Università degli Studi di Camerino

Slides:

Advertisements

Similar presentations

Test practice Multiplication. Multiplication 9x2.

Advertisements

PRESENTED BY: © Mandiant Corporation. All rights reserved. X86 Binary Rewriting Many Binaries. Such Secure. Wow. Richard Wartell 06/29/14.

By Hiranmayi Pai Neeraj Jain

 Method of representing or encoding numbers  Two main notation types  Sign-value  Roman numerals  Positional (place-value)  Modern decimal notation.

ASCII & Gray Codes.

Viruses, Worms and Spam Definitions Virus - unauthorized software, embedded in other programs and with the ability to propagate when the host program is.

Binary Addition Addition Rules: = = = = = carry 1 1 carry 1 Example 1: Example 2:

Free Trade in the Cyber Underground Malware Outsourcing Marita Fowler Farrah Patterson CAP 6135 – Term Project Proposal.

Click to edit Master title style Click to edit Master text styles Second level Third level Fourth level Fifth level June 10 th, 2009Event details (title,

Client-based Application Attacks Adli Abdul Wahid Dept. of Comp. Science, IIUM

Adding SubtractingMultiplyingDividingMiscellaneous.

Digital University of Pisa Alessandro Lenci CoLing Lab – Laboratorio di Linguistica Computazionale Università di Pisa Aix-Marseille Université.

 Method of representing or encoding numbers  Two main notation types  Sign-value  Roman numerals  Positional (place-value)  Modern decimal notation.

10-1 人生与责任淮安工业园区实验学校连芳芳 “ 自我介绍 ” “ 自我介绍 ” 儿童时期的我.

Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica master’s.

Laurea Triennale in Informatica – Corso di Ingegneria del Software I – A.A. 2006/2007 Andrea Polini XVII. Verification and Validation.

● Anonymous. ways - Casting the Establishment - System hacking - Infrastructure Hacking - Application and Data Hacking.

Rogue Wireless Router By Alex Crowell and James Kasten.

REMOVE/BLOK POP-UPS FROM INTERNET EXPLORER Virus Issue ?

Radare Easing binary analysis for fun and profit.

Intercept X Early Access Program Sophos Tester

Shellcode COSC 480 Presentation Alison Buben.

Student Xireaili Maihemoti

Process Synchronization

Why Should You Use Accounting Software?

Footprinting (definition 1)

Why Computer Security Need???

CSCE 548 Secure Software Development Final Exam – Review 2016

Ch 1. A Python Q&A Session Bernard Chen 2007.

Hackers and Crackers iJacsn.

CSC 495/583 Topics of Software Security Return-oriented programming

Google search not working on pc Google.

Fix QuickBooks Payroll Update Error Call

Rootkit A rootkit is a set of tools which take the ability to access a computer or computer network at administrator level. Generally, hackers install.

In Order To Get Error Free Internet Browsing Contact Avira Online Support Number Avira provides the users with the best security protection to their computer.

Yahoo Mail Customer Support Number

Most Effective Techniques to Park your Manual Transmission Car

How do Power Car Windows Ensure Occupants Safety

Servicenumber.org/internet-explorer. Resolve Issue Internet Explorer.

Intercept X for Server Early Access Program Sophos Tester

مراقبت خانواده محور در NICU

دانشگاه شهیدرجایی تهران

Wiki “wiki wiki”: Hawaiian for “very quick”

تعهدات مشتری در کنوانسیون بیع بین المللی

بسمه تعالی کارگاه ارزشیابی پیشرفت تحصیلی

دومین کمیته مترجمین حاکمیت بالینی دانشگاه

Faculty of Science IT Department By Raz Dara MA.

CS533 Concepts of Operating Systems Class 14

Topic of the final thesis

Index construction: Compression of postings

CS533 Concepts of Operating Systems Class 6

Adding with 9’s.

Adding with 10’s.

Index construction: Compression of postings

CS533 Concepts of Operating Systems Class 13

The Multiplication Table

Adding ____ + 10.

What are Computers? C Use this tutorial alongside the numbers coded in your workbook and answer the related questions in each section.

CS533 Concepts of Operating Systems Class 13

Setup a VM to use for analyzing malware

BETONLINEBETONLINE A·+A·+

Data Results: Label this as your main section

Presentation transcript:

Università degli Studi di Camerino Scuola di Scienze e Tecnologie Corso di Laurea in Informatica (Classe L-31) MITM ATTACK WITH PATCHING BINARIES ON THE FLY BY ADDING SHELLCODES Laureando: Gabrielli Gianluca Relatore: Prof. Marcantoni Fausto A.A. 2013/2014

INTERCEPT INJECT INFECT crazybyte.me @CrazyByte

Overview LAN INTERNET crazybyte.me @CrazyByte

Shellcode \\xeb\x1b\x5b\x31\xc0\x89\x43\x08\x50\x53\x89\xe1\x89\xca\x83\xc2\x04\x83\xc0\x0b\xcd\x80\x83\xe8\x0a\x31\xdb\xcd\x80\xe8\xe0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68 = 11101011 00011011 01011011 00110001 11000000 10001001 01000011 00001000 01010000 01010011 10001001 11100001 10001001 11001010 10000011 11000010 00000100 10000011 11000000 00001011 11001101 10000000 10000011 11101000 00001010 00110001 11011011 11001101 10000000 11101000 11100000 11111111 11111111 11111111 00101111 01100010 01101001 01101110 00101111 01110011 01101000 crazybyte.me @CrazyByte

