AddressSanitizer

Using AddressSanitizer aka (ASan) is one of the effective approaches to find vulnerabilities for C/C++ applications. You have already knew that most of the "Use After Free" browser vulnerabilities were found by ASan (http://tinyurl.com/b33fhwa).

The installation is quite easy but takes time.You need to install LLVM and clung frontend to use Asan. If you want to use Asan with an application , you should compile it with clung and this sometimes fails due to makefile settings. 

I caught a buffer overflow vulnerability while testing a http server that is mostly designed for embedded systems by using addresssanitizer, you need to be patient and try different variation of possibilities on frontend for an effective result.

Here you can find the output of an exception. 

I suggest to use gdb while making tests , otherwise it might be hard to catch register and exploitable status of vulnerability. You can also find o ASan features and capabilities from the following presentation. (http://tinyurl.com/aycobo9)

Upcoming GCC version 4.8 will include Asan with  enabling -fsanitize=address during make.  

Oracle Database Security Auditing Baseline

After spending some time about the security of auditing on Oracle DB . I decided to share some important "must to do" shortnotes with you. 

The first thing should be enabling the sys operation audits these are performed by sys, sysdba, sysoper users. To enable auditing of these users  the “audit_sys_operations” parameter on the database must set to “true”.

ORA-01756 and ORA-01789 error triggers should also be created for SQL Injection Detection. I can suggest that these triggers should also be logged for detective purposes. Especially ORA-01756 is more important than the other.

Audit_Trail  parameter must set to value OS, so that the audit files can be written to filesystem rather  than database.

The audit trails for users with sysdba and sysoper roles once enabled are always generated externally using operating system files in a location specified by audit_file_dest regardless of the audit_trail parameter setting.

Oracle has four options as a logging type. Object Base, Fine Grained Auditing, System Privileged and Statement based auditing.I did not prefer to go with object based or fine grained auditing. (if you have time to look inside the tables you can go with these options too). So i used Privileged and Statement base auditing to keep it short.  Just keep in mind that if the privileged and statement point the same event , oracle just audits one  log. Both the privileged and statement auditing have an option to log the event as a session or access modes  with success and failure event type. So my selection was Session with both success and failure modes. 

Statements to be Audit Enabled:

The shortcut definations can be found at http://bit.ly/UU6sXM

Be careful about enabling yellow ones, they can create so much audit. The blue ones i discarded

System Privileges to be Audit Enabled: 

You can see the all system privileges from  http://bit.ly/127c7y2: The list was so long i did not paste the table but it was the same approach as statement example. 

Exceptions:

The internal Oracle accounts should be disabled to prevent mass logging such as dbsnmp user.  You may also create exception for interface accounts unless they use, create, modify sensitive data.

Finally, you can check the enabled audit options from the following tables:

"DBA_STMT_AUDIT_OPTS" and "DBA_PRIV_AUDIT_OPTS"

                 

Canon Netspot Console Heap Overflow

Windbg Output :


First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=cccccccc ebx=00390000 ecx=01317ae8 edx=00390378 esi=01317ae0 edi=cccccccc
eip=7c910cce esp=0114fbbc ebp=0114fddc iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
ntdll!RtlAllocateHeap+0x567:
7c910cce 8b10            mov     edx,dword ptr [eax]  ds:0023:cccccccc=????????
0:002> u 7c910cce
ntdll!RtlAllocateHeap+0x567:
7c910cce 8b10            mov     edx,dword ptr [eax]
7c910cd0 3b5704          cmp     edx,dword ptr [edi+4]
7c910cd3 0f85505c0200    jne     ntdll!RtlAllocateHeap+0x579 (7c936929)
7c910cd9 3bd1            cmp     edx,ecx
7c910cdb 0f85485c0200    jne     ntdll!RtlAllocateHeap+0x579 (7c936929)
7c910ce1 8938            mov     dword ptr [eax],edi
7c910ce3 894704          mov     dword ptr [edi+4],eax
7c910ce6 3bf8            cmp     edi,eax

Payload Staging

Sometimes you can not find the way of run payload on buffer because of the space limitations. when it happens, you may use egghunting if you can  hold second payload on buffer or you can use metasploit staging payloads.

Basically first  stage  payload use VirtualAlloc to allocate some RWX memory and then download the second stage and so on..

I prepared a video of exploiting the vulnerable service(MiniShare WebServer) by using staging just for fun:) . ( I changed the injection vector from direct jmp esp to pop retn  + jmp esp with some fake stack alignment)