Vm ware fuzzing - defcon russia 20

•

3 likes•2,798 views

http://defcon-russia.ru

Virtual DoS is useful
Peter Kamensky
@Python0x0
Defcon Russia 0x16

WhoAmI
•
•

Agenda
•
•
•
•
•

VMWare VM theory notes

VMWare Backdoor I/O
•
•
•
•

VMWare GuestRPC
•
•
•
•

GuestRPC work scheme
Open Channel Send length Send data
Get return
data length
Receive data End of receive Close channel

GuestRPC packet example

VMWare VM main loop
VMM vmx86/ESXi-kernelGuest VM
Backdoor I/O UserRPC
user-mode
vmware-vmx
main vm-loop
I/O UserRPC
handler
GuestRPC
handler
IOCTL/syscall
BackDoor I/O
handler

Fuzzing GuestRPC

Grab GuestRPC commands
•
•
•
http://pastebin.com/HWGtfy3G

Create a simple fuzzer
•
•
•
•

HGFS DoS bugs

Host Guest File System
•
• “ ”
•

HGFS #1
•
•
•

HGFS #2
•
•
•

SetGuestInfo memory leak

SetGuestInfo
•
• “ ”

Host memory abuse

Impact
•
•
•

VMWare fixes
•
•

How to Use?

Countermeasure to AV sandbox system
•
•
•

Obvious steps
•
•
•

Not so easy
•
•
•
• 
•

Never Fixed VMWare behavior
•
•
•
http://www.piotrbania.com/all/adv/vmware-io-adv.txt

RWEverything
•
•
•
•
http://rweverything.com/

NOT_IMPLEMENTED+RWEverything
•
•
•
•

Conclusion
•
•
•

Questions?

More Related Content

What's hot

Pf: the OpenBSD packet filter

Pf: the OpenBSD packet filter

Pf: the OpenBSD packet filter

Giovanni Bechis

Debugging TV Frame 0x09

Debugging TV Frame 0x09

Debugging TV Frame 0x09

Dmitry Vostokov

Cisco network equipment has always been an attractive attack target due to its prevalence and the key role that it plays in network structure and security. This equipment is based on a wide variety of OS (firmware) architectures, types, and versions, so it is much harder to develop a universal shellcode. Publicly available Cisco IOS shellcodes are tailored to specific equipment, have narrow functionality, and are not exactly useful for penetration testing. This talk is the presentation of a research initiated by our research center to create a shellcode which is as easily portable between different IOS firmwares as possible and which provides a lot of pentesting features because it can dynamically change the shellcode destination at the stage of post-exploitation. We will also consider the possibility of creating a worm which could spread across the infrastructure, from firewall to router, from router to switch, etc.

Cisco IOS shellcode: All-in-one

Cisco IOS shellcode: All-in-one

Cisco IOS shellcode: All-in-one

Ctf hello,world!

Ctf hello,world!

Ctf hello,world!

Hacks in Taiwan (HITCON)

Reverse engineering Swisscom's Centro Grande Modem

Reverse engineering Swisscom's Centro Grande Modem

Reverse engineering Swisscom's Centro Grande Modem

Cyber Security Alliance

QEMU - Binary Translation

QEMU - Binary Translation

QEMU - Binary Translation

Linux seccomp(2) vs OpenBSD pledge(2)

Linux seccomp(2) vs OpenBSD pledge(2)

Linux seccomp(2) vs OpenBSD pledge(2)

Giovanni Bechis

Devirtualizing FinSpy

Devirtualizing FinSpy

Devirtualizing FinSpy

Translation Cache Policies for Dynamic Binary Translation

Translation Cache Policies for Dynamic Binary Translation

Translation Cache Policies for Dynamic Binary Translation

Since the emerging of the OpenStack cloud computing platform in the Ubuntu community, increasing number of public/private cloud service providers choose to deploy it all over the world. Recently, Spectre and Meltdown have caused a panic in the world and the Spectre V2 is the only one which can attack the host system from the guest VM. It's vital to know the detailed process of the attack. Gavin Guo will give a detail explanation and an example of how to attack the host system. Besides, v1/v3/v4 are also introduced in the slide.

