windows - HACKINGISCOOL

windows

A collection of 6 posts

A case of DLL Side Loading from UNC via Windows environmental variable

About a month ago I decided to take a look at JetBrains TeamCity, as I wanted to learn more about CVE-2022-25263 (an authenticated OS Command Injection in the Agent Push functionality). Initially I just wanted to find the affected feature and test the mitigation put in place, eventually I ended

Improving the write-what-where HEVD PoC (x86, Win7)

Introduction This one is about another HEVD exercise (look here to see the my previous HEVD post); the arbitrary write (https://github.com/hacksysteam/HackSysExtremeVulnerableDriver/blob/master/Driver/HEVD/Windows/ArbitraryWrite.c). The main reason I decided to write up my experience with it is the fact that it instantly

HEVD StackOverflowGS x86 Win7 - exploitation analysis

Introduction This post is about kernel mode exploitation basics under Windows. It operates on assumptions that the reader is familiar with terms such as process, thread, user and kernel mode and the difference between user and kernel mode virtual address range. One could use this post as an introduction to

Cmd Hijack - a command/argument confusion with path traversal in cmd.exe

This one is about an interesting behavior 🤭 I identified in cmd.exe in result of many weeks of intermittent (private time, every now and then) research in pursuit of some new OS Command Injection attack vectors. So I was mostly trying to: * find an encoding missmatch between some command check/

PE Import Table hijacking as a way of achieving persistence - or exploiting DLL side loading

Preface In this post I describe a simple trick I came up with recently - something which is definitely nothing new, but as I found it useful and haven't seen it elsewhere, I decided to write it up. What we want to achieve So - let's consider backdooring a Windows

Vulnserver - my KSTET exploit (delivering the final stage shellcode through an active server socket)

The purpose of writing this up was only to present a little trick I came up with while playing with vulnserver's (http://www.thegreycorner.com/2010/12/introducing-vulnserver.html) KSTET command (one of many protocol commands vulnerable to some sort of memory corruption bug). In spite of the hardcoded addresses,

No one really gives a shit about cookies and neither do I