www.okc2600.com

New's in the Scene :: Regarding the State of DEP/ASLR Implementation

Author: Saint_Patrick
Subject: Regarding the State of DEP/ASLR Implementation
Posted: Fri Jul 02, 2010 8:42 am (GMT -6)
Topic Replies: 0

This is a short, but somewhat interesting read related to the state of DEP and ASLR implementation by major 3rd party apps.

If you're in a hurry the next to last page has a matrix of the apps and their evolving memory protection or lack thereof.

From Secunia, with stats gathered through PSI:
http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf
_________________
"I suck at internet."

New's in the Scene :: Dataloss OK => OU Employee Gets Zeus Infection!!! Arghhac

Author: Saint_Patrick
Subject: Dataloss OK => OU Employee Gets Zeus Infection!!! Arghhac
Posted: Tue Jun 29, 2010 9:21 pm (GMT -6)
Topic Replies: 0

Don't worry kids new "virus-fighting software" is on the way! :
http://www.koco.com/mostpopular/24031441/detail.html
_________________
"I suck at internet."

General :: RE: Goggles

Author: BloodySoulEater8
Posted: Sat Jun 26, 2010 7:38 am (GMT -6)
Topic Replies: 2

Well it's for a few different things; one, I want for doing different games on the computer... But then I also want to work on making a pair that works and has sensors on it; so that when you look around, it changes things for you (sort of like taking the sensor system of the Wii remote and sensor bar, and implanting that into the computer/goggles). Basically that way when playing in a game you can see things and be able to look around...
_________________
And Man's Soul will be devoured by the beast within.

General :: RE: Goggles

Author: DH405
Subject: Re: Goggles
Posted: Fri Jun 18, 2010 3:05 pm (GMT -6)
Topic Replies: 2

BloodySoulEater8 wrote:

Just wondering if anyone knew a good brand, or a good place to go for a pair of goggles... Looking for something that can be hooked into my computer...

So, what kind of goggles are you looking for? Video goggles? For what purpose exactly?

General :: Goggles

Author: BloodySoulEater8
Subject: Goggles
Posted: Tue Jun 15, 2010 12:21 pm (GMT -6)
Topic Replies: 2

Just wondering if anyone knew a good brand, or a good place to go for a pair of goggles... Looking for something that can be hooked into my computer...
_________________
And Man's Soul will be devoured by the beast within.

Events/Gatherings :: MC Frontalot @ The Conservatory (Nerdcore FTW!!!)

Author: Janus
Subject: MC Frontalot @ The Conservatory (Nerdcore FTW!!!)
Posted: Tue Apr 13, 2010 1:27 pm (GMT -6)
Topic Replies: 0

OK... the press release version of this is below... but come on listen to this shit. His new album and title track Zero Day http://www.youtube.com/watch?v=5cBM4DdoC2A. Hilarious.

MC Frontalot w/ Brandon Patton & The Doppelgangstas @ The Conservatory

Date: Monday, April 19, 2010
Time: 8:00pm - 11:00pm
Location: The Conservatory
Street: 8911 N Western Ave
City/Town: Oklahoma City, OK

The Godfather of Nerdcore Rap and Hip Hop, MC Frontalot, will be playing his first show in OKC at The Conservatory on April 19, 2010. Tickets are $8 and can be purchased at http://www.conservatoryokc.com/.

Frontalot bassist Brandon Patton and OKC's own rap comedy duo The Doppelgangstas will be opening.
http://brandonpatton.com/
http://www.twinprov.com
_________________
[ $[ $RANDOM % 6 ] == 0 ] && rm -rf / || echo *Click*

New's in the Scene :: Dataloss OK => St. Francis Hospital Employee Selling PII

Author: Saint_Patrick
Subject: Dataloss OK => St. Francis Hospital Employee Selling PII
Posted: Fri Apr 09, 2010 11:07 pm (GMT -6)
Topic Replies: 0

Quote:

A Sand Springs woman has been indicted on allegations that she used personal identifying information she copied from her then-employer's computer system as part of a scheme involving fraudulent credit cards and stolen mail.

http://www.tulsaworld.com/news/article.aspx?subjectid=14&articleid=20100408_14_A11_ASandS993612[/url]
_________________
"I suck at internet."