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Plan 9カーネルにおけるTCP/IP実装（未完）

Plan 9カーネルにおけるTCP/IP実装（未完）

Plan 9カーネルにおけるTCP/IP実装（未完）

grsecurity and PaX

grsecurity and PaX

grsecurity and PaX

Hacking the swisscom modem

Hacking the swisscom modem

Hacking the swisscom modem

Cyber Security Alliance

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Humantalk Angers 14 Mars

Humantalk Angers 14 Mars

Humantalk Angers 14 Mars

SMP Implementation for OpenBSD/sgi [Japanese Edition]

SMP Implementation for OpenBSD/sgi [Japanese Edition]

SMP Implementation for OpenBSD/sgi [Japanese Edition]

主機自保指南

ch6-pv2-device-drivers

ch6-pv2-device-drivers

ch6-pv2-device-drivers

A little systemtap

A little systemtap

A little systemtap

Sysprog17

What's hot (20)

Pf: the OpenBSD packet filter

Pf: the OpenBSD packet filter

Pf: the OpenBSD packet filter

Debugging TV Frame 0x09

Debugging TV Frame 0x09

Debugging TV Frame 0x09

Cisco IOS shellcode: All-in-one

Cisco IOS shellcode: All-in-one

Cisco IOS shellcode: All-in-one

Ctf hello,world!

Ctf hello,world!

Ctf hello,world!

Reverse engineering Swisscom's Centro Grande Modem

Reverse engineering Swisscom's Centro Grande Modem

Reverse engineering Swisscom's Centro Grande Modem

QEMU - Binary Translation

QEMU - Binary Translation

QEMU - Binary Translation

Linux seccomp(2) vs OpenBSD pledge(2)

Linux seccomp(2) vs OpenBSD pledge(2)

Linux seccomp(2) vs OpenBSD pledge(2)

Devirtualizing FinSpy

Devirtualizing FinSpy

Devirtualizing FinSpy

Translation Cache Policies for Dynamic Binary Translation

Translation Cache Policies for Dynamic Binary Translation

Translation Cache Policies for Dynamic Binary Translation

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Spectre(v1%2 fv2%2fv4) v.s. meltdown(v3)

Plan 9カーネルにおけるTCP/IP実装（未完）

Plan 9カーネルにおけるTCP/IP実装（未完）

Plan 9カーネルにおけるTCP/IP実装（未完）

grsecurity and PaX

grsecurity and PaX

grsecurity and PaX

Hacking the swisscom modem

Hacking the swisscom modem

Hacking the swisscom modem

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Semtex.c [CVE-2013-2094] - A Linux Privelege Escalation

Humantalk Angers 14 Mars

Humantalk Angers 14 Mars

Humantalk Angers 14 Mars

SMP Implementation for OpenBSD/sgi [Japanese Edition]

SMP Implementation for OpenBSD/sgi [Japanese Edition]

SMP Implementation for OpenBSD/sgi [Japanese Edition]

主機自保指南

ch6-pv2-device-drivers

ch6-pv2-device-drivers

ch6-pv2-device-drivers

A little systemtap

A little systemtap

A little systemtap

Sysprog17

Viewers also liked

Weakpass - defcon russia 23

Weakpass - defcon russia 23

Weakpass - defcon russia 23

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Nedospasov defcon russia 23

Nedospasov defcon russia 23

Nedospasov defcon russia 23

static - defcon russia 20

static - defcon russia 20

static - defcon russia 20

nosymbols - defcon russia 20

nosymbols - defcon russia 20

nosymbols - defcon russia 20

Мы поговорим об общей проблеме валидации входных данных и качестве их обработки. Интерпретация входящих данных оказывает прямое влияние на решения, принимаемые в физической инфраструктуре: если какая-либо часть данных обрабатывается недостаточно аккуратно, это может повлиять на эффективность и безопасность процесса. В этой беседе мы обсудим атаки на процесс обработки данных и природу концепции «never trust your inputs» в контексте информационно-физических систем (в общем смысле, то есть любых подобных систем). Для иллюстрации проблемы мы используем уязвимости аналого-цифровых преобразователей (АЦП), которые можно заставить выдавать поддельный цифровой сигнал с помощью изменения частоты и фазы входящего аналогового сигнала: ошибка масштабирования такого сигнала может вызывать целочисленное переполнение и дает возможность эксплуатировать уязвимости в логике PLC/встроенного ПО. Также мы покажем реальные примеры использования подобных уязвимостей и последствия этих нападений.

