book

PoC||GTFO

by Manul Laphroaig

October 2017

Intermediate to advanced

312 pages

14h 14m

English

No Starch Press

Read now

Unlock full access

0:1 Let us begin!0:2 iPod Antiforensics0:3 ELFs are dorky, Elves are cool0:4 Epistle to Hats of All Colors0:5 Returning from ELF to Libc0:6 GTFO or #FAIL
1:1 Lend me your ears!1:2 RNG in four lines of Javascript1:3 Serena Butler’s TV Typewriter1:4 Making a Multi-Windows PE1:5 This ZIP is also a PDF1:6 Burning a Phone1:7 Sermon on the Divinity of Languages
2:1 Ring them Bells!2:2 Build your own birdfeeder.2:3 A PGP Matryoshka Doll2:4 Code Execution on a Tamagotchi2:5 Shellcode for MSP4302:6 Calling putchar() from ELF2:7 POKE of Death for the TRS 80/M1002:8 This OS is also a PDF2:9 A Vulnerability in Reduced Dakarand2:10 Juggernauty
3:1 Fear Not!3:2 Greybeard’s Luck3:3 This PDF is a JPEG.3:4 Netwatch for SMM3:5 Packet-in-Packet Mitigation Bypass3:6 An RDRAND Backdoor in Bochs3:7 Kosher Firmware for the Nokia 27203:8 Tetranglix Boot Sector3:9 Defusing the Qualcomm Dragon3:10 Tales of Python’s Encoding3:11 Angecryption
4:1 Let me tell you a story4:2 Epistle on the Bountiful Seeds of 0Day4:3 This OS is a Boot Sector4:4 Prince of PoC4:5 New Facedancer Framework4:6 Power Glitching Tamagotchi4:7 A Plausibly Deniable Cryptosystem4:8 Hardening Pin Tumbler Locks4:9 Intro to Chip Decapsulation4:10 Forget Not the Humble Timing Attack4:11 This Truecrypt is a PDF4:12 How to Manually Attach a File to a PDF4:13 Ode to ECB

5:1 It started like this5:2 A Sermon on Hacker Privilege.5:3 ECB: Electronic Coloring Book5:4 An Easter Egg in PCI Express5:5 A Flash PDF Polyglot5:6 This Multiprocessing OS is a Boot Sector5:7 A Breakout Board for Mini-PCIe5:8 Prototyping a generic x86 backdoor in Bochs5:9 Your Cisco blade is booting PoC∥GTFO.5:10 I am my own NOP Sled.5:11 Abusing JSONP with Rosetta Flash5:12 Sexy collision PoCs5:13 Ancestral Voices
6:1 Communion with the Weird Machines6:2 On Giving Thanks6:3 Gekko the Dolphin6:4 This TAR archive is a PDF!6:5 x86 Alchemy and Smuggling6:6 Detecting MIPS Emulation6:7 More Cryptographic Coloring Books6:8 PCB Reverse Engineering6:9 Davinci Seal6:10 Observable Metrics
7:1 With what shall we commune this evening?7:2 The Magic Number: 0xAA557:3 Coastermelt7:4 The Lysenko Sermon7:5 When Scapy is too high-level7:6 Abusing file formats7:7 AES-NI Backdoors7:8 Innovations with Linux core files.7:9 Bambaata speaks from the past.7:11 Cyber Criminal’s Song
8:1 Please stand; now, please be seated8:2 Witches, Warlocks, and Wassenaar8:3 Compiler Bug Backdoors8:4 A Protocol for Leibowitz8:5 Jiggling into a New Attack Vector8:6 Hypervisor Exploit, Five Years Old8:7 Stegosploit8:8 On Error Resume Next8:9 Unbrick My Part8:10 Backdoors up my Sleeve8:11 Naughty Signals8:12 Weird Crypto
IntroductionChapter 0: A CFP with POCChapter 1: Proceedings of the Society of PoC∥GTFOChapter 2: The Children’s Bible Coloring Book of PoC∥GTFOChapter 3: Address on the Smashing of Idols to Bits and BytesChapter 4: Tract de la Société SecrèteChapter 5: Address to the Inhabitants of EarthChapter 6: Old Timey ExploitationChapter 7: PoC∥GTFO, Calisthenics and OrthodontiaChapter 8: Exploits Sit Lonely on the Shelf

Content preview from PoC||GTFO

Footnotes

Introduction

¹ Page 541.

² Page 639.

³ Page 182.

⁴ Page 516.

⁵ Page 480.

⁶ Pages 495 and 612.

⁷ Page 667.

⁸ Page 525.

⁹ Page 29.

¹⁰ Page 404

¹¹ Page 620.

¹² Page 294.

Chapter 0: A CFP with POC

¹Since published as Implementation and Implications of a Stealth Hard Disk Backdoor by Zaddach, Kurmus et al.

²See PKI Layer Cake by Dan Kaminsky, Len Sassaman, and Meredith L. Patterson

³See http://www.saurik.com/id/18 and http://www.saurik.com/id/17.

⁴Cf. “The Format and the Parser,” a little-known variant of the “The Beauty and the Beast.” They resolved their parser differentials and lived invulnerably ever after.

⁵Just objcopy -O binary -j .interp /bin/ls /dev/stdout, wasn’t that easy? :)

⁶To achieve RTLD enlightenment, meditate on the Grugq’s subversiveld.pdf ...