[Full-disclosure] nullsec-net-crypter.pdf

Hello, we just released a new paper, which discusses ideas of advanced runtime encryption of .NET executables. You can find the paper here: http://www.nullsecurity.net/papers.html Enjoy reading it. Cheers, noptrix -- Name: Levon 'noptrix' Kayan E-Mail: nopt...@nullsecurity.net GPG key:

[Full-disclosure] rubilyn-0.0.1.tar.gz - Mac OS X rootkit

Hi FD, we are bored and wanted to share something with you: name rubilyn description === 64bit Mac OS-X kernel rootkit that uses no hardcoded address to hook the BSD subsystem in all OS-X Lion below. It uses a combination of syscall hooking and DKOM to hide activity on a host.

Re: [Full-disclosure] Predefined Post Authentication Session ID Vulnerability

:D On 07/11/12 15:56, Benji wrote: I have no words, just shock. On Wed, Jul 11, 2012 at 9:34 AM, Gokhan Muharremoglu gokhan.muharremo...@iosec.org wrote: Vulnerability Name: Predefined Post Authentication Session ID Vulnerability Type: Improper Session Handling Impact: Session Hijacking

[Full-disclosure] New Tool - U3-Pwn.tar.gz

Hi list, FILE U3-Pwn.tar.gz - http://www.nullsecurity.net/backdoor.html DESCRIPTION === U3-Pwn is a tool designed to automate injecting executables to Sandisk smart usb devices with default U3 software install. This is performed by removing the original iso file from the device and

[Full-disclosure] New tool: Hyperion - A runtime encrypter for 32-bit PE files

Hi there, We just published Hyperion-1.0.zip source code at nullsecurity. The presentation / slides are also available. [ FILE ] Hyperion-1.0.zip [ DESCR ] Hyperion is a runtime encrypter for 32-bit portable executables. It is a reference implementation and bases on the paper Hyperion:

[Full-disclosure] Hyperion - Paper about Windows PE run-time encryption

Hello, few minutes ago, we released a paper about windows PE runtime crypters. A short description: Hyperion: Implementation of a PE crypter - This paper reveals the theoretic aspects behind run-time crypters and describes a reference implementation for Portable Executables. You can find the

[Full-disclosure] nullsec-bypass-aslr.pdf - ASLR / ASLR bypass techniques

a salam alaikum list, a nice written paper by TheXero, who wants to share y0u: A paper discussing ASLR (Address Space Layout Randomization) and techniques to evade the protection you can find the paper at: http://www.nullsecurity.net/papers.html cheers, noobtrix -- Name: Levon 'noptrix'

[Full-disclosure] fasmaes-1.0.tar.gz - An AES implementation for Flat Assembler (FASM)

yo was geht? DESCRIPTION === An AES-128, AES-192 and AES-256 implementation for FASM. Uses the the x86 32-bit instruction set and operates completely on the stack. No additional data segments are necessary which makes it easy to integrate the AES functions in any existing project. The

[Full-disclosure] trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

Hi there, description === trixd00r is an advanced and invisible userland backdoor based on TCP/IP for UNIX systems. It consists of a server and a client. The server sits and waits for magic packets using a sniffer. If a magic packet arrives, it will bind a shell over TCP or UDP on the

Re: [Full-disclosure] trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

privet, On 02/08/12 23:03, Kai wrote: Hello, trixd00r is an advanced and invisible userland backdoor based on TCP/IP for UNIX systems. It consists of a server and a client. The server sits and waits for magic packets using a sniffer. If a magic packet arrives, it will bind a shell over TCP

Re: [Full-disclosure] trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

On 02/08/12 22:55, Kryton Jones wrote: Is this something like Port Knocking ?? you can see that kinda as port knocking yes. http://en.wikipedia.org/wiki/Port_knocking On 09/02/2012, at 8:29 AM, Levent Kayan wrote: Hi there, description === trixd00r is an advanced

[Full-disclosure] sshtrix - a very fast multithreaded SSHv1 and SSH1v2 login cracker (version 0.0.2)

hi there, i publish sshtrix version 0.0.2 with lot's of improvements and features. nice tool. ;) you can get it here: http://www.noptrix.net/codes.html cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423

[Full-disclosure] sshtrix - a very fast multithreaded SSHv1 and SSH1v2 login cracker

hello, you can get it from: http://www.noptrix.net/codes.html also, you will find a small description. cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage:

