---

Hacking Ubuntu: Serious Hacks Mods and Customizations (ExtremeTech)

ISBN: N/A
EAN: 2147483647

Year: 2003
Pages: 198

Authors: Neal Krawetz

BUY ON AMAZON

• The Shellcoder s Handbook: Discovering and Exploiting Security
• Back Cover
• About
• Part 1: Introduction to Exploitation: Linux on x86
• Chapter 1: Before You Begin
• Basic Concepts
• Recognizing C Code Constructs in Assembly
• Conclusion
• Chapter 2: Stack Overflows
• Buffers
• The Stack
• Overflowing Buffers on the Stack
• Using an Exploit to Get Root Privileges
• Defeating a Non-Executable Stack
• Conclusion
• Chapter 3: Shellcode
• Understanding System Calls
• Writing Shellcode for the exit() Syscall
• Injectable Shellcode
• Spawning a Shell
• Conclusion
• Chapter 4: Introduction to Format String Bugs
• Prerequisites
• What Is a Format String?
• What Is a Format String Bug?
• Format String Exploits
• Controlling Execution for Exploitation
• Why Did This Happen?
• Format String Technique Roundup
• Conclusion
• Chapter 5: Introduction to Heap Overflows
• What Is a Heap?
• Finding Heap Overflows
• Conclusion
• Part 2: Exploiting More Platforms: Windows, Solaris, and Tru64
• Chapter 6: The Wild World of Windows
• How Does Windows Differ from Linux?
• Heaps
• The Genius and Idiocy of the Distributed Common Object Model and DCE-RPC
• Debugging Windows
• Conclusion
• Chapter 7: Windows Shellcode
• Setting Up
• Parsing the PEB
• Searching with Windows Exception Handling
• Popping a Shell
• Conclusion
• Chapter 8: Windows Overflows
• Stack-Based Buffer Overflows
• Stack Protection and Windows 2003 Server
• Heap-Based Buffer Overflows
• Exploiting Heap-Based Overflows
• Other Overflows
• Exploiting Buffer Overflows and Non-Executable Stacks
• Conclusion
• Chapter 9: Overcoming Filters
• Writing Exploits for Use with an Alphanumeric Filter
• Writing Exploits for Use with a Unicode Filter
• Exploiting Unicode-Based Vulnerabilities
• The Venetian Method
• Decoder and Decoding
• Conclusion
• Chapter 10: Introduction to Solaris Exploitation
• Introduction to the SPARC Architecture
• SolarisSPARC Shellcode Basics
• SolarisSPARC Stack Frame Introduction
• Stack-Based Overflow Methodologies
• Stack Overflow Exploitation In Action
• Heap-Based Overflows on SolarisSPARC
• Basic Exploit Methodology (t_delete)
• Other Heap-Related Vulnerabilities
• Heap Overflow Example
• Other Solaris Exploitation Techniques
• Conclusion
• Chapter 11: Advanced Solaris Exploitation
• Single Stepping the Dynamic Linker
• Various Style Tricks for Solaris SPARC Heap Overflows
• Advanced SolarisSPARC Shellcode
• Conclusion
• Chapter 12: HP Tru64 Unix Exploitation
• The Alpha Architecture
• Retrieving the Program Counter (GetPC)
• System Call Invocation
• XOR Decoder for Shellcode
• .end main setuid execve Shellcode
• Connect-Back Shellcode
• Find-Socket Shellcode
• Bind-Socket Shellcode
• Stack Overflow Exploitation
• Exploiting rpc.ttdbserver
• Conclusion
• Part 3: Vulnerability Discovery
• Chapter 13: Establishing a Working Environment
• Conclusion
• What You Need for Reference
• What You Need for Code
• What You Need for Investigation
• What You Need to Know
• Optimizing Shellcode Development
• Chapter 14: Fault Injection
• Design Overview
• Fault Monitoring
• Putting It Together
• Conclusion
• Chapter 15: The Art of Fuzzing
• General Theory of Fuzzing
• Weaknesses in Fuzzers
• Modeling Arbitrary Network Protocols
• Other Fuzzer Possibilities
• SPIKE
• Other Fuzzers
• Conclusion
• Chapter 16: Source Code Auditing: Finding Vulnerabilities in C-Based Languages
• Tools
• Automated Source Code Analysis Tools
• Methodology
• Vulnerability Classes
• Beyond Recognition: A Real Vulnerability versus a Bug
• Conclusion
• Chapter 17: Instrumented Investigation: A Manual Approach
• Philosophy
• Oracle extproc Overflow
• Common Architectural Failures
• Bypassing Input Validation and Attack Detection
• Windows 2000 SNMP DOS
• Finding DOS Attacks
• SQL-UDP
• Conclusion
• Chapter 18: Tracing for Vulnerabilities
• Overview
• Conclusion
• Chapter 19: Binary Auditing: Hacking Closed Source Software
• Binary versus Source-Code Auditing: The Obvious Differences
• IDA ProThe Tool of the Trade
• Binary Auditing Introduction
• Reconstructing Class Definitions
• Manual Binary Analysis
• Binary Vulnerability Examples
• Conclusion
• Part 4: Advanced Materials
• Chapter 20: Alternative Payload Strategies
• Modifying the Program
• The SQL Server 3-Byte Patch
• The MySQL 1-Bit Patch
• OpenSSH RSA Authentication Patch
• Other Runtime Patching Ideas
• Upload and Run (or Proglet Server)
• Syscall Proxies
• Problems with Syscall Proxies
• Conclusion
• Chapter 21: Writing Exploits that Work in the Wild
• Factors in Unreliability
• Countermeasures
• Conclusion
• Chapter 22: Attacking Database Software
• Network Layer Attacks
• Application Layer Attacks
• Running Operating System Commands
• Exploiting Overruns at the SQL Level
• Conclusion
• Chapter 23: Kernel Overflows
• Kernel Vulnerability Types
• 0day Kernel Vulnerabilities
• Solaris vfs_getvfssw() Loadable Kernel Module Traversal Vulnerability
• Conclusion
• Chapter 24: Exploiting Kernel Vulnerabilities
• The exec_ibcs2_coff_prep_zmagic() Vulnerability
• Solaris vfs_getvfssw() Loadable Kernel Module Path Traversal Exploit
• Conclusion
• Index
• A
• B
• C
• D
• E
• F
• G
• H
• I
• J
• K
• L
• M
• N
• O
• P
• Q
• R
• S
• T
• U
• V
• W
• X
• Z
• List of Figures
• List of Tables