If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)

Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Hi all! We have been experiencing an issue on site where threads have been missing the latest postings. The platform host Vanilla are working on this issue. A workaround that has been used by some is to navigate back from 1 to 10+ pages to re-sync the thread and this will then show the latest posts. Thanks, Mike.

Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Security Challenge IV (Experimental)

h57xiucj2z946q · 2011-05-29 10:52:51

Ok as the title says, this is just an experimental challenge I quickly threw together last night. It may not work too well, or may not work at all, so don't be too disappointed. But this challenge steers away from the other web apps kind of challenges here to try something different, which in turn I hope is pretty fun for…

Comments

#52 18-08-2011 6:48pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Hm... Keeps terminating beforehand here. At least with putty. I tried with telnet, and it terminates after a single character. I'm guessing that the buffer is larger than 1 byte.

0
#53 18-08-2011 6:52pm

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

Hm... Keeps terminating beforehand here. At least with putty. I tried with telnet, and it terminates after a single character. I'm guessing that the buffer is larger than 1 byte.

It is yeah. Try connecting with raw in putty. Seems fine with windows telnet also.

0
#54 18-08-2011 6:53pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Ah yeah - works fine raw I'm on the case now.

0
#55 19-08-2011 4:04pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Exploit coded for XP SP3. Pretty straight forward. Do you want me to send you on the code?

0
#56 19-08-2011 4:32pm

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

You can yeah, but maybe in PM, as you will see why below. You handled DEP also or disabled it?

I was thinking of hosting this again (well would re-write the server again as I no longer have the code, but its only small, like a handful of lines of code.), and the attacker could use various tools out there to assist is building an exploit.

0
#57 19-08-2011 4:39pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

I didn't do anything with DEP. Default XP SP3 install. Will send it on in a PM.

0
#58 19-08-2011 4:42pm

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

I didn't do anything with DEP. Default XP SP3 install. Will send it on in a PM.

Strange, normally DEP prevents basic attacks, even in SP2.

0
#59 19-08-2011 5:02pm

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

At first I thought your virtual machine wasn't supporting hard DEP through the NX bit (you can test with: http://user.cs.tu-berlin.de/~normanb/), but I have read more into it and it seems OptIn is the default configuration for Win XP, so this will only apply to some system binaries and services (in a challenge, this exe would be launched as a service, so I dunno if it applies to system services or custom ones?).

I think I will re-do this server, maybe change things around so the user will have to do more than a basic overflow with further tasks/thinking needed. That is, if there is interest for it.

0
#60 19-08-2011 5:06pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Always interest in a security challenge Just keep the challenge so that it's do-able. I know alot of people might not have experience with buffer overflows.. so maybe start with a new one first, and then add a second part to it at a later date? That way, you can wean people into the challenges.

Just a thought.

0
Advertisement
#61 25-08-2011 2:30pm

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Setup and testing is all done. Part 5 should be up this evening all going well.

0
#62 25-08-2011 4:24pm

dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Excellent, will look forward to it

0
#63 29-08-2011 7:17am

obviousTroll

Registered Users Posts: 60 ✭✭

Join Date: August 2011

Posts: 56

Any chance I can jump on this bandwagon Damo? If so, please PM me the details. Muchos gracias.

0
#64 29-08-2011 8:29am

h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Yeah just look at this thread for details : http://www.boards.ie/vbulletin/showthread.php?t=2056368594

0
#65 29-08-2011 8:33am

obviousTroll

Registered Users Posts: 60 ✭✭

Join Date: August 2011

Posts: 56

Thanks Damo.

0