==Ph4nt0m Security Team==
Issue 0x01, Phile #0x05 of 0x06
|=---------------------------------------------------------------------------=|
|=------------------=[ Shellcode For Mac OSX (x86) Tips ]=-------------------=|
|=---------------------------------------------------------------------------=|
|=----------------------
==Ph4nt0m Security Team==
Issue 0x01, Phile #0x04 of 0x06
|=---------------------------------------------------------------------------=|
|=----------------------=[ 安全幻想曲2008 ]=---------------------=|
|=---------------------------------------------------------------------------=|
|=---------------------------
==Ph4nt0m Security Team==
Issue 0x01, Phile #0x03 of 0x06
|=---------------------------------------------------------------------------=|
|=---------------------=[ 做一个优秀的木匠 ]=---------------------=|
|=---------------------------------------------------------------------------=|
|=--------------------------------
==Ph4nt0m Security Team==
Issue 0x01, Phile #0x02 of 0x06
|=---------------------------------------------------------------------------=|
|=----=[ An improvement on mixed case alphanumeric shellcode decoder ]=------=|
|=---------------------------------------------------------------------------=|
|=----------------------
==Ph4nt0m Security Team==
Issue 0x01, Phile #0x01 of 0x06
|=---------------------------------------------------------------------------=|
|=----------------------=[ Introduction ]=-----------------------=|
|=---------------------------------------------------------------------------=|
|=----------------------
http://www.milw0rm.com/sploits/2008-zha0_ms08_014.rar
# milw0rm.com [2008-03-21]
鬼仔注： 探索NDIS HOOK新的实现方法(1)
作者：zhouxiaoyong (zhouhongyun1978_at_gmail.com)
来源：安全焦点
探索NDIS HOOK新的实现方法(2)
---INLINE HOOK实现NDIS HOOK
前面讲述了如何通过获取NDIS_PROTOCOL_BLOCK来实现NDIS HOOK，这里讲述第二种方法，那就是inline hook方法。说起inline hook，也不是什么新鲜玩意，无非是在一个函数的首部嵌入一个jmp机器指令，在该函数执行有效代码前就跳到我们的代理函数，在我们的代理函数里做了必要的处理以后，再跳回原来的函数，接着执行原函数的指令。
by cocoruder(frankruder@hotmail.com)
http://ruder.cdut.net
Summary:
More than three local code execute vulnerabilities exist in Adobe Flash CS3 Professional while it is parsing FLA files. An attacker who successfully exploit these vulnerabilities can run arbitrary code on the affected system.
Affected Software Versions:
Adobe Flash CS3 Professional 9.0