Hello, this came up to my head while i was reading a traceroute
implementation.
This traceroute has a similar bug, it refers to an array of pointers
and the int value that is acting as the array index is unsigned. The
problem is
that it does something like this

pointer_array[unsigned_int] = mallo

[ more ]  [ reply ]

In-Reply-To: <F36BC027FD4D7E4FB9EA59EFAF86BAAD11AEE4 (at) mex0010mf01.na.xerox (dot) net [email concealed]>

>Does any one knows a method to retrieve the password for the SAM
>(NT/W2K) that has been encripted with syskey? Or bypass the system
>startup password?

Proactive Windows Security Explorer allows that:

http://www.elco

[ more ]  [ reply ]

Thank to all for your answers.

To avoid misunderstandings what i am looking for is the password for the
SAM not the users/passwords.

Best regards

-----Original Message-----
From: Johnson, Joey [mailto:Joey.Johnson (at) MWAA (dot) com [email concealed]]
Sent: Jueves, 10 de Febrero de 2005 01:23 p.m.
To: Anzaldo, Oscar; vuln-

[ more ]  [ reply ]

You have lots of options with Windows.
Easiest solution- Get a copy of ERD and just change the password

-----Original Message-----
From: Anzaldo, Oscar [mailto:Oscar.Anzaldo (at) xerox (dot) com [email concealed]]
Sent: Tuesday, February 08, 2005 10:50 AM
To: vuln-dev (at) securityfocus (dot) com [email concealed]
Subject: SAM encrypted with syskey

Hi

[ more ]  [ reply ]

I searched amazon for books on mail protocols such as pop2/3, imap3/4
and smtp but wasn't able to find anything interesting, like code examples.

What puzzles me are the mime encodings and if it's possible to write
back to an imap server, you read the message, modify the body and write
the chang

[ more ]  [ reply ]

The boot floppy you can find here
http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
seems to have the ability to circumvent syskey.

-Jason

-----Original Message-----
From: Anzaldo, Oscar [[REMOVED]]
Sent: Tuesday, February 08, 2005 9:50 AM
To: [REMOVED]
Subject: SAM encrypted with syskey

H

[ more ]  [ reply ]

Hi list,

Does any one knows a method to retrieve the password for the SAM
(NT/W2K) that has been encripted with syskey? Or bypass the system
startup password?

Regards

Oscar.

[ more ]  [ reply ]

> From: q q [mailto:systemcracker (at) gmail (dot) com [email concealed]]
> Sent: Saturday, 05 February, 2005 14:08
> To: vuln-dev (at) securityfocus (dot) com [email concealed]
>
> create a file named foobar.html
> create a folder named foobar_files
> copy a bunch of files (of any type) inside foobar_files
> delete foobar.html
>
> notice that windows h

[ more ]  [ reply ]

Off-by-one exploits do not work by pointing ebp at shellcode like a
straightforward exploit does with eip. ebp points to the local stack
frame. The ebp stored on the stack points to the previous local stack
frame. You need to modify the saved ebp value to manipulate the stack
frames in such a way

[ more ]  [ reply ]

Hi,

I have problem to exploit an off by one vulnerability. When i overwrite ebp with some data and i´t point to my NOPS, i receive an SIGSEGV message.

SIGSEGV message in 0x90909090 ??

I´m using red hat 7.3 and gcc 2.95.

Anybody knows why 0x90909090 broke my exploitation ?

Thanks

Breno

[ more ]  [ reply ]

well, the title says it all really;

create a file named foobar.html
create a folder named foobar_files
copy a bunch of files (of any type) inside foobar_files
delete foobar.html

notice that windows has also deleted foobar_files and everything inside it

the reason is that when you choose to save a

[ more ]  [ reply ]

This web services was not using WS Security was it?
I am assuming the xml encryption was custom or was it provided by WSE?

-----Original Message-----
From: Mads Rasmussen [mailto:mads (at) opencs.com (dot) br [email concealed]]
Sent: Friday, February 04, 2005 7:33 AM
To: vuln-dev (at) securityfocus (dot) com [email concealed]
Subject: Re: xml over https

[ more ]  [ reply ]

Here are some references from MS to get you started:

"Stop SQL Injection Attacks Before They Stop You"

http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/

"Validating User Input"

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/bldgapp
s/ba_highprog_11kk.asp

"Cross

[ more ]  [ reply ]

SOAP provides the transport envelope for XML. XML represents and extends HTML data by providing additional descriptions via metadata. WSDL describes the web services, while UDDI supports registration and discovery of web services. All are evolving protocols that take advantage and use existing proto

[ more ]  [ reply ]

I don't have much details on the application yet, but I will have to
analyse an application using xml encodings over https.
Don't know if it's SOAP although I don't think so.

I was thinking of applying some injection techniques, if anyone has some
pointers I would appreciate them

Thanks

Mads

[ more ]  [ reply ]

Fabio,
It has very little to do with IE. The hs_err_pidXXXX.log files are
dumps that the JVM makes when it crashes when in native code.

I belive this JVM bug may be:
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4816519

There are reports of this happening on NT and XP, but since the bug

[ more ]  [ reply ]

Hi at all,

yesterday evening I was working at my pc, running multiple windows of
Internet Explorer at the same time. When I tried to open the 40th IE's
windows (I know, 40 windows simultaneously open is a big number, but I had
many reasons to do this kind of operation... :-/) I encountered a crash

[ more ]  [ reply ]

Filename with greetings ... sorry

On Sun, 30 Jan 2005 00:41:16 -0600, <benoror (at) gmail (dot) com [email concealed]> wrote:
> /* WC-ms05002-ani-expl-cb.c: 2005-01-30: PUBLIC v.0.2
> *
> * Copyright (c) 2004-2005 WhiskyCoders.
> *
> * (MS05-002) Microsoft Internet Explorer .ANI Files Handling Exploit
> * (CAN-2004-1049)

[ more ]  [ reply ]

Hello, this is my first post. I hope its in the list.

I am posting to get some help in developing an exploit for such a condition.

The environment:
Freebsd machine, nonexec heap/stack. This is a suid binary, but is
not calling setuid().

main()
{
char * ptr ;
ptr = getenv("TERM");

[ more ]  [ reply ]

Well i was trying to find something in .ra format. I found something
interesting(I think)
I had an old .Ra and tryed to change some information of the file(via
an hexadecimal editor):
All my .ra files begin always with the following code:
.ra......ra4.........r.........>................+........
If

[ more ]  [ reply ]