Windows Defender's antivirus emulator was reverse engineered to better understand its behavior analysis techniques. The author analyzed the emulation process, which loads potentially malicious binaries into a virtual environment to observe runtime behavior. Key components like the CPU emulator and virtual filesystem were reversed. The author also developed tools to interact with and instrument the emulator. This exposed internal Defender functions and allowed fuzzing of the emulator's API implementations to search for vulnerabilities. The research provided insight into Defender's emulation-based behavior detection approach.
Automatic Exploit Generation (AEG) aims to automatically find vulnerabilities and generate exploits by analyzing source code through a series of steps:
1. It pre-processes source code to generate intermediate representations for binary and source code analysis.
2. It performs source code analysis to determine the maximum size of symbolic data.
3. It uses symbolic execution guided by an "unsafe path predicate" to find bugs in the source code and collect related information.
4. It performs dynamic binary analysis to gather runtime information needed for exploit generation.
5. It generates an "exploit predicate" using the collected information to hijack program control flow and execute shellcode.
6. It verifies whether the generated
Windows Defender's antivirus emulator was reverse engineered to better understand its behavior analysis techniques. The author analyzed the emulation process, which loads potentially malicious binaries into a virtual environment to observe runtime behavior. Key components like the CPU emulator and virtual filesystem were reversed. The author also developed tools to interact with and instrument the emulator. This exposed internal Defender functions and allowed fuzzing of the emulator's API implementations to search for vulnerabilities. The research provided insight into Defender's emulation-based behavior detection approach.
Automatic Exploit Generation (AEG) aims to automatically find vulnerabilities and generate exploits by analyzing source code through a series of steps:
1. It pre-processes source code to generate intermediate representations for binary and source code analysis.
2. It performs source code analysis to determine the maximum size of symbolic data.
3. It uses symbolic execution guided by an "unsafe path predicate" to find bugs in the source code and collect related information.
4. It performs dynamic binary analysis to gather runtime information needed for exploit generation.
5. It generates an "exploit predicate" using the collected information to hijack program control flow and execute shellcode.
6. It verifies whether the generated
- MAYHEM is a system for automatically generating exploits by combining concrete and symbolic execution. It aims to maximize the amount of work done while minimizing wasted effort.
- It uses a hybrid execution approach where it concurrently runs a concrete executor client and symbolic executor server. The client explores new paths while the server performs symbolic analysis.
- A key challenge is handling symbolic memory addresses, which MAYHEM addresses through techniques like value set analysis to bound possible addresses and index search trees to efficiently search the memory state space.
This document summarizes a research paper that presents FIRMADYNE, an automated dynamic analysis system for analyzing Linux-based embedded firmware. FIRMADYNE extracts firmware filesystems, emulates the firmware using QEMU, and performs dynamic analysis by hooking system calls, testing for vulnerabilities, and crawling accessible webpages. The researchers applied FIRMADYNE to a dataset of firmware images from 42 vendors and found that emulation enabled discovery of vulnerabilities, with original equipment manufacturers having the most.
This document discusses binary exploitation techniques, specifically buffer overflows. It begins with an overview of program memory sections like the stack, heap, data, and text. It then covers security options like RELRO, stack canaries, and ASLR that aim to prevent exploits. Finally, it dives into buffer overflows, explaining how overflowing a buffer can overwrite the return address on the stack to redirect program flow and potentially execute shellcode to get remote code execution. The goal of "pwn" techniques is to leverage program vulnerabilities to gain control of the target system.
This document summarizes a zero-day attack on the TP-Link SR20 router. It describes how the router runs an unauthenticated debugging protocol (TDDP version 1) that allows downloading files from TFTP if the second byte of a packet is 0x31, enabling arbitrary code execution. The document discusses initial reverse engineering efforts, including identifying the "tddp" file using binwalk and analyzing its functions in Ghidra to understand how it handles network packets and triggers the vulnerable configuration function.
Penetration test introduction for beginner.
It only contains a little of web pen-test .
(This is my first lesson teaching others about security!)
@頁厘壓嶄屎寄W_議匯銘B邑y秘Tn殻e中麼勣頁匯乂秘T議岑R]嗤湊侮議|廉咀緩載m栽兜W議Y芦杠稚灑^心。
(@頁厘及匯肝恂P豢Y芦議丕晩n殻咀緩嗤音Φ諜愀淳御岑厘xx艇)
25. 蛍喨従W揃揃尺
? c
? 晒
? 併
? ?垢殻庁侏晒
? H併MISO戻竃 OSI model
? H貧聞?喘議頁 TCP/IP model
26. OSI Model TCP/IP Model
及鈍 ?喘
Application Layer
?喘
Application Layer
及励啜攸 燕_?
