Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker - PowerPoint PPT Presentation

Sep 12, 2023 •309 likes •530 views

1 Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 NSA Codebreaker Challenges 4 Administrivia No class on Oct 28 If you are interested in, check out EKOPARTY CTF 2016 Due: Lab08 is out and its due on Nov 3 (two weeks!)

1 Lec08: Remote Exploit Taesoo Kim
2 Scoreboard
3 NSA Codebreaker Challenges
4 Administrivia • No class on Oct 28 • If you are interested in, check out EKOPARTY CTF 2016 • Due: Lab08 is out and its due on Nov 3 (two weeks!) • NSA Codebreaker Challenge → Due: Dec 1
5 Lab06: ROP
6 Discussion: Lab07 • What's the most "annoying" bug or challenge? • What's the most "interesting" bug or challenge? • So, ROP is too powerful?
7 Discussion: pop • What was the problem? • How did you solve?
8 Discussion: pop
9 Discussion: puzzle • What was the problem? • How did you solve?
10 Discussion: upto-retaddr • How much did you try? • Where did you stuck?
11 Discussion: find-gadget • What was the problem? • How did you solve?
12 Discussion: sprintf • How much did you try? • Where did you stuck?
13 Discussion: rop-sorting • How much did you try? • Where did you stuck?
14 Discussion: inc1 • How much did you try? • Where did you stuck?
15 Discussion: fmtstr-relro • How much did you try? • Where did you stuck?
16 Take-outs from ROP • DEP/ASLR are not perfect solutions • DEP: ret-to-lib, ROP • ASLR: code leakage • What about stack canary? (what if we placed it together?) • Lots of known defenses (did you attend today's talk?)
17 Today's Tutorial • In-class tutorial: • Socket programming in Python • Your first remote exploit!
18 Remote Challenges • Use techniques learned from Lab01-Lab07 • But targeting the remote server (e.g., online services)
19 DEMO: about how remote challenges work • nc • exploit.py
20 In-class Tutorial • Step1: nc • Step2: brute force attack • Step3: guessing attack $ git git@clone tc.gtisc.gatech.edu:seclab-pub cs6265 or $ git pull $ cd cs6265/lab08 $ ./init.sh $ cd tut $ cat README
Lec08: Remote Exploit Taesoo Kim

Recommend

Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 Administrivia In-class CTF on Nov 16-17

1 Lec08: Remote Exploit Taesoo Kim 2 Scoreboard 3 Administrivia In-class CTF on Nov 16-17 (24 hours)! Due: form your team and submit your CTF challenge by Nov 13! Due: Lab07 is out and its due on Nov 2 (two weeks!) NSA

596 views • 33 slides

OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June

OpenBSD Remote Exploit Only two remote holes in the default install Alfredo A. Ortega June 30, 2007 Mbuf buffer overflow Buffer overflow Researching the OpenBSD 008: RELIABILITY FIX a new vulnerability was found: The m dup1()

587 views • 23 slides

Zero Exploit Tolerance By Jamie Butler and Cody Pierce Confidential and Proprietary Who we are

Zero Exploit Tolerance By Jamie Butler and Cody Pierce Confidential and Proprietary Who we are The exploit problem Modern software vulnerabilities Hardware-assisted exploit Agenda prevention Prior research

674 views • 45 slides

aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development for Dummies

Ein Blick in die Hexenkche der Exploit Entwickler aka Der Hacker und die 7 Geilein 27/03/2018 // Exploit Development for Dummies https://www.bee-itsecurity.at // Page 2 27/03/2018 // Exploit Development for Dummies

613 views • 48 slides

Q: Exploit Hardening Made Easy Edward J. Schwartz, Thanassis Avgerinos, and David Brumley

Q: Exploit Hardening Made Easy Edward J. Schwartz, Thanassis Avgerinos, and David Brumley Carnegie Mellon University 8/15/2011 1 Downloading Exploits I found a Exploit control flow hijack exploit online! Evil Ed Windows 7 8/15/2011 2

837 views • 58 slides

------------ GOOD LUCK ON THE EXAM ----------------- 1) In Buffer Overflow exploit, which of the

------------ GOOD LUCK ON THE EXAM ----------------- 1) In Buffer Overflow exploit, which of the following registers gets overwritten with return address of the exploit code? A. EIP B. ESP C. EAP D. EEP Ans: A 2)Which type of scan does not

431 views • 18 slides

Remote Access Plus Enterprise Remote Access Sofuware - Product Overview Covers all your

Remote Access Plus Enterprise Remote Access Sofuware - Product Overview Covers all your troubleshooting needs ! On Premises Available on cloud Feature Highlights Advanced remote desktop sharing Voice, video and text chat Remote

222 views • 11 slides

Automatic Exploit Generation an Odyssey Sophia DAntoine CanSecWest 2016 Introduction

Automatic Exploit Generation an Odyssey Sophia DAntoine CanSecWest 2016 Introduction Programs have become increasingly difficult to exploit larger, changing surface area mitigations more bytes to siphon through 10/22/2015

652 views • 46 slides

Remote Working Toolkit Remote Work Best Practices Remote work provides a unique & exciting

Remote Working Toolkit Remote Work Best Practices Remote work provides a unique & exciting opportunity: with just a few tweaks to your homelife and routine, your productivity and personal well-being can be maximized. This document

