«
Expand/Collapse
183 items tagged "null"
Related tags:
null pointer [+],
yourself [+],
x 509 [+],
issue [+],
e zine [+],
character certificate [+],
certificate [+],
null byte [+],
version [+],
udp packet [+],
socket [+],
microsoft [+],
firefox [+],
avahi [+],
vulnerabilities [+],
txt [+],
sendmail [+],
samsung [+],
poc [+],
null pointer dereference [+],
multiple [+],
mozilla [+],
freebsd [+],
service vulnerability [+],
windows [+],
server [+],
opera [+],
mozilla firefox [+],
modrdn [+],
mediaserver [+],
freebsd versions [+],
firefly [+],
byte [+],
bugtraq [+],
xitami [+],
wrong number [+],
stack overflow [+],
ssl [+],
shellcode [+],
server versions [+],
s codesys [+],
remote [+],
refractor [+],
reader [+],
quagga [+],
perl functions [+],
perl [+],
patch [+],
pam [+],
overflow [+],
optima [+],
opera version [+],
number [+],
null pointers [+],
microsoft reader [+],
libzip [+],
libnids [+],
libesmtp [+],
kies [+],
kernel version [+],
integer overflow [+],
index [+],
imatix [+],
gnu debugger [+],
gnu [+],
gdb [+],
fragment c [+],
fragment [+],
exploit [+],
execve [+],
engine versions [+],
engine [+],
endless loop [+],
dereference [+],
debugger [+],
cyrus imap server [+],
cyrus imap [+],
bgpd [+],
attackers [+],
apiftp [+],
access control [+],
denial of service [+],
vulnerability [+],
znc [+],
xor [+],
x86 linux [+],
wordpad [+],
wireshark [+],
windows xp sp3 [+],
windows xp [+],
unicode string [+],
superh [+],
stripbytecount [+],
shield [+],
sh4 [+],
setreuid [+],
session [+],
security [+],
script kiddies [+],
rop [+],
public key encryption [+],
php 5 [+],
persian [+],
password [+],
pam module [+],
numbers stations [+],
null sessions [+],
null session [+],
ntlmssp [+],
net [+],
mplayer [+],
microsoft wordpad [+],
microsoft windows [+],
local privilege escalation [+],
libtiff [+],
libcurl [+],
lattice [+],
kssl [+],
kernel memory [+],
kde [+],
iridium satellite network [+],
hp hash [+],
guessable passwords [+],
grapheme [+],
floating point numbers [+],
facebook [+],
exploits [+],
exp [+],
dos [+],
dll library [+],
curl [+],
credit cards [+],
apple mac os x [+],
apple mac os [+],
anatomy [+],
allshare [+],
Pentesting [+],
null character [+],
pointer [+],
zeros [+],
x86 [+],
x printing [+],
x afp [+],
word [+],
win [+],
todd sabin [+],
space labs [+],
space [+],
sessions [+],
sctp [+],
safer use [+],
runlevel [+],
rpcclient [+],
pypam [+],
ptr [+],
pseudofs [+],
privilege escalation vulnerability [+],
postgresql [+],
php versions [+],
peamp [+],
password authentication [+],
null space [+],
null null [+],
null characters [+],
nss [+],
nsd [+],
neon [+],
nbsp [+],
msrpc [+],
mitkrb [+],
microsoft word [+],
los angeles [+],
linus [+],
libvoikko [+],
kdc [+],
init [+],
infinite supply [+],
hashes [+],
hacks [+],
hackerspace [+],
gotchas [+],
execution [+],
event [+],
domain [+],
direct [+],
diagnose [+],
dev [+],
denial [+],
computing [+],
commotion [+],
classic [+],
cifs [+],
charlie [+],
california [+],
cain [+],
brute force [+],
bip bip [+],
bip [+],
better solution [+],
beta [+],
authentication [+],
ash [+],
admin [+],
Release [+],
Public [+],
Latest [+],
Hackerspaces [+],
BackTrack4 [+],
BackTrack [+],
linux [+],
linux kernel [+],
validation [+],
php [+],
kernel [+],
proof of concept [+],
character [+],
openldap [+]
-
-
16:27
»
Packet Storm Security Exploits
FireFly Mediaserver version 1.0.0.1359 suffers from a denial of service vulnerability that can be triggered by a NULL pointer dereference.
-
16:01
»
Packet Storm Security Exploits
gdb (GNU debugger) versions 7.5.1 and below ELF anti-debugging / reversing patcher that causes a NULL pointer dereference to trigger.