Presentation Layer
及励
Session Layer
及膨
Transport Layer
Transport Layer
及膨
及眉 W揃揃
Network Layer
WHW揃揃
Internet Layer
及眉
及?屈 Y創Y
Data Link Layer
BY
Link Layer
及?屈
及?匯 w
Physical Layer
w
Physical Layer
及?匯
30. Transport Layer
? ?喘啜柘連壓緩啀伺亳^粁K紗貧會。
? 云?喘豢陣崙Y創KM?佩佩腐e、e`タ軅輌坿_隠Y創屎_僕_
? f協TCP、UDP
? ^粁(Segment)、Port、Socket
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
31. Port & Socket
? Port(B俊穏)
? 0~1023些qv殻塀、AO狼y殻塀
? 1024~65535再篷殻塀(?徭)
? Eg:
? HTTP80
? Telnet23
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
? Socket
? 參IP address才PortM撹socket address
? 撃淫ァ嗤輳甘c?朕議仇議socket address
泌緩秀羨B瘁祥辛參住QY創 。
? E.g. 127.0.0.1:8080
33. TCP & UDP
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
f協 ^粁會 e`タ軅 堀業 貧f協
TCP
Transmission Control
Protocol
B
(眉?圭燐?返)
嗤會 嶷 ^蛸
HTTP?
FTP
UDP
User Datagram Protocol
o o會 G ^酔
DNS?
軸r唹?咄堪堪送
35. 眉?圭燐?返 Three-Way Handshake
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
SYN
SYN-ACK
ACK
1. A債龝瓧
2. B採參昃牽椎低椿
3. A犀昃牽
4. blablabla..._兵υ
36. 眉?圭燐?返 Three-Way Handshake
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
SYN
SYN-ACK
ACK
撃淫會N_Ja
撃淫會M_JaN+1
撃淫會N+1_JaM+1
37. WHW揃揃 Internet Layer
? 云財楚楚柎毘殻業、捲嫺警|、撃淫枠會、揃揃喇債吉Q協
Y創恷煮僕揃揃彯
? O筍座径罫鋲(Router)
? f協IP
? 撃淫(Packet)
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
38. Internet Protocol
? IPv4(32 bits)
? 參?屈M了燕?幣10001100.01111011.00000101.00000101
? 械?鯉塀?噴M了140.123.5.5
? IPv6(128 bits)
? 械?鯉塀?噴鎗M了2001:4860:4860:0000:0000:8888
? :岻g飛飛脅頁巣辛?喘::音^?匯MIP峪辛聞?喘?匯肝緩。
? 2001:4860:4860::8888
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
40. ? 揃揃喇匂B俊謹?徨W揃揃
? 壓揖?匯?徨W揃揃筏綴C脅輦佻猖撞IP了峽
? ?徨W揃揃議及?匯IPNetwork ID
? ?徨W揃揃嶄議恷瘁?匯IP Boardcast IP
? 嘔D嶄嗤?徨W揃揃
? 233.1.2.0 /24、233.1.3.0 /24
?徨W揃揃 Subnet
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
233.1.2.1
233.1.2.2
233.1.3.1
233.1.3.2
233.1.3.0/24233.1.2.0/24
41. ? Mask 喇?屈M了M撹喜塘AND\麻辛孳盈峺協議Y創。
? 野1議了崔隠藻藻野0議了崔孳盈。
? Eg
孳孛 Mask
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
Data 11001001 10101010 11111111
Mask 11111111 11110000 10101010
Result 11001001 10100000 10101010
42. ? 喇?屈M了Bm議1M撹cIP議燕?幣?圭隈犒臓
? 呀辛壓IP瘁?圭參 仝/ 1議義秦拭恒?幣。
? 參貧?匯?蘋箭
? /24 旗燕32了圷嶄議念24了圷協x阻阻?徨W揃揃議了峽。
? 牀豢(11111111.11111111.11111111.00000000)2 ?