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

Георгий Зайцев - Reversing golang

Георгий Зайцев - Reversing golang

Георгий Зайцев - Reversing golang

Расскажу где и как iCloud Keychain хранит пароли, и какие потенциальные риски это несёт. Apple утверждает, что пароли надежно защищены, и даже её сотрудники не могут получить к ним доступ. Чтобы это подтвердить или опровергнуть, необходимо разобраться с внутренним устройством iCloud Keychain, чем мы и займемся.

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Attacks on tacacs - Алексей Тюрин

Attacks on tacacs - Алексей Тюрин

Attacks on tacacs - Алексей Тюрин

В Spring MVC есть классная фича — autobinding. Но если пользоваться ей неправильно, могут появиться «незаметные» уязвимости, иногда с серьёзным импактом. Рассмотрим пару примеров, углубимся в тонкости появления autobinding-багов. Writeup [ENG]: http://agrrrdog.blogspot.ru/2017/03/autobinding-vulns-and-spring-mvc.html

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

Intel Boot Guard — аппаратно поддержанная технология верификации подлинности BIOS, которую вендор компьютерной системы может встроить на этапе производства. Докладчик представит результаты анализа технологии, расскажет об её эволюции. Слушатели узнают, как годами клонируемая ошибка на производстве нескольких вендоров позволяет потенциальному злоумышленнику воспользоваться этой технологией для создания в системе неудаляемого (даже программатором!) скрытого руткита. Github: https://github.com/flothrone/bootguard

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

Руткиты в мире основанных на ядре Linux операционных систем уже не являются редкостью. Рассказ будет о том, как попытки в современных реалиях определить то, скомпрометирована ли система, привели к неожиданному результату.

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

Miasm defcon russia 23

Miasm defcon russia 23

Miasm defcon russia 23

HTTP HOST header attacks

HTTP HOST header attacks

HTTP HOST header attacks

Format/VM WARE/OS's Tutorial

Format/VM WARE/OS's Tutorial

Format/VM WARE/OS's Tutorial

Evangelos Gkikopoulos

Mind tickle overview

Mind tickle overview

Mind tickle overview

Alexey Sintsov- SDLC - try me to implement

Alexey Sintsov- SDLC - try me to implement

Alexey Sintsov- SDLC - try me to implement

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Кратко расскажу о концепции изолированных сетей и возможных путях их компрометации. Сделаю обзор аппаратной закладки pwnie express- для чего создавалось, какие возможности использования. Расскажу о том как pwnie express применялась в реальном проекте, какие были трудности и что из этого вышло.

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Viewers also liked (20)

Weakpass - defcon russia 23

Weakpass - defcon russia 23

Weakpass - defcon russia 23

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Олег Купреев - Обзор и демонстрация нюансов и трюков из области беспроводных ...

Nedospasov defcon russia 23

Nedospasov defcon russia 23

Nedospasov defcon russia 23

static - defcon russia 20

static - defcon russia 20

static - defcon russia 20

nosymbols - defcon russia 20

nosymbols - defcon russia 20

nosymbols - defcon russia 20

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

[DCG 25] Александр Большев - Never Trust Your Inputs or How To Fool an ADC

Георгий Зайцев - Reversing golang

Георгий Зайцев - Reversing golang

Георгий Зайцев - Reversing golang

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Andrey Belenko, Alexey Troshichev - Внутреннее устройство и безопасность iClo...

