Jump to content

newbi3
 Share

Recommended Posts

Today I was at school and I opened up playonlinux on my Linux mint machine to download halo. To my surprise instead of seeing a list of applications to download I saw the raw HTML of my county's "block page". This got me thinking "Hey maybe we got something here". So to continue testing I opened up ettercap to see what was going here. Now I noticed that POL pulls a description of the application from the repository also (and here is the fun part) it looks like it is pulling the installation script from the repository. I have absolutely know clue where to go from here. I have never reverse engineered something before and I am wondering where there might be some documentation on reverse engineering and if there are any vulnerabilities in other applications like this that I can read documentation on.

Link to comment
Share on other sites

You could probably have a 3rd party script run that would rewrite the install script and have your rewritten code run instead of the install script, but I wouldn't call that an exploit.

Exploits are generally when an application crashes and you use the crash to gain control of one or more of the registers to get it to jump to your own instructions. Reversing is when you try to figure out what exactly a program is doing and how it's doing it. Reverse engineering and exploit development are different fields, but reversing would be the best place to start.

For reversing, the most famous tutorials are Lena's. Random's are also very good too.

http://tuts4you.com/download.php?list.17

www.thelegendofrandom.com

For exploit writing, Corelan's are the best.

www.corelan.be

Link to comment
Share on other sites

You could probably have a 3rd party script run that would rewrite the install script and have your rewritten code run instead of the install script, but I wouldn't call that an exploit.

Exploits are generally when an application crashes and you use the crash to gain control of one or more of the registers to get it to jump to your own instructions. Reversing is when you try to figure out what exactly a program is doing and how it's doing it. Reverse engineering and exploit development are different fields, but reversing would be the best place to start.

For reversing, the most famous tutorials are Lena's. Random's are also very good too.

http://tuts4you.com/...oad.php?list.17

www.thelegendofrandom.com

For exploit writing, Corelan's are the best.

www.corelan.be

Thanks a lot for this I have been looking for a place to start for a while

Link to comment
Share on other sites

  • 1 month later...

One possible way to exploit it is to arp spoof the network route all traffic thru your box ( you become the router) then write a IPtables rule to run a script if conditions are met (affectively spoofing the repo site)

Then the script you allow them to upload and run will have anything from email keylogger to adding a root user account.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...