Note: I also followed this: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/boot-parameters-to-enable-debugging to get debugging working
Windows Drivers Part 2: IOCTLs
In this article, we are going to delve further into how a kernel driver works. In the first part, we talked about getting an environment set up. A lot of this comes from this article.
A driver is purely in kernel space, but it exists to service user space programs, and…
Loading a driver on the fly
In previous entries, the way we have loaded a device driver was to use OSR’s Driver Loader so that we could quickly install, uninstall, start, and stop the service. We did this because it was quicker than putting an entry in the registry (which requires a reboot to complete). So how to do you load…
Basic Shellcode — Stack Smashing (No DEP, No ASLR)
Ten years ago, the world was just recovering from the dot com bubble, running Windows XP SP1, worrying about all of the remote exploits that were flying around, and running code without Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR). Ten years…
How Compilation Works: preprocessing, compilation, assembly and linking
Note: I found this article after I wrote this, and it does a much better job at explaining all of this. As I have said before, this blog is mostly an exercise in forcing myself to learn things at a deeper level. As such, this is a half baked explanation…
More Driver Debugging
Attaching WinDbg to a VM to be able to get debugging output and create breakpoints is good, but if you don’t know how to use it, then its not terribly useful. However, in the cases we are working with (where we are developing and testing the code), we would have a lot more insight into what the driver…
Python Mimicry Server
I was given a little challenge with the following requirements:
1.) Develop a client and server using the Python socket library that operates as follows* Client application is given a server IP address (in dotted decimal notation), a port, and a password as command line…
How to collect a file from someone…
I am currently exploring a few options with regard to my current employment, and one of the companies I interviewed with presented me with choice of challenges I could do. I had basically 48 hours (during the middle of the week) to complete one of the following (I have redacted some of the…
Giving back
I am getting to the point in my career where I have a certain level of experience. I am now able to jump on things that I have not done before, and have an idea of how to attack the problem.
I decided that I wanted to give back to those that are just starting out in their career. I found…
Railgun — How to Use Structs in Railgun Calls
Railgun is a really powerful extension for the Metasploit Framework that allows anyone to do windows API calls from a meterpreter session. There is a really good primer on Rapid7’s site that goes over more about what Railgun is, and has some helpful links on the Windows API…