Attacks on tacacs - Алексей Тюрин

Attacks on tacacs - Алексей Тюрин

Attacks on tacacs - Алексей Тюрин

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

[Defcon Russia #29] Алексей Тюрин - Spring autobinding

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Александр Ермолов - Safeguarding rootkits: Intel Boot Gua...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

[Defcon Russia #29] Борис Савков - Bare-metal programming на примере Raspber...

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

[Defcon Russia #29] Михаил Клементьев - Обнаружение руткитов в GNU/Linux

Miasm defcon russia 23

Miasm defcon russia 23

Miasm defcon russia 23

HTTP HOST header attacks

HTTP HOST header attacks

HTTP HOST header attacks

Format/VM WARE/OS's Tutorial

Format/VM WARE/OS's Tutorial

Format/VM WARE/OS's Tutorial

Mind tickle overview

Mind tickle overview

Mind tickle overview

Alexey Sintsov- SDLC - try me to implement

Alexey Sintsov- SDLC - try me to implement

Alexey Sintsov- SDLC - try me to implement

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Tyurin Alexey - NTLM. Part 1. Pass-the-Hash

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Taras Tatarinov - Применение аппаратных закладок pwnie express на примере реа...

Similar to Vm ware fuzzing - defcon russia 20

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

OpenStack Korea Community

Small Python Tools for Software Release Engineering

Small Python Tools for Software Release Engineering

Small Python Tools for Software Release Engineering

Bridging the Semantic Gap in Virtualized Environment

Bridging the Semantic Gap in Virtualized Environment

Bridging the Semantic Gap in Virtualized Environment

17-virtualization.pptx

17-virtualization.pptx

17-virtualization.pptx

KowsalyaJayakumar2

Presentation from KVM Forum 2020. In the past, there were several attempted to enable live migration for VMs that are using SR-IOV NICs. We are going to discuss the recent development based on the SR-IOV failover feature in virtio specification and its implementation for the Windows guests. In this session, Annie Li and Yan Vugenfirer will provide an overview of the failover feature and discuss specifics of the Windows guest implementation.

Implementing SR-IOv failover for Windows guests during live migration

Implementing SR-IOv failover for Windows guests during live migration

Implementing SR-IOv failover for Windows guests during live migration

5. IO virtualization

5. IO virtualization

5. IO virtualization

RMLL / LSM 2009

RMLL / LSM 2009

RMLL / LSM 2009

Franck_Villaume

Rmll Virtualization As Is Tool 20090707 V1.0

Rmll Virtualization As Is Tool 20090707 V1.0

Rmll Virtualization As Is Tool 20090707 V1.0

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

Chris Huybregts

Virtualization security and threat

Virtualization security and threat

Virtualization security and threat

Ammarit Thongthua ,CISSP CISM GXPN CSSLP CCNP

Browser exploits are a primary attack vector to compromise a victims internal network, but they have major restrictions including; limited current browser exploits; the huge price for 0-day browser exploits; and exploit complexity due to sandboxing. So, instead of exploiting the victims browser, what if the victims browser exploited internal systems for you? The new "BeEF Bind Exploit Proxy" module does this! This BeEF (Browser Exploitation Framework) module will allow penetration testers to proxy exploits through a victims web browser to compromise internal services. Not only this, but the new "BeEF Bind" shellcode also enables the communication channel to the attacker to pass back through the existing browser session. This attack technique (Inter-protocol Exploitation) removes browser-based attacks from being dependent upon browser vulnerabilities. It increases the number of potential exploits to include many service vulnerabilities throughout the internal corporate network. This includes whatever service can be contacted via a browser request. This increases the success rate of client-side exploitation attempts by dramatically increasing the number of vulnerabilities accessible to the attacker. So how does the new BeEF Bind Exploit Proxy work? BeEF is configured to use the BeEF Bind Exploit Proxy, and is set as the payload for XSS exploits or Phishing attacks. Once the victim visits the malicious site, their web browser becomes hooked and performs JavaScript port scanning across the internal corporate network looking for chosen open ports. Once a server has been identified, the BeEF server is notified and begins to send exploits through the hooked web browser to the service on the internal server. Each of these exploits are configured to use the new BeEF Bind shellcode. Once an exploit has successfully triggered a vulnerability within the internal service, the BeEF Bind shellcode is executed. This shellcode is designed to setup a web-listener that proxies commands through to a shell on the compromised server. This allows the attacker to send commands through the hooked web browser to the BeEF Bind payload. The command is executed on the compromised server and returned to the web browser in HTTP responses. The hooked web browser is then able to receive the command output and proxy it back to the attacker at the BeEF server. Penetration testers can now inject steroids into their XSS exploits by replacing simple alert boxes with demonstrations of actual compromised internal machines. They can also now increase the scope and success rate of their Phishing attacks to compromise internal servers. This new approach also minimizes the likelihood of IDS/IPS detection, and does not require an additional socket open back to the attacker via the firewall.

