• Interchangeable Barrels!
• Multi-Sources for compressed air (CO2 or Bike Pump)
• Lots of safety features!  (Multiple ball valves, and a safety release valve)
  

The guys at PaulDotCom Security Weekly have this thing for wireless of all kinds. Wireless cards, cables, antennas, 802.11, RFID...the list goes on. Always on the lookout for something neat and useful they found the Asus EEE line of netbooks. They are small, usually feature Atheros wireless cards, and have a huge modding community. The small form factor is also something that works well for wireless assessments, whether covert or sanctioned. The size is conducive to easy transport in a small space or as a second laptop while traveling.

To those aims, the Asus 4G Surf (amongst others in the EEE family) works well, however the small internal wireless antennas don't offer much flexibility or range. We need to take some cues from the EEE modding community and extend the hardware to support a better antenna. So, here's how to add an external RP-TNC antenna connector to the Asus EEE 4G Surf.

➢ Hexadecimal number system
➢ Basic understanding of how Assembly language is used
➢ Basic understanding of Assembly Opcode Mnemomics
➢ Understanding of memory pointers
➢ General idea of memory registers and their use
➢ Some experience with writing program functions of any language

Likewise there are some requirements that you will need should you want to complete the exercise.  I highly suggest that you finish the exercise, as this will solidify a lot of the concepts that are discussed.  You will need:

➢ A WindowsXP SP1 machine (Virtual Machine is Ok) (Victim)
➢ Ollydbg installed on XP SP1 box
➢ OllySSEH Ollydbg Plugin installed on XP SP1 box
➢ ESF EasyChat Server 2.2 (Free)
➢ Another machine with Python installed. (can be any os) (Attacker)

One of the most important concepts to understand when writing functional exploits is that they are the result of a software bug. If all programs were perfectly written such that there were no flaws, there would be no vulnerabilities to exploit. In many cases, an attacker may be able to cause a program to crash due to insufficient error checking within the program. Causing the program to crash would be considered a Denial of Service (DOS) attack. However, causing a DOS condition in a program does not mean it can be fully exploited, but it does indicate that it could be possible. While there are several different types of attack vectors available to create a fully functional exploit, there are many cases where the conditions of the program or environment do not provide a viable exploit using any of the known vectors. This article is written with the assumption that an SEH attack vector is possible in the target software, and it is important to understand that this vector may not always be present in other vulnerable software.

Before we get started, take note that we will be mostly discussing the operation of two different software routines that are running simultaneously. One routine will be the vulnerable software program and it's supporting function libraries that we are attempting to corrupt. For us, this first routine will be the EasyChat server software. The second routine is the Windows system exception dispatcher which constantly runs waiting for an error condition to occur. The dispatcher routine attempts to handle any exceptions (errors) that may occur in the first routine (EasyChat). As we go through this paper, try to keep these two routines separate in your mind.