TAILIEUCHUNG - Check Point Secure Platform Hack

This is paper are the more or less raw results of the trial and error natural process of hacking a system. As the initial idea was not to made it public, I did not take care of the “feel and look” and I wrote as a simple reminder to me of what attack vectors where tried and its time-line. As the R+D work increased, what where simple annotations begun to look interesting, maybe for readers other than me. At the end I got what I was looking for: a way to hack the tested system, but then I realize that what was more interesting –at. | Pentest consultores seguridad telemática Check Point Secure Platform Hack Doc. First release October 2007 An uncensored real-time-line of how I exploited a vulnerability in a kernel hardened EAL4 certified firewall Hugo Vazquez Caramés hvazquez at pentest dot es http phone 0034 933962070 Pentest Check Point SecurePlatform Hack Index About Introduction of the Check Point The Secure Platform R60 Common Criteria Security Validation Common Criteria The Secure Information Gathering of the Fast look to vulnerabilities Try out to some buffer The Monster The real exploitation Now let s try with exec-shield turned on .75 How to put the system argument in a place other than the environment variable .78 System argument Summary of the state of the testing Another Playing with cpu Overflows in the 2nd and 1st arguments of Let s try to delete a Playing with UNLINK .131 Trying well Known hacking Rename .143 Chroot .145 2 Pentest Check Point SecurePlatform Hack Frame Do_System .155 Playing again with cpu registers and execve .158 Back to Do_System .161 Attacking through the binary Yet another strange attack Cpshell 1st Real scenario 1st . About other overflows and remote What about responsible disclosure .217 ANNEX I -

• An ninh - Bảo mật
• remote exploitation
• Frame manipulation
• Secure Platform
• Security Target
• Validation Report
• vulnerabilities candidates