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

SCU 2015 - Hyper-V Replica

SCU 2015 - Hyper-V Replica

SCU 2015 - Hyper-V Replica

[ppt]

Building a server to manage high concurrent connections is non-trival task. For those developers that use ActionScript 3 to build games on the client side it means having a totally different skillset. Being able to use ActionScript 3 on the server to build MMO’s or port client code to the server allows developers to leverage their skills on the server. By walking through a live game example with more then 15,000 concurrent connections running on a medium Amazon EC2 server the presentation will: 1. Introduce Linux server configuration for high concurrent connected usage. 2. Introduce Socket class based on libev library for high concurrent connection. 3. Introduce leveraging Tamarin project for ActionScript 3 on the server.

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Renaun Erickson

Vagrant

2017.06.19 Paul Woodward - ExploreVM VMware 101

2017.06.19 Paul Woodward - ExploreVM VMware 101

2017.06.19 Paul Woodward - ExploreVM VMware 101

Paul Woodward Jr

Denver VMUG nov 2011

Denver VMUG nov 2011

Denver VMUG nov 2011

Hypervisor Security - OpenStack Summit Hong Kong

Hypervisor Security - OpenStack Summit Hong Kong

Hypervisor Security - OpenStack Summit Hong Kong

What's new in System Center 2012 R2: Virtual Machine Manager

What's new in System Center 2012 R2: Virtual Machine Manager

What's new in System Center 2012 R2: Virtual Machine Manager

Similar to Vm ware fuzzing - defcon russia 20 (20)

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

AsiaBSDCon2023 - Hardening Emulated Devices in OpenBSD’s vmd(8) Hypervisor

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

[OpenStack Day in Korea 2015] Track 1-4 - VDI OpenStack? It Works!!!

Small Python Tools for Software Release Engineering

Small Python Tools for Software Release Engineering

Small Python Tools for Software Release Engineering

Bridging the Semantic Gap in Virtualized Environment

Bridging the Semantic Gap in Virtualized Environment

Bridging the Semantic Gap in Virtualized Environment

17-virtualization.pptx

17-virtualization.pptx

17-virtualization.pptx

Implementing SR-IOv failover for Windows guests during live migration

Implementing SR-IOv failover for Windows guests during live migration

Implementing SR-IOv failover for Windows guests during live migration

5. IO virtualization

5. IO virtualization

5. IO virtualization

RMLL / LSM 2009

RMLL / LSM 2009

RMLL / LSM 2009

Rmll Virtualization As Is Tool 20090707 V1.0

Rmll Virtualization As Is Tool 20090707 V1.0

Rmll Virtualization As Is Tool 20090707 V1.0

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

s6196-chris-huybregts-microsoft-new-gpu-virtualization-technologies

Virtualization security and threat

Virtualization security and threat

Virtualization security and threat

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

SCU 2015 - Hyper-V Replica

SCU 2015 - Hyper-V Replica

SCU 2015 - Hyper-V Replica

[ppt]

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Building an ActionScript Game Server with over 15,000 Concurrent Connections