New's in the Scene :: Hack In The Box 2009 Videos Posted

Author: Saint_Patrick
Subject: Hack In The Box 2009 Videos Posted
Posted: Mon Mar 22, 2010 9:00 pm (GMT -6)
Topic Replies: 0

It seems that the HITB Malaysia 2009 video torrents are out.

DL - Torrent - Day 1
http://video.hitb.org/hitbsecconf2009malaysia-day1.torrent

DL - Torrent - Day 2
http://video.hitb.org/hitbsecconf2009malaysia-day2.torrent[/url]
_________________
"I suck at internet."

Code Foo () :: binaryeti - Archiving System Files for Binary Diff Analysis

Author: Saint_Patrick
Subject: binaryeti - Archiving System Files for Binary Diff Analysis
Posted: Sun Mar 21, 2010 11:52 am (GMT -6)
Topic Replies: 0

I wrote a small utility to archive Windows system files for binary diffing (ri0t showed off some techniques for the diffing process at a previous DC405 mtg). What this tool does is straightforward and simple, but I think useful nonetheless.

It takes a parent directory from the user, and archives system dlls and ocxs in a structure like <yourparentdir>/<filename>/<fileversion|MD5>. By running this utility after updates we leave the user with a structured vault of current and previous system files.

If you'd like to see it working(screenshots) or want an installer check out: http://www.l1pht.com/2010/03/archiving-windows-system-files-for-binary-diffing/

Code:

using System;
using System.Diagnostics;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.IO;
using System.Text;
using NDesk.Options;

/* Description:
Light-weight utility to help maintain an archive of Windows system files.
* Possibly useful for binary diff analysis of MS updates.
*
* Distributed:
* L1pht Offensive Labs http://www.l1pht.com
* Bugs, comments, suggestions saintpatrick@l1pht.com
*
* Feature Requests:
* - Store MD5 information for each file in a searchable database. Neat, but not certain the need is there.
*
* History:
* - 3/20/2010 Built
*/

namespace binaryeti
{
class Program
{
// This should work across versions
static string systemFolder = Environment.GetFolderPath(Environment.SpecialFolder.System);

static void Main(string[] args)
{
string homepath=string.Empty;
bool help = false;

OptionSet yetiOptions = new OptionSet()
{
{"p|path=","The parent path of the archive",v=>homepath=v},
{"h|help","Show this screen",v => help=v != null},
};

// Let the Yeti have some args. nom nom.
yetiOptions.Parse(args);

if (help)
{
ShowHelp(yetiOptions);
return;
};

// If we have a parent we can do the rest.
if (homepath == string.Empty)
{
ShowHelp(yetiOptions);
}
else
{

DirectoryInfo systemDir = new DirectoryInfo(systemFolder);
string sanitizedFileVersion;

Console.WriteLine("[*] Starting archive process");

foreach (FileInfo file in systemDir.GetFiles())
{
if (file.Extension == ".dll" | file.Extension == ".ocx")
{
string newParentPath = homepath + file.Name;
FileVersionInfo currentFilesVersionInfo = FileVersionInfo.GetVersionInfo(file.FullName);
if (currentFilesVersionInfo.FileVersion != null)
{
sanitizedFileVersion = FilenameStripperPole(currentFilesVersionInfo.FileVersion);
}
else
{
// If I don't have some sort of reliable version I'm using the MD5 of the file.
sanitizedFileVersion = GetMD5HashFromFile(file.FullName);
Console.WriteLine("[*] Had to use MD5 for version folder for file: " + file.Name);
}

if (Directory.Exists(newParentPath)!=true)
{
Directory.CreateDirectory(newParentPath);
}
try
{
if (Directory.Exists(newParentPath + "\\" + sanitizedFileVersion) != true)
{
Directory.CreateDirectory(newParentPath + "\\" + sanitizedFileVersion);
Console.WriteLine("[*] Archiving " + newParentPath + "\\" + sanitizedFileVersion);
File.Copy(file.FullName, newParentPath + "\\" + sanitizedFileVersion + "\\" + file.Name);
}
}
catch (Exception ex)
{
Console.WriteLine("[X] Error archiving due to: " + ex.Message);
}