-
-
14:38
»
Packet Storm Security Exploits
Samsung Kies version 2.3.2.12054_20 suffers from a null pointer dereference and multiple improper access control vulnerabilities.
-
-
17:00
»
SecuriTeam
This allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.
-
-
18:32
»
Packet Storm Security Exploits
Microsoft Wordpad version 5.1 suffers from a null pointer dereference vulnerability when handling .doc files. Proof of concept included.
-
-
5:00
»
Carnal0wnage
Post [5] Honorable Mention: Null Sessions
Null sessions are old school. they used to be useful for pretty much every host in a domain. Unfortunately, I very rarely run into an environment where all workstations let you connect anonymously AND get data.
Where they can come in useful is
- Against mis-configured servers
- Against domain controllers to pull info
Low? actually a medium...

More than once I've had a PT where a master_browser was exposed to the Internet. We were able to connect to the server using
rpcclient and enumerate users. After that we had a full list of the users in the domain to conduct external brute forcing attacks with.
If you like pretty pictures, it kinda looks like this, there are command line utilities as well...
Cain uses null sessions by default to try to pull information. On modern systems this will fail.

But domain controllers/
master_browsers do allow this, so if you find yourself in the position to be able to speak with one you can a list of users for the domain


You can then take that list of users and do brute force attacks against various services. I rarely don't find at least one username/username in an environment.
-
-
8:01
»
Hack a Day
[Charlie] from Null Space Labs in Los Angeles, California sent in this fun little video as an introduction to their hackerspace. Going a bit  askew from the traditional “walk through” method of a tour, they decide to first attempt semi-successfully to fly a quadcopter, film some police commotion, then show off some projects in progress. [...]
-
-
14:09
»
Hack a Day
Here’s something we thought we would never see: computing with just pipes, /dev/zero, and /dev/null. As a thought experiment, [Linus] imagined a null byte represented an electron. /dev/zero would have an infinite supply of electrons and /dev/null would make a wonderful positive power supply. With a very short program (named mosfet.c), [Linus] can use Linux pipes [...]
-
-
9:23
»
Packet Storm Security Recent Files
Microsoft ASP.NET Forms suffers from a null byte termination authentication bypass vulnerability that exists in the CopyStringToUnAlingnedBuffer() function of the webengine4.dll library used by the .NET framework. The unicode string length is determined using the lstrlenW function. The lstrlenW function returns the length of the string, in characters not including the terminating null character. If the unicode string containing a null byte is passed, its length is incorrectly calculated, so only characters before the null byte are copied into the buffer.
-
9:23
»
Packet Storm Security Misc. Files
Microsoft ASP.NET Forms suffers from a null byte termination authentication bypass vulnerability that exists in the CopyStringToUnAlingnedBuffer() function of the webengine4.dll library used by the .NET framework. The unicode string length is determined using the lstrlenW function. The lstrlenW function returns the length of the string, in characters not including the terminating null character. If the unicode string containing a null byte is passed, its length is incorrectly calculated, so only characters before the null byte are copied into the buffer.
-
-
16:51
»
Packet Storm Security Exploits
3S CoDeSys versions 3.4 SP4 Patch 2 and below suffer from integer overflow, stack overflow, folder creation and multiple NULL pointer vulnerabilities.
-
16:51
»
Packet Storm Security Recent Files
3S CoDeSys versions 3.4 SP4 Patch 2 and below suffer from integer overflow, stack overflow, folder creation and multiple NULL pointer vulnerabilities.
-
16:51
»
Packet Storm Security Misc. Files
3S CoDeSys versions 3.4 SP4 Patch 2 and below suffer from integer overflow, stack overflow, folder creation and multiple NULL pointer vulnerabilities.
-
16:38
»
Packet Storm Security Recent Files
Go Null Yourself E-zine Issue 6 - Topics in this issue include Floating Point Numbers Suck, How Skynet Works, Defeating NX/DEP With return-to-libc and ROP, and more.
-
16:38
»
Packet Storm Security Misc. Files
Go Null Yourself E-zine Issue 6 - Topics in this issue include Floating Point Numbers Suck, How Skynet Works, Defeating NX/DEP With return-to-libc and ROP, and more.
-
-
7:25
»
Packet Storm Security Recent Files
Go Null Yourself E-zine Issue 5 - Topics in this issue include Public-Key Encryption and RSA, Iridium Satellite Network, An Introduction to x86 NASM, Hacking 15A Announcements, and more.
-
7:25
»
Packet Storm Security Misc. Files
Go Null Yourself E-zine Issue 5 - Topics in this issue include Public-Key Encryption and RSA, Iridium Satellite Network, An Introduction to x86 NASM, Hacking 15A Announcements, and more.
