OpenRCE: Blog

Linux kernel 2.6.31 perf_counter_open exploit

Thu, 24 Sep 2009 10:24:43 -0500

Well, it has been a while since my last technical post � More than 1 year ?!? Wow, time runs so fast :)

So let�s go for a post about Linux kernel exploitation (yeah, I know, sounds cool). We will exploit a quite recent bug in kernel 2.6.31 (still unpatched while writing this) in the perf_counter_open syscall (CVE 2009-3234) to gain root privileges. As real hackers say, f34R.

But, let�s start by the begining: the bug.
Read More ...

Intel(r) switches backdoor

Mon, 19 May 2008 16:53:19 -0500

I recently got an Intel(r) Express 530T switch from eBay. It�s a �Manageable� switch, this means that you can connect to the switch through a null modem cable, telnet or a web interface to modify the switch configuration (Change MAC address filtering, create/delete VLANs, change ports speeds an priority, �).

But when I tried to connect to the switch, I discovered that the switch hadn�t been reseted, and that the seller didn�t gave me the username and password needed to manage the switch.

After trying to find any reset button around, under, and even inside the switch, I sent a mail to the seller and contacted the Intel support.
As the seller wasn�t responding and the Intel support wasn�t able to give me a reset procedure, I crawled the web, and managed to find a little Intel(r) utility �that does not exists�, according to the russian website that was distributing it...
Read More ...

Writing exploits for Metasploit 3.0

Thu, 24 Jan 2008 13:36:33 -0600

This article is about writing exploit using the Metasploit Framework, for very secure software: bof-server ;)
Bof-server has been written especially to be exploited during this article, and as you already guessed by looking at it�s name, we will exploit a stack overflow bug. You can find bof-server here: ...

Read More ...

x86 calling conventions

Sat, 19 Jan 2008 02:28:12 -0600

This is the first article of a (I hope) long series of articles about 'The Basics: What everyone should know about' :)

The calling convention defines the way a function or a piece of code should arrange data before calling a function, and what to do after. It responds to questions like "In which order should I pass the arguments ?", "Should I clean something ?", "Where is the result ?", ...

Read More ...