324 views • 6 slides

TheReleaseofProofofConcept CodeintotheWild An exploit

TheReleaseofProofofConcept CodeintotheWild An exploit isapieceofsoftware,achunkof data,orsequenceofcommandsthattake

398 views • 24 slides

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA)

DTCP + Remote Access Proposal for Discussion with 3S October 28, 2009 1 Remote Access (RA) Basic Rules Remote Connection AKE RA Encoding Rules 2 Remote Access Basic Rules Source devices may permit remote access to content

326 views • 15 slides

COLLARTS SOURCING REMOTE INTERNSHIPS WHAT IS A REMOTE INTERNSHIP? COLLARTS REMOTE INTERNSHIPS

COLLARTS SOURCING REMOTE INTERNSHIPS WHAT IS A REMOTE INTERNSHIP? COLLARTS REMOTE INTERNSHIPS A remote internship is a class of internship where you do not have to be physically present in the office or site while doing the internship. You

151 views • 13 slides

COUNTERS REMOTE LDL-xxx-06/26 LNL-xxx-27 LGL-xxx-27 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06

REMOTE COLLECTION COUNTERS REMOTE LDL-xxx-06/26 LNL-xxx-27 LGL-xxx-27 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06 LDL-xxx-06 Possibility of connecting in one line with low multidecks LDL-xxx-07 LDL-xxx-07 LDL-xxx-07 LDL-xxx-07 LDL-xxx-07

1k views • 82 slides

Heap Models For Exploit Systems IEEE Security and Privacy LangSec Workshop 2015 Julien Vanegue

Heap Models For Exploit Systems IEEE Security and Privacy LangSec Workshop 2015 Julien Vanegue Bloomberg L.P. New York, USA. May 24, 2015 Big picture : The Automated Exploitation Grand Challenge A Security Exploit is a program taking

451 views • 23 slides

Remote Access and SSH a t t e n t i i g r e e n ! P a y t o t e x t o n n T h e s e c o r r e c t

Remote Access and SSH a t t e n t i i g r e e n ! P a y t o t e x t o n n T h e s e c o r r e c t i d o n e a f t h e l e c t u r e ! t e r a r e o n s 1 Remote Access Modern computing requires the use of a variety of resources located on

652 views • 44 slides

Remote Procedure Calls Dan Savel, dxs221 EECS 338, Spring 2011 What is a Remote Procedure Call?

Remote Procedure Calls Dan Savel, dxs221 EECS 338, Spring 2011 What is a Remote Procedure Call? Executing a procedure in an application running on a remote server Transport Protocol and Serialization are abstracted away to work

309 views • 20 slides

Transparent ROP Exploit Mitigation using Indirect Branch Tracing

Transparent ROP Exploit Mitigation using Indirect Branch Tracing Alexandros Perrakis Manolis Karabinakis Stelios Ninidakis Vulnerabilities Buffer overflow

342 views • 30 slides

Virtual Learning St. John the Baptist School Remote Learning vs. Virtual Learning Remote

Virtual Learning St. John the Baptist School Remote Learning vs. Virtual Learning Remote Learning Virtual Learning - Entire class is remote - Some of the class is in person and - Some live instruction and recorded some is remote lessons

374 views • 11 slides

(g)RPC - Remote Procedure Call February 13, 2019 Remote Procedure Call (RPC) a form of

(g)RPC - Remote Procedure Call February 13, 2019 Remote Procedure Call (RPC) a form of inter-process communication RPC - Protocols XML-RPC xmlrpc2 (CRAN), XMLRPC (omegahat) JSON-RPC https://www.jsonrpc.org/ gRPC open

341 views • 8 slides

One Exploit to Rule them All? On the Security of Drop-in Replacement and Counterfeit

Johannes Obermaier, Marc Schink, Kosma Moczek August 11, 2020 One Exploit to Rule them All? On the Security of Drop-in Replacement and Counterfeit Microcontrollers Outline - Research Scope - Optical Die Inspection - Security Concept -

936 views • 58 slides

Chapter 15: Distributed Communication Sockets Remote Procedure Calls (RPCs) Remote

Chapter 15: Distributed Communication Sockets Remote Procedure Calls (RPCs) Remote Method Invocation (RMI) CORBA Object Registration Silberschatz, Galvin, and Gagne 1999 Applied Operating System Concepts Sockets

461 views • 21 slides

From x-ray crystallography to electron microscopy and back -- how best to exploit the continuum of

From x-ray crystallography to electron microscopy and back -- how best to exploit the continuum of structure-determination methods now available Scripps EM course, November 14, 2007 What aspects of contemporary x-ray crystallography have made

609 views • 33 slides

How to Exploit a Heterogeneous Cluster of Computers (Asymptotically) Optimally Arnold L.

How to Exploit a Heterogeneous Cluster of Computers (Asymptotically) Optimally Arnold L. Rosenberg Electrical & Computer Engineering Colorado State University Fort Collins, CO 80523, USA rsnbrg@colostate.edu Joint work with Micah

927 views • 60 slides

Playing with FHIR IR How to Exploit the EHR Mark L Braunstein, MD Professor of the Practice

Playing with FHIR IR How to Exploit the EHR Mark L Braunstein, MD Professor of the Practice School of Interactive Computing Georgia Institute of Technology Visiting Research Fellow E-Health Centre, CSIRO Variable Results Australia ranks

1.13k views • 67 slides