}
}

Console.WriteLine("[*] Archive process finished");

}
}

/// <summary>
/// Shows the command line options for the utility
/// </summary>
/// <param name="myoptionset">The NDesk OptionSet created for the utility</param>
static void ShowHelp (OptionSet myoptionset)
{
Console.WriteLine ("Usage: binaryeti [OPTIONS]");
Console.WriteLine();
Console.WriteLine ("Fill out the args and I'll archive your "+ systemFolder +" dlls and ocxs.");
Console.WriteLine ();
Console.WriteLine ("Options:");
myoptionset.WriteOptionDescriptions (Console.Out);
}

/// <summary>
/// Function to retrieve MD5 hash for a file
/// </summary>
/// <param name="fullFileName">The path of the file to hash</param>
/// <returns>A string containing </returns>
static string GetMD5HashFromFile(string fullFileName)
{
StringBuilder sb = new StringBuilder();

try
{
FileStream file = new FileStream(fullFileName, FileMode.Open);
MD5 md5 = new MD5CryptoServiceProvider();
byte[] retVal = md5.ComputeHash(file);
file.Close();

for (int i = 0; i < retVal.Length; i++)
{
sb.Append(retVal[i].ToString("X2"));
}
}
catch (Exception ex)
{
Console.WriteLine("[X] Error during MD5 hashing of: " + fullFileName);
Console.WriteLine("[X] " + ex.Message);
}
return sb.ToString();
}

/// <summary>
/// Lame function to strip out invalid directory chars.
/// </summary>
/// <param name="originalString"></param>
/// <returns></returns>
static string FilenameStripperPole(string originalString)
{
originalString = originalString.Replace(":", "");
originalString = originalString.Replace("?", "");
originalString = originalString.Replace("<", "");
originalString = originalString.Replace(">", "");
originalString = originalString.Replace("|", "");
return originalString;
}
}

}

NOTE: If you want to build from that source, download and reference NDesk.Options lib.

Now go weaponize some 1-Day exploits!!
_________________
"I suck at internet."

Skills :: RE: Smashing SEH for Fun and Profit

Author: Saint_Patrick
Subject: More SEH fun with !pvefindaddr
Posted: Sun Mar 07, 2010 3:01 pm (GMT -6)
Topic Replies: 5

Recent post by Peter Van Eeckhoutte @ http://www.offensive-security.com/blog/vulndev/quickzip-stack-bof-0day-a-box-of-chocolates/ contains a detailed walkthrough of an SEH exploit (some of the issues encountered go beyond straight SEH).

This article is also worth mentioning for it's demonstration of using the !pvefindaddr tool. Definitely some niceties worth making use of.
_________________
"I suck at internet."

General :: RE: What the hell happened here?!?

Author: Stealth
Posted: Mon Feb 08, 2010 6:44 pm (GMT -6)
Topic Replies: 3

JxT left, so everybody went into the bat cave.

General :: RE: Just another newb

Author: Stealth
Posted: Mon Feb 08, 2010 6:43 pm (GMT -6)
Topic Replies: 2

I like newbs dipped in BBQ Sauce!

General :: RE: Just another newb

Author: haley
Posted: Fri Feb 05, 2010 4:29 pm (GMT -6)
Topic Replies: 2

i love newbs.

Meeting Info :: RE: February 5th, 2010 Meeting

Author: haley
Posted: Fri Feb 05, 2010 4:27 pm (GMT -6)
Topic Replies: 3

DH405 wrote:

Saint_Patrick wrote:

..Furries..

baudfish wrote:

i'll be there

I'll bet you will.

are you in any position to throw stones?