Upcoming Courses and Security Training

BlackHat Offensive Security Training Courses are selling out…sign up quick! To all those who signed up – we’ve got some special things planned for you, you’re definitely in for a ride. Thanks for flying Offsec.

Read More

QuickZip Stack BOF 0day: a box of chocolates

A few days ago, one of my friends (mr_me) pointed me to an application that appeared to be acting somewhat “buggy” while processing “specifically” crafted zip files.  After playing with the zip file structure for a while (thanks again, mr_me, for documenting the zip file structure), I found a way to make the application crash and overwrite a exception handler structure.

In this article, I will explain the steps I took to build an exploit for this bug. 

… Read more »

Read More

PWB V.3.0 Available March 21st, 2010

The Offensive Security team is excited to announce the release date of v3.0 of the Pentesting With BackTrack Course.  On March 21, 2010 the course will be made live. The team has worked overtime to ensure the videos and labs are better than ever.

With new modules, more in depth explanations and a new rich lab environment, this will prove to be a very exciting release. We are opening up early registration for those interested in signing up now.  

… Read more »

Read More

Multiple Media Player HTTP DataHandler Overflow

We recieved an interesting submission today at exploit-db from Dr_IDE. We have verified that both Quicktime and Itunes crash on Windows and OSX. The description reads:

“There is a widespread failure in the way that (.MOV) files are handled by the Quicktime Library. I have attempted to compound my findings on this issue.

Nearly every (.MOV) enabled application that I tested fell victim to this exploit. This is a local memory corruption vulnerability in the way these programs process a malformed file.

… Read more »

Read More

Pentesting With BackTrack v.3.0

BackTrack 4 Downloads are still going strong with over 30,000 registered downloads up to now. We are currently working on updating our new course materials based on BackTrack 4. We expect the new version to be available soon.

As always, alumni students will be able to upgrade their version of PWB. The upgrade fee will (as usual) be the difference between the current price and new one. No, we don’t have pricing information at this point!

… Read more »

Read More

BackTrack 4 Final Release

Taken  from the new BackTrack Site :

BackTrack 4 Final is out and along with this release come some exciting news, updates, and developments. BackTrack 4 has been a long and steady road, with the release of abeta last year, we decided to hold off on releasing BackTrack 4 Final until it was perfected in every way shape and form.

With this release includes a new kernel, a larger and expanded toolset repository,

… Read more »

Read More

Exploit-DB Updates

Lots of new updates in the exploit-db arena. Barabas whipped up a quick browser search bar plugin.

We got a massive CVE / OSVDB entry update from Steve Tornio which was added to our DB. Our “perfect” exploit template now has links to the exploit code, vulnerable app , CVE and OSVDB entries. See this example. You can now search for exploits via CVE or OSVDB.

We’ve added a new column to the database –

… Read more »

Read More

Explo.it – The Day After

The Exploit Database is up and running…survived day 1 . On a last moment fluke, we registered the domain https://www.exploit-db.com/, which is now also up and running.

We’ve improved the search functions on the site, and imported the “papers” and “shellcode” sections from Milw0rm. We’ve been getting our first submissions and are processing them almost in real time. We’ve set up an IRC channel on freenode  #exploitdb,

… Read more »

Read More

Offensive Security Exploit Archive Online

After a short and intense setup, we are ready to present the Offsec Exploit Archive. We’ve recreated the milw0rm database, updated it and are now accepting submissions. The purpose of the site is to provide researchers and security enthusiasts a repository of exploits, and when possible, the relevant affected software. We’ve started the party by posting a few new exploits of our own – namely a Novell eDirectory 8.8 SP5 iConsole Buffer overflow exploit and a HP Power Manager Administration Universal Buffer Overflow Exploit.

… Read more »

Read More

Offsec Web Server Hacked

For the past couple of weeks we have been watching escalating DOS attacks against our web server, specifically against the Metasploit Unleashed Wiki. Today as we were watching our apache logs, we noticed unusual requests. A quick analysis showed that our web server was compromised through a vulnerability in the wiki software we use for the free Metasploit course. The compromise occurred on Nov 6th,and went unnoticed for  around 28 hours.

A php shell was uploaded to the wiki through an obscure vulnerability,

… Read more »

Read More

Offensive Security Exploit Archive

For the past few months, Offensive Security has been working with additional exploit addicts (Rel1k) at maintaining the integrity of the Milw0rm exploit archive. For those who don’t know, Milw0rm has been dormant in the past few weeks, for reasons which remain with str0ke (he is alive, healthy and well btw).

Offensive Security together with Gerix.it will be picking up from the place Milw0rm left, and will be maintaining a new exploit archive collection which will be open to the public.

… Read more »

Read More

Metasploit Rising

The Framework that we all know and love is about to take a massive leap into the future.   The MSF crew as well as the MSF itself has been placed under Rapid 7’s corporate umbrella.

The framework will continue to be free, running under the BSD license. We expect to see major improvements in the MSF due to this shift. With corporate backing there will be more resources and time to improve the MSF.

… Read more »

Read More