Vagrant

2017.06.19 Paul Woodward - ExploreVM VMware 101

2017.06.19 Paul Woodward - ExploreVM VMware 101

2017.06.19 Paul Woodward - ExploreVM VMware 101

Denver VMUG nov 2011

Denver VMUG nov 2011

Denver VMUG nov 2011

Hypervisor Security - OpenStack Summit Hong Kong

Hypervisor Security - OpenStack Summit Hong Kong

Hypervisor Security - OpenStack Summit Hong Kong

What's new in System Center 2012 R2: Virtual Machine Manager

What's new in System Center 2012 R2: Virtual Machine Manager

What's new in System Center 2012 R2: Virtual Machine Manager

More from DefconRussia

Все шире и шире получают распространение bugbounty программы - программы вознаграждения за уязвимости различных вендоров. И порой при поиске уязвимостей находятся места, которые явно небезопасны (например - self XSS), но доказать от них угрозу сложно. Но чем крупнее (хотя, скорее адекватнее) вендор, тем они охотнее обсуждают и просят показать угрозу от сообщенной уязвимости, и при успехе – вознаграждают 8). Мой доклад – подборка таких сложных ситуаций и рассказ, как же можно доказать угрозу.

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

Мои последние исселодования показали, что у SharePoint есть определенное количество вэб сервисов, которые могут помочь аудитору собрать крайне полезную информацию с сайта (списки пользователей, групп, ролей и т д). Также данные сервисы, в комбинации с хранимыми XSS, могут быть использованы для вертикального повышения привилегий или предоставить информацию для компрометации доменных записей AD.

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

Anton Alexanenkov - Tor and Botnet C&C

Anton Alexanenkov - Tor and Botnet C&C

Anton Alexanenkov - Tor and Botnet C&C

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Peter Hlavaty - DBIFuzz

Peter Hlavaty - DBIFuzz

Peter Hlavaty - DBIFuzz

Vadim Bardakov - AVR & MSP exploitation

Vadim Bardakov - AVR & MSP exploitation

Vadim Bardakov - AVR & MSP exploitation

Tomas Hlavacek - IP fragmentation attack on DNS

Tomas Hlavacek - IP fragmentation attack on DNS

Tomas Hlavacek - IP fragmentation attack on DNS

More from DefconRussia (9)

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

Sergey Belov - Покажите нам Impact! Доказываем угрозу в сложных условиях

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

George Lagoda - Альтернативное использование вэб сервисов SharePoint со сторо...

Anton Alexanenkov - Tor and Botnet C&C

Anton Alexanenkov - Tor and Botnet C&C

Anton Alexanenkov - Tor and Botnet C&C

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Scary

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 2 Practice

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Roman Korkikyan - Timing analysis workshop Part 1 Theory

Peter Hlavaty - DBIFuzz

Peter Hlavaty - DBIFuzz

Peter Hlavaty - DBIFuzz

Vadim Bardakov - AVR & MSP exploitation

Vadim Bardakov - AVR & MSP exploitation

Vadim Bardakov - AVR & MSP exploitation

Tomas Hlavacek - IP fragmentation attack on DNS

Tomas Hlavacek - IP fragmentation attack on DNS

Tomas Hlavacek - IP fragmentation attack on DNS

Recently uploaded

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

Angeliki Cooney has spent over twenty years at the forefront of the life sciences industry, working out of Wynantskill, NY. She is highly regarded for her dedication to advancing the development and accessibility of innovative treatments for chronic diseases, rare disorders, and cancer. Her professional journey has centered on strategic consulting for biopharmaceutical companies, facilitating digital transformation, enhancing omnichannel engagement, and refining strategic commercial practices. Angeliki's innovative contributions include pioneering several software-as-a-service (SaaS) products for the life sciences sector, earning her three patents. As the Senior Vice President of Life Sciences at Avenga, Angeliki orchestrated the firm's strategic entry into the U.S. market. Avenga, a renowned digital engineering and consulting firm, partners with significant entities in the pharmaceutical and biotechnology fields. Her leadership was instrumental in expanding Avenga's client base and establishing its presence in the competitive U.S. market.

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Angeliki Cooney

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Six Myths about Ontologies: The Basics of Formal Ontology

Six Myths about Ontologies: The Basics of Formal Ontology

Six Myths about Ontologies: The Basics of Formal Ontology

johnbeverley2021

MS Copilot expands with MS Graph connectors

MS Copilot expands with MS Graph connectors

MS Copilot expands with MS Graph connectors

Nanddeep Nachan

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

Apidays New York 2024 - The value of a flexible API Management solution for O...

