eleven red pandas

eleven red pandas

Users
Tweets

eleven red pandas

@bytecodevm

Jun 12

When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400 bytes, the answer is an egghunter. This walkthrough takes Savant Web Server 3.1 from initial crash to NT-level shell: partial overwrite to defeat the savant.exe null-byte module base, POP EAX RET gadget, a 7-byte conditional jump that exploits pre-zeroed memory, two independent buffers (URL path HTTP body), then both classic egghunters — syscall-based on Windows 10 (with the NEG trick to encode 0x1C8 null-free) and the OS-agnostic SEH-based variant with a custom dispatcher handler. core-jmp.org/2026/06/egghunt… #BadCharacters #bufferoverflow #Egghunter #gadgets #HeapStaging #INT0x2E #KeystoneEngine #Metasploit #Meterpreter #NtAccessCheckAndAuditAlarm #NullFreeShellcode #PartialOverwrite #POPEAXRET #ROP #SavantWebServer #SCASD #SEHEgghunter #shellcode #StackBufferOverflow #StackOverflow #w00tw00tEgg #WinDBG #WindowsExploitDevelopment #x86

133

Evta

Evta

@pwhattie

Apr 17

🐬ETA Weekly🦀 🪶108 Hardware-Software Security 2: The Long Search for Practical Memory Safety from Stack Smashing to Hardware-Enforced Security🥐 🍕Update in Audit🪻 🍬github.com/ETAAcademy/ETAAca…🌕 Memory safety isn't a tooling problem. It's a deployment problem. We already know how memory bugs happen. That creates two failure modes: - Spatial bugs: out-of-bounds reads and writes - Temporal bugs: use-after-free and dangling references Once an invalid pointer is dereferenced, a normal bug turns into an exploit primitive. That is how a simple overflow can become control-flow hijacking, data corruption, or information disclosure. 🫓The classic example is stack smashing:🪽 1. Overflow a local buffer 2. Overwrite saved stack metadata 3. Redirect execution 4. Turn memory corruption into code execution 🚤Most defenses help, but only partially:🪮 - Stack canaries catch some overwrites - DEP/NX blocks injected code - ASLR makes targets harder to predict Useful? Yes. Complete? No. The deeper challenge is full memory safety. And this is where most discussions miss the real constraint: 🪭A defense only wins if it balances 3 things at once:🤿 1. Protection strength 2. Runtime overhead 3. Compatibility with existing software Miss one, and adoption drops fast. That is why the field keeps exploring different tradeoffs: - CHERI gives pointers hardware-enforced bounds and authority - MPK / PAC / MTE protect narrower parts of the problem in hardware - CFI / CET keep execution on valid control-flow paths The big lesson: Security mechanisms do not compete on elegance. They compete on deployability. If a defense is too slow, too incompatible, or too disruptive, it stays in papers while vulnerable code keeps shipping. Memory safety is not just about stopping exploits. It is about making protection strong enough to matter and practical enough to deploy. What matters more for adoption in your view: lower overhead or better compatibility? Bookmark this if you work on systems, compilers, or security. 🏛️#Audit #MemoryCorruption #SpatialSafety #TemporalSafety #AttackPipeline #StackBufferOverflow #Shellcode #NOPSled #StackCanaries #DEP #ASLR #MemorySafety #PointerMetadata #SoftBound #CETS #CHERI #Capabilities #MPK #PAC #MTE #IntelCET #ShadowStack #IndirectBranchTracking #ControlFlowIntegrity #SoftwareFaultIsolation #SMAC #Deployability🛒

0:08