-
-
15:28
»
Packet Storm Security Advisories
When given a wrong number of arguments, a number of perl functions will attempt to read memory from an unmapped location, resulting in a deterministic crash.
-
15:28
»
Packet Storm Security Recent Files
When given a wrong number of arguments, a number of perl functions will attempt to read memory from an unmapped location, resulting in a deterministic crash.
-
15:28
»
Packet Storm Security Misc. Files
When given a wrong number of arguments, a number of perl functions will attempt to read memory from an unmapped location, resulting in a deterministic crash.
-
-
12:22
»
Packet Storm Security Recent Files
Go Null Yourself E-zine Issue 4 - Topics in this issue include Lattice-Based Cryptography, The Tech Behind Credit Cards, MapReduce Part 2, 303-833-00xx Scan, and more.
-
12:22
»
Packet Storm Security Misc. Files
Go Null Yourself E-zine Issue 4 - Topics in this issue include Lattice-Based Cryptography, The Tech Behind Credit Cards, MapReduce Part 2, 303-833-00xx Scan, and more.
-
-
19:23
»
Packet Storm Security Exploits
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
19:23
»
Packet Storm Security Recent Files
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
19:23
»
Packet Storm Security Misc. Files
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
-
8:54
»
Packet Storm Security Exploits
libzip version 0.9.3 allows remote and local attackers to trigger a denial of service condition via a null pointer dereference if ZIP_FL_UNCHANGED flag is set.
-
8:54
»
Packet Storm Security Recent Files
libzip version 0.9.3 allows remote and local attackers to trigger a denial of service condition via a null pointer dereference if ZIP_FL_UNCHANGED flag is set.
-
8:54
»
Packet Storm Security Misc. Files
libzip version 0.9.3 allows remote and local attackers to trigger a denial of service condition via a null pointer dereference if ZIP_FL_UNCHANGED flag is set.
-
-
8:37
»
Packet Storm Security Exploits
The Refractor 2 engine versions 1.50 and below suffer from a NULL pointer dereference vulnerability. Games such as Battlefield 2 and Battlefield 2142 are affected. Proof of concept code included.
-
8:37
»
Packet Storm Security Recent Files
The Refractor 2 engine versions 1.50 and below suffer from a NULL pointer dereference vulnerability. Games such as Battlefield 2 and Battlefield 2142 are affected. Proof of concept code included.
-
8:37
»
Packet Storm Security Misc. Files
The Refractor 2 engine versions 1.50 and below suffer from a NULL pointer dereference vulnerability. Games such as Battlefield 2 and Battlefield 2142 are affected. Proof of concept code included.
-
-
20:06
»
Packet Storm Security Recent Files
pam_shield is a PAM module that uses null-routing or iptables to lock out script kiddies that probe your computer for open logins or easy guessable passwords. pam_shield is meant as an aid to protect public computers on the Internet.
-
20:06
»
Packet Storm Security Misc. Files
pam_shield is a PAM module that uses null-routing or iptables to lock out script kiddies that probe your computer for open logins or easy guessable passwords. pam_shield is meant as an aid to protect public computers on the Internet.
-
-
20:29
»
Packet Storm Security Recent Files
Go Null Yourself E-zine Issue 3 - Topics in this issue include HP Hash Cracking with MapReduce, Port Knocking Primer, Abusing phpBB's Tell-A-Friend, Decoding Trillian Password Files, Numbers Stations FOIA, and more.
-
20:29
»
Packet Storm Security Misc. Files
Go Null Yourself E-zine Issue 3 - Topics in this issue include HP Hash Cracking with MapReduce, Port Knocking Primer, Abusing phpBB's Tell-A-Friend, Decoding Trillian Password Files, Numbers Stations FOIA, and more.
-
-
10:41
»
SecuriTeam
A null pointer dereference vulnerability has been noticed in Microsoft Word 2003.
-
Make your website safer. Use external penetration testing service. First report ready in one hour!
-
-
21:01
»
Packet Storm Security Recent Files
FreeBSD versions 7.0 through 7.2 suffer from a pseudofs NULL pointer dereference vulnerability. Due to a spurious call to pfs_unlock() in pfs_getattr() (as defined in sys/fs/pseudofs/pseudofs_vnops.c), a null pointer is dereferenced after calling extattr_get_attribute() on pseudofs vnode. By allocating a page at address 0x0, an attacker can overwrite an arbitrarily chosen portion of kernel memory, leading to a crash or local root escalation.
