seen from Germany
seen from United States
seen from United States
seen from Malaysia
seen from China
seen from Germany
seen from France
seen from Macao SAR China
seen from Taiwan
seen from T1
seen from United States
seen from Germany
seen from Germany
seen from Netherlands
seen from Finland
seen from United States
seen from Russia
seen from Germany
seen from United States
seen from China
AI-Generated Exploit Used in First Known Zero-Day 2FA Bypass Campaign
Cybercriminals deployed AI-generated exploit code targeting a zero-day two-factor authentication bypass flaw in open-source web administration software for planned mass exploitation.
Source: Google Threat Intelligence Group
Read more: CyberSecBrief
Memory Address to Little Endian
This is just a little code snippet (in Python) to convert a memory address to little endian format.
#!/usr/bin/python import sys,struct,binascii,re,os script = os.path.basename(__file__) if len(sys.argv) < 2: print "Usage: ./%s <mem addr>\n ./%s 0x41424344" % (script, script) sys.exit(1) eip = int(sys.argv[1],0) # e.g. 0x41424344 def format_eip(i): return struct.pack('<L', i) reversed = format_eip(eip) # This is just to pretty print the hex in the terminal (i.e. # print as '41 41' instead of auto-formatting as ASCII 'A A'). # Just use 'reversed' directly in buffers reversed_bin = binascii.hexlify(reversed) print "\nin little-endian: %s" % reversed_bin # Print again, this time as a shellcode ready string with \x's formatted_split = "" split = re.findall('..',reversed_bin) for i in split: i=r'\x'+i formatted_split += i print " shellcode ready: %s \n" % formatted_split
This is what it looks like when it runs:
Most of this code is just there for formatting it correctly for view from the terminal as you run the script. If you were using the returned value directly in your payload, you'd need only do something such as:
#!/usr/bin/python ...snip... import struct import binascii def format_eip(i): return struct.pack('<L', i) eip = 0x41424344 buffer = "A"*4000 buffer += format_eip(eip) ...snip...
OSCE Exam Prep
It’s nearly time..! In just a few days I’ll be attempting the Offensive Security Certified Expert (OSCE) exam. Yikes. I’m already certain that this is going to be the single most difficult challenge I’ve undertaken personally, professionally, and academically, to date.
Given the above, and that the exam goes for 72 hours (48 hours + 24 hours reporting), I’ve been developing a series of scripts and cheatsheets so that I can make the most of my exam time, and maybe even prevent a few little mistakes caused by sleep deprivation.
This is one of the cheatsheets. I find that I commonly look for many of these commands and opcodes during exploit development.
