SecDocs Feed for author Cesar Cerrudo

[Slides] WLSI - Windows Local Shellcode Injection

Fri, 13 Jan 2012 06:34:03 +0100

Authors: Cesar Cerrudo
Tags: shellcode
Event: Black Hat EU 2006

[Slides] Hacking Windows Internals

Tue, 27 Dec 2011 06:34:16 +0100

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: Black Hat EU 2005

[Slides] Demystifying MS SQL Server & Oracle Database Server Security

Sat, 24 Dec 2011 06:28:30 +0100

Authors: Cesar Cerrudo
Tags: SQL Server Oracle
Event: Black Hat USA 2005

[Slides] Auditing ActiveX Controls

Tue, 13 Dec 2011 06:33:15 +0100

Authors: Cesar Cerrudo
Tags: ActiveX
Event: Black Hat Windows Security 2004

[Slides] Hunting Flaws in MS SQL Server

Thu, 20 Oct 2011 08:54:07 +0200

Authors: Aaron Newman Cesar Cerrudo
Tags: SQL Server
Event: Black Hat Windows Security 2003

[Paper] Hunting Flaws in MS SQL Server

Thu, 20 Oct 2011 08:54:07 +0200

Authors: Aaron Newman Cesar Cerrudo
Tags: SQL Server
Event: Black Hat Windows Security 2003

[Paper] Token Kidnapping's Revenge

Wed, 07 Sep 2011 19:04:26 +0200

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: Black Hat USA 2010
Abstract: On April 14, 2009 Microsoft released a patch (documented here) to fix the issues detailed in my previous Token Kidnapping presentation (download PDF). The patch properly fixed the issues but... This new presentation will detail new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions including the brand new Windows 2008 R2 and Windows 7. These new attacks allow to bypass new Windows services protections such as Per service SID, Write restricted token, etc. It will be demonstrated that almost any process with impersonation rights can elevate privileges to Local System account and completely compromise Windows OSs. While the issues are not critical in nature since impersonation rights are required, they allow to exploit services such as IIS 6, IIS 7, SQL Server, etc. in some specific scenarios. Exploits code for those services will be released. The presentation will be given in a very practical way showing how the new issues were found, with what tools, techniques, etc. allowing the participants to learn how to easily find these kind security issues in Windows operating systems.

[Slides] Token Kidnapping's Revenge

Wed, 07 Sep 2011 19:04:10 +0200

[Paper] Practical 10 Minute Security Audit: The Oracle Case

Thu, 28 Jul 2011 21:15:47 +0200

Authors: Cesar Cerrudo
Tags: Oracle
Event: Black Hat DC 2007

[Slides] Practical 10 Minute Security Audit: The Oracle Case

Thu, 28 Jul 2011 21:15:15 +0200

Authors: Cesar Cerrudo
Tags: Oracle
Event: Black Hat DC 2007

[Paper] Hacking Databases for Owning Your Data

Fri, 08 Jul 2011 01:04:35 +0200

Authors: Cesar Cerrudo Esteban Martínez Fayó
Tags: database SQL injection
Event: Black Hat EU 2007

[Slides] Hacking Databases for Owning Your Data

Fri, 08 Jul 2011 01:04:18 +0200

Authors: Cesar Cerrudo Esteban Martínez Fayó
Tags: database SQL injection
Event: Black Hat EU 2007

[Video] Token Kidnapping's Revenge

Sat, 29 Jan 2011 12:19:50 +0100

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: DEFCON 18

[Paper] Token Kidnapping's Revenge

Sat, 29 Jan 2011 12:01:21 +0100

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: DEFCON 18

[Slides] Token Kidnapping's Revenge

Sat, 29 Jan 2011 12:01:02 +0100

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: DEFCON 18

[Audio] Token Kidnapping's Revenge

Sat, 29 Jan 2011 12:00:33 +0100

Authors: Cesar Cerrudo
Tags: Windows exploiting
Event: DEFCON 18

[Slides] SQL Server Anti-Forensics

Tue, 31 Aug 2010 11:17:00 +0200

Authors: Cesar Cerrudo
Tags: SQL Server forensic
Event: Black Hat DC 2009

[Audio] SQL Server Anti-Forensics

Tue, 31 Aug 2010 11:17:00 +0200

Authors: Cesar Cerrudo
Tags: SQL Server forensic
Event: Black Hat DC 2009

[Video] SQL Server Anti-Forensics

Tue, 31 Aug 2010 11:17:00 +0200

Authors: Cesar Cerrudo
Tags: SQL Server forensic
Event: Black Hat DC 2009

[Paper] SQL Server Anti-Forensics

Thu, 19 Feb 2009 13:30:00 +0100

Authors: Cesar Cerrudo
Tags: SQL Server forensic
Event: Black Hat DC 2009

[Paper] Manipulating Microsoft SQL Server Using SQL Injection

Sun, 08 Jun 2008 16:23:00 +0200

Authors: Cesar Cerrudo
Tags: SQL Server SQL injection exploiting

[Paper] Manipulating Microsoft SQL Server Using SQL Injection

Sat, 26 Apr 2008 13:50:00 +0200

Authors: Cesar Cerrudo
Tags: SQL Server SQL injection
Abstract: This paper will not cover basic SQL syntax or SQL Injection. It is assumed that the reader has a strong understanding of these topics already. This paper will focus on advanced techniques that can be used in an attack on a (web) application utilizing Microsoft SQL Server as a backend. These techniques demonstrate how an attacker could use a SQL Injection vulnerability to retrieve the database content from behind a firewall and penetrate the internal network. This paper is meant to educate security professionals of the potential devastating effects SQL Injection could have on an organization. Web applications are becoming more secure because of the growing awareness of attacks such as SQL Injection. However, in large and complex applications, a single oversight can result in the compromise of the entire system. Specifically, many developers and administrators of (web) applications may have a false sense of security because they use stored procedures or mask an error messages returned to the browser. This may lead them to believe that they can not be compromised by this vulnerability. While we discuss Microsoft SQL Server in this paper, this is no way indicative that Microsoft SQL Server is any less secure than other database platforms such as Oracle or IBM DB2. SQL injection is not a defect of Microsoft SQL Server – it is also a problem for every other database vendor as well. Perhaps the biggest issue with Microsoft SQL Server is the flexibility of the system. This flexibility is what allows it to be subverted so far by SQL injection. This paper is meant to show that any time an administrator or developer allows arbitrary SQL to be executed, their system is open to being rooted. It is not meant to show that Microsoft SQL Server is inherently flawed.

[Slides] Token Kidnapping

Sun, 20 Apr 2008 00:29:00 +0200

Authors: Cesar Cerrudo
Tags: Windows exploiting internals Windows Vista