Possible Remote Root Vuln in Exim

Due to a post from Sergey Kononenko it can be possible that the current version of Exim in Debian allows an attacker to access root through a malicious mail. He contacts the exim developers through their mailing list and describes an attack which occured in his company.

This vulnerability was already reported as a bug on the debian bug tracking system.

Let's see when exploit-db and metasploit have the first exploits ;-)

Greetz,
bluec0re

WiFi Sync FTW

Today I had discovered an incredible Android App for my brand-new Desire HD: Winamp for Android.

With this app you can sync your music via WiFi over the air. Simply start the app on your phone (it is a good musicplayer also), activate WiFi sync and start organizing your musiclibrary through Winamp.

Greetz,

BlueC0re

Posted via my DHD

Interesting Magic Number

Yesterday I've bought Emergency 2012, the new game of the Emergency series. Because the freeplay mode has some annoying events (like pickpocketing) which happens very often, I wanted to change the frequency like in Em4. But the most xml files were compressed or encrypted. The magic number of this files seems interesting:

	00	01	02	03
00	D3	C0	37	13

If you read this as a little endian integer you will get: 0x1337C0D3
Someone wants to speak some leetspeak :)

btw: this shop has some cool language options ;)

Greetz
BlueC0re

Lua C-API

Yesterday I've restarted to develop a rts-game from the scratch. I've decided to use LUA as script engine. Because I want use C++ as programming language, I wrote a binder class to bind C++-Classes with Lua-Metatables. The first thing I needed to learn was that you can't call all functions of the C-API directly. Some of them must be called during a lua-call. If they be called directly you will often get an error like "PANIC: unprotected error in call to Lua API (no calling environment)" and your application will crash immediately. It tooks a long time until I noticed that I can't call

lua_replace(L, LUA_ENVIRONINDEX);

directly so I must use

lua_setfenv(L, -1);

if I want to set the current table as environment table. You will get the same error message if you try to load single libs (luaopen_..) directly. You must use luaL_openlibs or open it during a lua call.

Greetz,
BlueC0re

ARM - Reverse Engineering

I've spended the hole day with reverse engineering of a little application on my mobilephone. It was the first time I've been working with ARM-Assembler. Now, after a couple of hours I was successful. I have found the functions which I had been looking for and I was able to bring them back in a higher programming language.

Some important things in ARM:

Automatic static ARP-Table

Today I have tried to automate the static arp entries. Fortunately my Linux-Laptop has a wonderful Networkmanager. His dispatcher daemon supports shellscripts which will be executed during the different states of connecting to a network.

Hey Hey

Welcome to my new Weblog.

On this site I will post informations about me and my projects. I hope you will find some interesting things out here.

Greetz
BlueC0re