= (255.255.255.0)10
?徨W揃揃孳孛 Subnet Mask
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
43. ? 參192.168.239.176 /26蘋箭
?徨W揃揃麻
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
IP 11000000 . 10101000 . 11101111 . 10110000 = 192.168.239.176
Mask 11111111 . 11111111 . 11111111 . 11000000 = 255.255.255.192
Subnet 11000000 . 10101000 . 11101111 . 10000000 = 192.168.239.128
Network ID 11000000 . 10101000 . 11101111 . 10000000 = 192.168.239.128
Broadcast IP 11000000 . 10101000 . 11101111 . 10111111 = 192.168.239.191
45. Exercise
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
? 192.168.239.176 /23
? 緩W粁嗤 29 - 2 = 510 MIP辛參聞?喘。 (32 - 23 = 9 bits 壅諏茅?遍硫)
IP 11000000 . 10100000 . 11101111 . 10110000 = 192.168.239.176
Mask 11111111 . 11111111 . 11111110 . 00000000 = 255.255.254.0
Subnet 11000000 . 10100000 . 11101110 . 00000000 = 192.168.238.0
Network ID 11000000 . 10100000 . 11101110 . 00000000 = 192.168.238.0
Broadcast IP 11000000 . 10100000 . 11101111 . 11111111 = 192.168.239.255
46. BY Link Layer
? w啜?屈M了Y創M?佩佩腐e式タ軅蹇
? 陣崙和?匯c議了崔。
? O筍砂Q匂(Switch)
? 崇(Frame)
? f協MAC
? CRC、Checksum
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
47. Media Access Control
? MAC address (W揃揃触) 嗤 48 bits宥械參?噴鎗M了燕?幣。
? 耽MAC address脅頁?匯o?屈議。
? 械?鯉塀
? 74-D0-2B-C3-14-A2
? 74D0.2BC3.14A2
? 74:D0:2B:C3:14:A2
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
48. 住Q匂 Switch
? 住Q匂搆襟BY
? 參 MAC Address Table o光Port(初?中)議輳MAC address
? ∧婬週 frame Dl吏?朕Port(初?中)
? Switch貧議Portc枠念戻欺議Port古廷廷頁音揖議
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
49. w Physical Layer
? 云Y創e議了圷?匯?匯衣?崛和c。
? f協函Q豢w箪初
? pg~、高w、揖S|
? O筍
? W揃揃UTP o孳盈塀pg
? W揃揃初?中触
?喘
W
H
W
揃揃
B
Y
w
?喘
燕
_
W
揃揃
Y
創
Y
w
50. Y創撃b
Message ??????????????? Application
Message
Data Data Data
Segment ??????????????? Transport
Header
Data
Packet ????????? Network
Header
Transport
Header
Data
Frame ??? Frame
Header
Network
Header
Transport
Header Data Frame
Footer
Bits ??? 100101010101000010101010001001010100110101´..
53. ?匯?徨W揃揃f ( A ★ B )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
54. ?匯?徨W揃揃f ( A ★ B )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
IP Src. 192.168.10.11
IP Dest. 192.168.10.12
MAC Src. aaaa.aaaa.aaaa
MAC Dest. bbbb.bbbb.bbbb
淫
55. ?匯?徨W揃揃f ( A ★ B )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.10.12
MAC Src. aaaa.aaaa.aaaa
MAC Dest. bbbb.bbbb.bbbb
56. ?匯?徨W揃揃f ( A ★ B )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.10.12
MAC Src. aaaa.aaaa.aaaa
MAC Dest. bbbb.bbbb.bbbb
57. L7 L7
L6 L6
L5 L5
L4 L4
L3 L3
L2 L2 L2
L1 L1 L1
?匯?徨W揃揃f ( A ★ B )
A B
59. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.20.22
MAC Src. aaaa.aaaa.aaaa
MAC Dest. eeee.eeee.eee1
60. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.20.22
MAC Src. aaaa.aaaa.aaaa
MAC Dest. eeee.eeee.eee1
61. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫 IP Src. 192.168.10.11
IP Dest. 192.168.20.22
62. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫 IP Src. 192.168.10.11
IP Dest. 192.168.20.22
MAC Src. eeee.eeee.eee2
MAC Dest. dddd.dddd.dddd
63. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.20.22
MAC Src. eeee.eeee.eee2
MAC Dest. dddd.dddd.dddd
64. 睡?徨W揃揃f ( A ★ D )
192.168.10.11
aaaa.aaaa.aaaa
A
192.168.10.12
bbbb.bbbb.bbbb
192.168.20.21
cccc.cccc.cccc
B C
192.168.10.11
bbbb.bbbb.bbbb
192.168.20.22
dddd.dddd.dddd
D
192.168.10.0/24
192.168.20.1
eeee.eeee.eee2
192.168.10.1
eeee.eeee.eee1
192.168.20.0/24
淫
IP Src. 192.168.10.11
IP Dest. 192.168.20.22
MAC Src. eeee.eeee.eee2
MAC Dest. dddd.dddd.dddd
65. L7 L7
L6 L6
L5 L5
L4 L4
L3 L3 L3
L2 L2 L2 L2 L2
L1 L1 L1 L1 L1
睡?徨W揃揃f ( A ★ D )
A D