Common Attack Victim Cracker www.trustme.ru crazybyte.me @CrazyByte

Why it fail? Victim Cracker !? crazybyte.me @CrazyByte

How does AV work? Definizioni Virus Signature XYZ 11101011 00011011 01011011 00110001 11000000 10001001 01000011 00001000 01010000 01010011 10001001 11100001 10001001 11001010 10000011 11000010 00000100 10000011 11000000 00001011 11001101 10000000 10000011 11101000 00001010 00110001 11011011 11001101 10000000 11101000 11100000 11111111 11111111 11111111 00101111 01100010 01101001 01101110 00101111 01110011 01101000 Definizioni Virus Signature XYZ 11000000 00001011 11001101 10000000 10000011 crazybyte.me @CrazyByte

Crypter + a = Passw: 'a' ASCII = 01100001 11101011 00011011 01011011 00110001 11000000 10001001 01000011 00001000 + a 01100001 01100001 01100001 01100001 01100001 01100001 01100001 01100001 = 10001010 01111010 00111010 01010000 10100001 11101000 00100010 01101001 gianluca.gabrielli@autistici.org @Gianlucode

Crypter STUB crazybyte.me 10001010 01111010 00111010 01010000 10100001 11101000 00100010 01101001 STUB Passw: 'a' crazybyte.me @CrazyByte

Operative Systems crazybyte.me @CrazyByte

Operative Systems crazybyte.me @CrazyByte

Operative Systems PE Mach-O ELF crazybyte.me @CrazyByte

Code Caves crazybyte.me 01100100 10010010 11101100 10010010 10111101 10100101 01001000 00101000 01100100 10010010 11101100 10010010 10111101 10100101 01001000 00101000 01100100 10010010 11101100 10010010 10111101 10100101 01001000 00101000 . crazybyte.me @CrazyByte

Code Caves crazybyte.me 01100100 10010010 11101100 10010010 11101100 10010010 10010010 10010010 11101100 10010010 10111101 10100101 01001000 11101100 10010010 10111101 00101000 01100100 11101100 10010010 10111101 10010010 11101100 10010010 10111101 10100101 10010010 11101100 10010010 01001000 00101000 01100100 11101100 10010010 10111101 10010010 10100101 10010010 11101100 10010010 01001000 00101000 01100100 10010010 11101100 10010010 10010010 11101100 00000000 00000000 00000000 00000000 00000000 00000000 00101000 10010010 11101100 10010010 01100100 10010010 11101100 10010010 10111101 10010010 11101100 00101000 . 01001000 10010010 11101100 10010010 00101000 01100100 10010010 11101100 00101000 10010010 11101100 10010010 crazybyte.me @CrazyByte

Code Caves crazybyte.me 01100100 10010010 11101100 10010010 11101100 10010010 10010010 10010010 11101100 10010010 10111101 10100101 01001000 11101100 10010010 10111101 00101000 01100100 11101100 10010010 10111101 10010010 11101100 10010010 10111101 10100101 10010010 11101100 10010010 01001000 00101000 01100100 11101100 10010010 10111101 10010010 10100101 10010010 11101100 10010010 01001000 00101000 01100100 10010010 11101100 10010010 10010010 11101100 00000000 00000000 00000000 00000000 00000000 00000000 00101000 10010010 11101100 10010010 01100100 10010010 11101100 10010010 10111101 10010010 11101100 00101000 . 01001000 10010010 11101100 10010010 00101000 01100100 10010010 11101100 00101000 10010010 11101100 10010010 crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

Portable Executable crazybyte.me 01100100 10010010 11101100 10010010 10111101 10100101 10010010 11101100 10010010 01001000 00101000 01100100 11101100 10010010 10111101 10010010 11101100 10010010 10100101 10010010 11101100 10010010 01001000 00101000 10010010 11101100 00000000 00000000 00000000 00000000 00000000 00000000 00101000 10010010 11101100 10010010 10111101 10010010 11101100 00101000 . 01001000 10010010 11101100 1001001 00101000 01100100 10010010 1110110 crazybyte.me @CrazyByte

Portable Executable WIKI crazybyte.me @CrazyByte

Portable Executable Single Cave Multiple Caves Adding a Section Three Ways to Inject Single Cave Multiple Caves Adding a Section crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

Portable Executable Shellcode crazybyte.me @CrazyByte

Portable Executable crazybyte.me @CrazyByte

PE – Multiple Caves crazybyte.me @CrazyByte

PE – Multiple Caves crazybyte.me @CrazyByte

PE – Multiple Caves crazybyte.me @CrazyByte

How does AV work? Definizioni Virus Signature XYZ 11101011 00011011 01011011 00110001 11000000 10001001 01000011 00001000 01010000 01010011 10001001 11100001 10001001 11001010 10000011 11000010 00000100 10000011 11000000 00001011 11001101 10000000 10000011 11101000 00001010 00110001 11011011 11001101 10000000 11101000 11100000 11111111 11111111 11111111 00101111 01100010 01101001 01101110 00101111 01110011 01101000 Definizioni Virus Signature XYZ 11000000 00001011 11001101 10000000 10000011 crazybyte.me @CrazyByte

PE – Multiple Caves crazybyte.me @CrazyByte

ELF crazybyte.me @CrazyByte

ELF crazybyte.me @CrazyByte

ELF crazybyte.me @CrazyByte

ELF crazybyte.me @CrazyByte

Mach-O crazybyte.me @CrazyByte

Mach-O crazybyte.me @CrazyByte

Mach-O crazybyte.me @CrazyByte

POC || GTFO IT'S TIME TO PATCH! crazybyte.me @CrazyByte

THANKS FOR THE ATTENTION Thesis Presentation Charts Are made just using Free Software www.libreoffice.org crazybyte.me @CrazyByte