Perl Snippet
Recently, I have been moving Perl scripts from BSD and Linux machines onto OS X. Mostly, things are pretty smooth but today I had to change a script slightly so that I could read data from /private/var/tmp/ on OS X. The scripts I had on the other systems would read from /var/tmp/
Guide to AWBO Exercises
Over here at the VRT, we've thoroughly enjoyed sinking our teeth into the awbo exercises. Hopefully, readers who've had the chance to work through these are eagerly anticipating those to come. On the other hand, there may still be some of you who are interested in giving
Snort startup script for Ubuntu
#! /bin/sh ### BEGIN INIT INFO # Provides: Snort # Required-Start: $local_fs $remote_fs $syslog $network mysql # Required-Stop: $local_fs $remote_fs $syslog $network mysql # Default-Start: 2 3 4 5 # Default-Stop: S 0 1 6 # Short-Description: Init script
AWBO4!
Some of you tore through awbo3 pretty quickly, but I wanted to give others time to catch up before posting this one. We're going to start getting into some issues you'll see in live software when working on exploits. This one in particular might remind you of a certain ba
Logical signatures in ClamAV 0.94
Up until ClamAV 0.93, the following formats have been used the most to write signatures to detect malware: SignatureName;TargetDescriptionBlock;LogicalExpression;Subsig0;Subsig1;Subsig2;... Logical signatures should be stored in .ldb files. Let us illustrate how logical signat
Webcast Teaser -- Basic Buffer Overflow Detection
Our next webcast, Performance Rules Creation: Rules Options and Techniques, is scheduled for 1pm EST on Wednesday, September 17th. We’ll be using actual published VRT rules to demonstrate common rule structures, rule options and some of the gotchas that you might run across when
AWBO Part Deux
Since some people have been chomping at the bit for the next challenge, so here it is. The same rules apply as did last time. When we say no static stack return addresses, this also means of course that there's no need for NOP sleds, so I shouldn't see them in solutions.
Checking Multiple Bits in a Flag Field
Sometimes, it is necessary to check a value in a flag field that is not a power of two (1, 2, 4, 8, etc.) and therefore requires multiple bits to be represented, yet other values in the byte are not part of that flag field. Such is the case for DNS where server status codes are r
Defcon, testing and exploiting
This year at Defcon Immunity trotted out the first iteration of their NOP cert test, and I had the pleasure of giving it a test run. I still think it's a great indicator of ability, despite the Immunity tools focus; I'm not a user of any of their tools generally, but I ma