-
21:01
»
Packet Storm Security Advisories
FreeBSD versions 7.0 through 7.2 suffer from a pseudofs NULL pointer dereference vulnerability. Due to a spurious call to pfs_unlock() in pfs_getattr() (as defined in sys/fs/pseudofs/pseudofs_vnops.c), a null pointer is dereferenced after calling extattr_get_attribute() on pseudofs vnode. By allocating a page at address 0x0, an attacker can overwrite an arbitrarily chosen portion of kernel memory, leading to a crash or local root escalation.
-
-
9:56
»
Carnal0wnage
I covered some of the halflm challenge sniffing stuff in a previous
post.
but I had to revisit it the other day for work and couldn't find the actually tables and program from the post.
so here are some updated links.
where to grab the tables:
http://freerainbowtables.mirror.garr.it/mirrors/freerainbowtables/halflmchall/where to grab the program:
http://sourceforge.net/projects/rcracki/Some gotchas I ran into on the last PT was some reason getting odd hashes in the
SMB and
NTLM sniffing modules.
in some cases the hashes were not the same for the same username and hostname, these were unusable, I also had some that had a bunch of zeros in them, those were also not crackable.
Windows 2000 2195:Windows 2000 5.0:1122334455667788:4c4d5353500003000000010001004600000000000000470000000000000040000000000000004000000006000600400000001000100047000000158a88e048004f0044000081196a7af2e4491c28af3025741067535700:00000000000000000000000000000000
But I did get smb_login scanned, that was fun:
ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:59de5d885e583167c3a9a92ac42c0ae52f85252cc731bb25:5ada49d539bd174e7049805dc1004925e25130c33dbe892a ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:40305b22075d6000d0508d9ad1f7beb02f85252cc731bb25:337c939e66480243d1833309b8afe49a81fe4c5e646bf00a ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:daf3570c10ed2817c3d8a05d69f9ef292f85252cc731bb25:d3fb390bac5d152f7a394466fbef686e275d05b99c0a115e ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d:727b4e35f947129ea52b9cdedae86934bb23ef89f50fc595 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:d737aa8f95ce38359cab5d8a2519c4b92f85252cc731bb25:0624a3f7d457c54b163c641dbf4b7963548ef1c5d0397cbf ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:0e89a68d07e315c6035e82b757b955882f85252cc731bb25:58f2d720179b4a38a0523e02aef0d41dacccd6577eaa943c ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:aa9436c1d40cb53f3e7a20091c4b931c2f85252cc731bb25:8ac45acdbd60f2fad3081ecf005536efa6009c21ca5faf36 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:dce867f0cb638db2dbcc3576a52dc4612f85252cc731bb25:8990b33dac65c5ef75073829894b911a983c1e260fbd1097 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:6f9d851d74c8a095c9df672a1554bebc2f85252cc731bb25:89953de6f957b7db5fe664d23af3de41dd38f5ec0a4a6eb0 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:cc96cc93b4dc9b7582273227fd61a5952f85252cc731bb25:76d3c3deb0bb8ef1a1e41ab6a3f6c686a321ce016c624567 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:cc96cc93b4dc9b754db66776827758d30b7892eef2e3f2bc:df58ae0f786becc11be11034dc53b21bdf1d73579af868d1 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:de5d1d85daf6593d0a09ff32049013ab2f85252cc731bb25:526471d8c4a0ecc8af05851804ea8fdd26848fa3ccc63152 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:b8489edee1058b43f3ce0f0abe5a16872f85252cc731bb25:57b9c47a75335692f60e787e41cd16a292a21bc667b3fd02 ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:2b6b134af8d48f2a972bff5660420d582f85252cc731bb25:5018402148e15a8d77cb22dd46f1449a2791416b73ee9c3d ADMIN Windows 2000 2195Windows 2000 5.0:NULL:1122334455667788:bb49aefd51ed0dccd5be291bd33be3052f85252cc731bb25:c9b255750bd88ac72e03adafda261e62618c943f7d59daf5
-
-
15:37
»
remote-exploit & backtrack
So, I followed this instuction building-perfect-backtrack-4-usb-thumb.html from powercram.com to make a bt4 usb stick that keeps stuff I install.
I ended up at the lines before "Install Nessus" where I wanted to boot from the stick (I don't need nessus or crypted stuff, so I'd leave that out) but if I boot I receive the error
init: illegal runlevel (null)
now, I tried to search for files that set the init runlevel to find out what's wrong but I failed D:
what can I do?
Is there a solution for this problem? Is there a better solution to keep installed programs on my usb bt4?