Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [buffer-overflow]

A classical programming bug that may lead to a possible security flaw in software. Exploitation of this bug is usually taking place either in the stack or in the heap.

6
votes
1answer
77 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
-1
votes
1answer
40 views

I have code with BOF vulnerability. i want use ROP technique. how start? [closed]

i have simple server side code want used ROP technique . #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/types.h> #...
3
votes
1answer
140 views

someone can help me recognize the vulnerability

I get this code and I can not find the vulnerability. I think this code may be vulnerable to buffer overflow. How do I prove it? #include <stdio.h> #include <stdlib.h> #include <...
-2
votes
1answer
63 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) ...
4
votes
1answer
42 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
2
votes
1answer
60 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
0
votes
1answer
48 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
1
vote
0answers
27 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
2
votes
1answer
29 views

Why SUID Shellcode not working but Basic Shellcode working?

I'm playing with Basic Buffer Overflow Protostar - Stack 5 #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> //gcc -z execstack -fno-stack-...
3
votes
1answer
173 views

Buffer overflow challenge - shell not opening

I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a give_shell function (they cover shellcode in the next challenge) I can successfully overwrite the saved EIP on ...
4
votes
3answers
135 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
1
vote
0answers
117 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
7
votes
2answers
447 views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
3
votes
2answers
313 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
3
votes
1answer
2k views

A buffer overflow exercise using a shellcode

I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to get the root shell once I have inserted a shellcode into the program. This is what I have until now:...
1
vote
1answer
346 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
1
vote
0answers
26 views

Possible to execute cgi application locally and preserve the permissions?

This was part of a challenge which is now ended. On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to ...
3
votes
1answer
349 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
3
votes
1answer
779 views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
0
votes
1answer
178 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
4
votes
1answer
983 views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
42 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
4
votes
1answer
392 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
4
votes
1answer
599 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
1
vote
1answer
1k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
1
vote
2answers
192 views

Why can't I get the EIP to reflect my input

I am going through a tutorial which shows you how to exploit a stack based buffer overflow in a sample C program. The C code is: #include <string.h> void function(char *str) { char buffer[...
1
vote
1answer
205 views

Trouble understanding this rop chain

I recently saw a video of someone doing some rop work. And I have a lot of trouble about what is going on. His setup is like this: [garbage] [xor eax] [xor ebx] [address of "sh"] [pop ecx] [address ...
3
votes
3answers
4k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
2
votes
0answers
292 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
0
votes
1answer
215 views

buffer overflow-seg fault

I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to ptrace() (on itself), therefore the shellcode I'm using ...
2
votes
1answer
131 views

Passing arrays to a function call (Buffer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
0
votes
1answer
497 views

Null Byte not breaking shellcode

While exploiting a strcpy() buffer overflow in Win XP, I used the address of ESP after the crash to overwrite EIP. The address contained a null byte so it did not work, so I found a jmp esp ...
1
vote
1answer
92 views

The Addressing Problem?

I'm reading about buffer overflow and there's this part i didn't understand , it says : Eliminating Data Segments That assembly code works completely. However, it is useless. You can compile ...
0
votes
1answer
168 views

Address is 3 bytes - need 4 bytes to overwrite RET

I have an issue. The address for a function that I need to overwrite the RET to (buffer overflow) is only 3 bytes. However, I need 4 bytes to overwrite the RET exactly. What do I do?
0
votes
1answer
1k views

Beginner buffer overflow - why isn't my shellcode executing?

I'm following the video here: https://www.youtube.com/watch?v=N0DBu3TGejI ExploitMe.c #include<stdio.h> #include<string.h> main(int argc, char **argv) { char buffer[80]; ...
2
votes
1answer
7k views

Problem finding return address for shellcode

Howdy guys and ghouls, I've got a classic b0f, in fact it's the protostar stack5 exercise link to stack5 code Now I have the buffer + shellcode running up to overwriting EIP and I need to provide ...
2
votes
2answers
283 views

How should I reach my shellcode?

I am trying to exploit this little program I found on opensecuritytraining.info. But, somehow, I am stuck at this point. What I did was to create a file which gets read from the program. Here is the ...
6
votes
1answer
3k views

ROP exploitation in x86_64 linux

I am working on return oriented programming exploitation on a x86_64 Linux. However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are ...
3
votes
0answers
291 views

I want to know more about how a particular exploit works. How do I do that? [closed]

I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect ...
-2
votes
4answers
1k views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
11
votes
1answer
4k views

Understanding the most recent heap implementation under Linux

A few days ago, I was wondering how one could teach himself heap-based overflow exploitation. So I searched through documentation, subsequently practicing what I read in order to have a better ...
6
votes
1answer
8k views

Illegal Instruction exploiting sample Buffer Overflow code

Some days ago I coded a simple code to test a buffer overflow exploitation on x86 system. In order to keep it simple I disabled ASLR and NX so there are no protection that could cause weird behaviours....
7
votes
1answer
1k views

Understanding this Buffer Overflow exploitation

some days ago I took this piece of code from opensecuritytraining.info to test a buffer overflow exploitation: #include <stdio.h> char *secret = "pepito"; void go_shell(){ char *shell = "/...
5
votes
1answer
208 views

Program won't crash on heap overflow

I'm trying to learn about heap overflows for this exploitation challenge I have to solve. In short, the program allocates 3 consecutive buffers on the heap, and I have access to write whatever I want ...
6
votes
1answer
987 views

GDB Error “Too many array elements”

I'm trying to understand very basic stack-based buffer overflow I'm running Debian wheezy on a x86_64 Macbook Pro. I have the following unsafe program: #include <stdlib.h> #include <stdio.h&...
7
votes
3answers
5k views

buffer overflow exploits - Why is the shellcode put before the return address

The code I'm referring to is found here: Link to code I read that the buffer overflow exploit uses a buffer that looks something like this: | NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS | From ...
3
votes
2answers
354 views

Why is this string on the stack not exactly the one I entered? [closed]

I was trying to understand buffer overflow attacks using the following C program #include"stdio.h" #include"string.h" void iwontprint() { printf("i wont be printed!"); } void ...