of Adobe. After weeks without a response, Aboukhadijeh decided to make the glitch publicly known, in an attempt to force Adobe's hand. His plan worked, and Adobe released a statement saying they were working on the problem, and the fix wouldn't require a Flash update.

In the video above, a college student shows just how the exploit can be performed, calling attention to a gap in Adobe's coding that was somehow completely cashed by the intruders for peeping into your world .

Read more »

Posted in: Exploits

Exploit writing-2

If you are reading this article for the first time please read my later article exploit writing -1 .

Lets continue the exploit writing -1

let's open the program in  GDB(gnome debugger) and try to  find the offset needed to trigger an overwrite

like you can see here SSP has reported a segmentation fault that means we were able to overwrite the EIP register .

Now lets look at the all the registries through info registries command

Here you can notice the list of registries and the address in the hex format (x/ADDRESS)


Lets check for the ESP register , here you can see that esp is located at 0xbfa87f00

Now if we can find the ESP register address before the execution of strcpy function then we will be able to execute the malicious code .


so now lets see the source code of our program by list command in gdb and we have to keep a break point at the strcpy function .

Now you can also see how to keep the breakpoint in the picture , here we were able to figure out the address of the ESP register i.e, 0xbffff26c

Now lets subtract the 200bytes from the esp address 

You may get a doubt why should we subtract the 200bytes ??

answer for that question is for overwriting the EIP register we need to subtract the 200bytes from the intital address of the esp register then we will copy the esp-200bytes address into eip register which will tigger the overflow .So if you subtract the ESP address with 200bytes we will get 0xbffff06c

To be continued ... in next tutorial we will see the shell code generation

Read more »

Posted in: Exploits

Exploit writing-1

Hi guyzzz ..  Today we will be learning about the exploit writing .

Before we move further i am assuming few things

1)You understand the basic concept  of the buffer overflows
2)You know basic C/C++ and ASM knowledge
3)Basic knowledge about  the GDB
4)Exploiting techniques

If you dnt know about anyone of the above assumptions , please learn them and come back

First of all let me write small c program

#include<stdio.h>
#include<string.h>
int main ( int argc , char** argv[])
{
char buff[500];
strcpy(buff,argv[1]);
}

Lets see what happens if you compile the above program  and load it in the debugger

What is happening and why it is happening ???
well gcc 3.x and gcc 4.x by default use a protecting technique called "stack smashing protection " , which is used for tracing the stack buffer overflow before any malicious code is executed

Stack Smashing protection 


SSP places a randomly chosen integer in memory just befor the stack return pointer . Normallt , buffer overflows overwrite memory addresses from low to high , so in order to overwrite the small integer that is placed just befor the stack return pointer , SSP just checks to see if that integer was changed or not before the use of the return pointer on the stack

How to bypass the SSP ?? 


we can bypass the SSP by adding "-fno-stack-protector" flag to gcc when compiling


we will discuss further in the next tutorial ... Thank you 

Read more »

Posted in: Exploits