Court of Analysis and Testing

This is the third part of smash the tux series, in this post lets continue our work and try to finish 0x03 - 0x06 challenge Challenge 0x03: from this source code, we can see that there is a limit of input length in the program. If we try to input with a length that exceeds 512 bytes, the program will terminate itself. We can safely assume that 512 is the length that we need to overwrite the EIP register let's try to test the program by inputting just 512 bytes and see what happen to it. so what happens in here? this vulnerability is called "off by one byte" if the programmer knows that it takes 512 bytes and above to overwrite the EIP, they should not put a check like this (strlen(text) > 512) that means we can still input with length 512, to do the correct checking it supposed to be like this (strlen(text) >= 512) this will make sure that input with length 512 and above is properly sanitized Let's try to determine how much length we a...

In the previous blog about SmashTheTux we are talking about how we can leverage simple buffer overflow and format string attack to gain control of a program. This time we will take a look at one of the most interesting attacks in the modern OS environment "Race condition" I heard about this attack when I'm attending a lecture of operating system security at that time I understand the underlying principle of the attack but not really much on how to do attack and this time I have a chance to do the implementation of this attack What is the race condition? According to OWASP 10, the race condition is a vulnerability that produces an unexpected result when the timing of actions is impacted or affected by other actions. Simple enough this attack is based on the length of the timing of the program execution and mostly happens in a multithreaded application where all of the execution is happening at the same time. consider the following source code taken from ...

It's bad enough that many people around the world are affected and died by coronavirus but I think this situation is getting worse because I found out that malware author actually used this situation to start spreading their malware campaign. For me, It's not surprised since they always follow the latest trend and device a new malware type for getting a new profit, one of the examples that we can use is ransomware. After a couple of hours strolling around the internet haystack with my android VM, I found some dodgy website that offers an app that claims that can track coronavirus spread in your location. Long story short, it turns out that this is a ransomware that demands the victim to pay a certain BTC to them. I try to reverse engineer the malware and luckily I found out how to open the device. If you don't have time and just want to unlock your device the key is 4865083501 Preliminary static analysis: Malware md5 hash: 69a6b43b5f63030938c578eec05993eb Ma...