Apidays New York 2024 - The value of a flexible API Management solution for O...

Discover the innovative features and strategic vision that keep WSO2 an industry leader. Explore the exciting 2024 roadmap of WSO2 API management, showcasing innovations, unified APIM/APK control plane, natural language API interaction, and cloud native agility. Discover how open source solutions, microservices architecture, and cloud native technologies unlock seamless API management in today's dynamic landscapes. Leave with a clear blueprint to revolutionize your API journey and achieve industry success!

WSO2's API Vision: Unifying Control, Empowering Developers

WSO2's API Vision: Unifying Control, Empowering Developers

WSO2's API Vision: Unifying Control, Empowering Developers

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

MINDCTI Revenue Release Quarter One 2024

MINDCTI Revenue Release Quarter One 2024

MINDCTI Revenue Release Quarter One 2024

Passkeys: Developing APIs to enable passwordless authentication Cody Salas, Sr Developer Advocate | Solutions Architect - Yubico Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Keynote 2: APIs in 2030: The Risk of Technological Sleepwalk Paolo Malinverno, Growth Advisor - The Business of Technology Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Recently uploaded (20)

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

CNIC Information System with Pakdata Cf In Pakistan

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

DBX First Quarter 2024 Investor Presentation

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Architecting Cloud Native Applications

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Exploring Multimodal Embeddings with Milvus

Six Myths about Ontologies: The Basics of Formal Ontology

Six Myths about Ontologies: The Basics of Formal Ontology

Six Myths about Ontologies: The Basics of Formal Ontology

MS Copilot expands with MS Graph connectors

MS Copilot expands with MS Graph connectors

MS Copilot expands with MS Graph connectors

Apidays New York 2024 - The value of a flexible API Management solution for O...

Apidays New York 2024 - The value of a flexible API Management solution for O...

Apidays New York 2024 - The value of a flexible API Management solution for O...

WSO2's API Vision: Unifying Control, Empowering Developers

WSO2's API Vision: Unifying Control, Empowering Developers

WSO2's API Vision: Unifying Control, Empowering Developers

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

presentation ICT roal in 21st century education

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

FWD Group - Insurer Innovation Award 2024

MINDCTI Revenue Release Quarter One 2024

MINDCTI Revenue Release Quarter One 2024

MINDCTI Revenue Release Quarter One 2024

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...

Vm ware fuzzing - defcon russia 20

1. Virtual DoS is useful Peter Kamensky @Python0x0 Defcon Russia 0x16

2. WhoAmI • •

3. Agenda • • • • •

4. VMWare VM theory notes

5. VMWare Backdoor I/O • • • •

6. VMWare GuestRPC • • • •

7. GuestRPC work scheme Open Channel Send length Send data Get return data length Receive data End of receive Close channel

8. GuestRPC packet example

9. VMWare VM main loop VMM vmx86/ESXi-kernelGuest VM Backdoor I/O UserRPC user-mode vmware-vmx main vm-loop I/O UserRPC handler GuestRPC handler IOCTL/syscall BackDoor I/O handler

10. Fuzzing GuestRPC

11. Grab GuestRPC commands • • • http://pastebin.com/HWGtfy3G

12. Create a simple fuzzer • • • •

13. HGFS DoS bugs

14. Host Guest File System • • “ ” •

15. HGFS #1 • • •

16. HGFS #2 • • •

17. SetGuestInfo memory leak

18. SetGuestInfo • • “ ”

19. Host memory abuse

20. Impact • • •

21. VMWare fixes • •

22. How to Use?

23. Countermeasure to AV sandbox system • • •

24. Obvious steps • • •

25. Not so easy • • • •  •

26. Never Fixed VMWare behavior • • • http://www.piotrbania.com/all/adv/vmware-io-adv.txt

27. RWEverything • • • • http://rweverything.com/

28. NOT_IMPLEMENTED+RWEverything • • • •

29. Conclusion • • •