[Full-disclosure] Skype 5.3.*.5.2.* Critical Pointer Vulnerability

hello, http://vulnerability-lab.com/get_content.php?id=180 cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage: http://www.noptrix.net/

[Full-disclosure] Skype (= 5.5.0.113, Windows) html/js code injection vulnerability

hello, http://www.noptrix.net/advisories/skype_inject.txt hint: applet/object tags + extern .js files. :) cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage:

[Full-disclosure] Adium = 1.4.2 HTML/Javascript, XSS advisory

hello, bzzzt, lolday: http://www.noptrix.net/advisories/adium_inject.txt - next bug is coming (off-by-one) /* no comment */ cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0

[Full-disclosure] Skype - local remote Denial Of Service vulnerability - crash exploit (0day)

Hello, http://www.youtube.com/watch?v=b9p4BZ0vsAI - vulnerability-lab.com upcoming ~5 bugs soon. cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage:

[Full-disclosure] ICQ = 7.5 remote Denial of Service (0day)

Hello, Adv: http://www.noptrix.net/advisories/icq_dos.txt PoC: http://www.youtube.com/watch?v=7I1JNUWLeec cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0 Homepage:

[Full-disclosure] ICQ 7.5 Client - remote client hijacking vulnerability (0day)

hello, XSS POWER!!!111 @ http://noptrix.net/advisories/icq_cli_xss.txt ICQ 7.5 client http://noptrix.net/advisories/icq_web_xss.txt icq.com webpage cheers, noptrix -- Name: Levent 'noptrix' Kayan E-Mail: nopt...@lamergarten.net GPG key: 0x014652c0 Key fingerprint: ABEF 4B4B 5D93 32B8 D423

Re: [Full-disclosure] Skype = 5.3.0.120 persistent Cross-Site Scripting Issue

some ppl asked me for recordings. here we go: attacker: http://www.noptrix.net/tmp/skype_linux.ogv winXP victim: http://www.noptrix.net/tmp/skype_winxp.ogv win7 victim: http://www.noptrix.net/tmp/skype_win7.avi cheers, noptrix On 07/13/11 16:08, Levent Kayan wrote: Within I will disclose

[Full-disclosure] Skype = 5.3.0.120 persistent Cross-Site Scripting Issue

Within I will disclose a platform-neutral Cross-site scripting vulnerability in Skype which can be exploited to hijack user's session IDs or compromise user's browser/system. The vulnerability is caused by poor validation and sanitization of input/output. Links: PoC and advisory can be found

Re: [Full-disclosure] [Amsn-devel] aMSN = 0.96 remote DoS vulnerability

On Mon, Apr 23, 2007 at 10:11:38AM +0200, Ferdinand Klinzer wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 But that sound funny levent_ but still you are 31337 hacker pz :) Am 22.04.2007 um 17:51 schrieb Levent Kayan: On Sun, Apr 22, 2007 at 05:41:25PM +0200, Sebastian Rother

Re: [Full-disclosure] [EMAIL PROTECTED]: Re: [Amsn-devel] aMSN = 0.96 remote DoS vulnerability]

On Sun, Apr 22, 2007 at 07:06:15PM +0300, Ismail D?nmez wrote: On Sunday 22 April 2007 18:51:39 Levent Kayan wrote: [...] 31337 is just an example port! aMSN is binding an ephermal port after you've started it. Just do a netstat -an and look for ephermal ports. If you get the aMSN port you

Re: [Full-disclosure] [Amsn-devel] aMSN = 0.96 remote DoS vulnerability

(amsn window). But if you going to send more than one character of '}' or '{' it will be killed. Yes, the whole client! To Ismail Soenmez: What about DDoS? Sending characters to that port in an infinite loop is a DDoS for you? -- Name: Levent Kayan E-Mail: [EMAIL PROTECTED] GPG key: 0xd6794965

[Full-disclosure] aMSN = 0.96 remote DoS vulnerability

/* * bug: amsn remote DoS vulnerability * affected version: = 0.96 * site: http://amsn-project.net/ * tested: amsn-0.96 on freebsd 6.2 * * author: levent kayan * date: Tue Mar 27 16:04:51 CEST 2007 * www.corehack.org */ /* Introduction */ amsn is a free open source MSN Messenger clone