3 ms·
> World’s First MIDI Shellcode There's been MIDI shell code for well over 20 years on pretty much all major platforms: https://cve.mitre.org/cgi-bin/cvekey.cgi
by SideQuark 2y ago
> World’s First MIDI Shellcode
There's been MIDI shell code for well over 20 years on pretty much all major platforms: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi
- LegionMammal978 2y agoPlenty of buffer overflows. But has anyone actually written a shellcode for those?
- SideQuark 2y agoMetasploit added automated shellcode generators into midi files at least a dozen years ago, likely earlier. https://www.exploit-db.com/exploits/18426 https://www.exploit-db.com/exploits/18426 So to test this, surely they tried it once, and presumably Metasploit users generated tons of them . And from having worked in this space a long time ago, such CVEs would trigger a host of malicious midi files looking for holes, especially since people embedded them in webpages around early 2000s. Around that time I'd routinely take a MS update, diff the DLLs, reverse interesting location changes, and craft shellcode attacks during training to show people how it's not very hard. And there were tons of people across the spectrum able to do similarly. CVE disclosures made them much easier to develop.