Archive for March, 2010

EXE injection plus

For those interested in metasploit (or whatever) payload injection into EXE files, the metasploit patch (now posted http://www.metasploit.com/redmine/projects/framework/repository/revisions/8896) is based on one case, albeit the most likely to work, of my original program in C and Win32 API. This original program also can embed the payload if it fits into unused space at the end of a code section, which […]

, ,

Leave a comment

Metasploit EXE code injection

I recently posed a patch to inject an arbitrary metasploit payload into a win32 exe while attempting to not affect the behavior of the host exe. I’m not the best ruby ninja, but I do at least know a little about the PE format. https://metasploit.com/redmine/issues/1244#change-3739 the patch: https://metasploit.com/redmine/attachments/196/inject.patch Payload is run in a separate thread. […]

, ,

Leave a comment

Security advice

Great post from rsnake; pointing out a Microsoft Research paper (So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users ) on how security advice often does more harm than good. http://ha.ckers.org/blog/20100317/effectiveness-of-user-training-and-security-products-in-general/ I have always disagreed with password policies. There is no gain to most strict password policies over […]

, ,

Leave a comment

Google Update

If you have installed Google Chrome, or maybe Google Desktop or Google’s toolbar, you might be surprised that you have a new Firefox addon, named “Google Update”. And just like Microsoft’s loveable addon, the Google Update addon opens a hole you probably don’t want opened. Unable to find much documentation on the addon, I did […]

, , ,

Leave a comment

Shellcode API hashes

For all you shellcoders out there; to make Windows API calling easier, you can use Stephen Fewer’s block_api.asm in the Metasploit tree. http://www.metasploit.com/redmine/projects/framework/repository/revisions/8160/entry/external/source/shellcode/windows/x86/src/block/block_api.asm But you need the function hashes, which if you don’t have the DLL on your current OS, or the python file, or something like that can be annoying. So I posted a […]

, , ,

Leave a comment