Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [buffer-overflow]

A classical programming bug that may lead to a possible security flaw in software. Exploitation of this bug is usually taking place either in the stack or in the heap.

1
vote
1answer
31 views

Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault

I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip. Here's my code of vuln.c #include <stdio.h> #include <string.h> #include <stdlib.h&...
4
votes
1answer
92 views

x86-64 bit Buffer Overflow, help with overwriting %rip

I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit. To this end I use the following vulnerable program: #include <stdio.h> #include <string.h> #include <...
3
votes
2answers
82 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
1
vote
1answer
58 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
0
votes
0answers
44 views

Why /bin/sh getting permission denied after jumping to a function?

I have a simple buffer overflow code like this : #include <stdlib.h> #include <stdio.h> #include <string.h> char* exec_string = "/bin/sh"; void shell(char* cmd) { system(cmd); } ...
7
votes
1answer
97 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
1answer
164 views

someone can help me recognize the vulnerability

I get this code and I can not find the vulnerability. I think this code may be vulnerable to buffer overflow. How do I prove it? #include <stdio.h> #include <stdlib.h> #include <...
-2
votes
1answer
77 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) ...
4
votes
1answer
59 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
2
votes
1answer
71 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
0
votes
1answer
51 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
1
vote
0answers
43 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
2
votes
1answer
47 views

Why SUID Shellcode not working but Basic Shellcode working?

I'm playing with Basic Buffer Overflow Protostar - Stack 5 #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> //gcc -z execstack -fno-stack-...
3
votes
1answer
241 views

Buffer overflow challenge - shell not opening

I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a give_shell function (they cover shellcode in the next challenge) I can successfully overwrite the saved EIP on ...
4
votes
3answers
142 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
1
vote
0answers
132 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
8
votes
2answers
618 views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
3
votes
2answers
394 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
3
votes
1answer
3k views

A buffer overflow exercise using a shellcode

I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to get the root shell once I have inserted a shellcode into the program. This is what I have until now:...
1
vote
1answer
398 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
1
vote
0answers
26 views

Possible to execute cgi application locally and preserve the permissions?

This was part of a challenge which is now ended. On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to ...
3
votes
1answer
429 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
3
votes
1answer
967 views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
0
votes
1answer
192 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
4
votes
1answer
1k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
44 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
4
votes
1answer
452 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
4
votes
1answer
636 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
1
vote
1answer
1k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
1
vote
2answers
205 views

Why can't I get the EIP to reflect my input

I am going through a tutorial which shows you how to exploit a stack based buffer overflow in a sample C program. The C code is: #include <string.h> void function(char *str) { char buffer[...
1
vote
1answer
226 views

Trouble understanding this rop chain

I recently saw a video of someone doing some rop work. And I have a lot of trouble about what is going on. His setup is like this: [garbage] [xor eax] [xor ebx] [address of "sh"] [pop ecx] [address ...
3
votes
3answers
4k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
2
votes
0answers
305 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
0
votes
1answer
225 views

buffer overflow-seg fault

I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to ptrace() (on itself), therefore the shellcode I'm using ...
2
votes
1answer
137 views

Passing arrays to a function call (Buffer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
0
votes
1answer
526 views

Null Byte not breaking shellcode

While exploiting a strcpy() buffer overflow in Win XP, I used the address of ESP after the crash to overwrite EIP. The address contained a null byte so it did not work, so I found a jmp esp ...
1
vote
1answer
92 views

The Addressing Problem?

I'm reading about buffer overflow and there's this part i didn't understand , it says : Eliminating Data Segments That assembly code works completely. However, it is useless. You can compile ...
0
votes
1answer
196 views

Address is 3 bytes - need 4 bytes to overwrite RET

I have an issue. The address for a function that I need to overwrite the RET to (buffer overflow) is only 3 bytes. However, I need 4 bytes to overwrite the RET exactly. What do I do?
0
votes
1answer
1k views

Beginner buffer overflow - why isn't my shellcode executing?

I'm following the video here: https://www.youtube.com/watch?v=N0DBu3TGejI ExploitMe.c #include<stdio.h> #include<string.h> main(int argc, char **argv) { char buffer[80]; ...
2
votes
1answer
8k views

Problem finding return address for shellcode

Howdy guys and ghouls, I've got a classic b0f, in fact it's the protostar stack5 exercise link to stack5 code Now I have the buffer + shellcode running up to overwriting EIP and I need to provide ...
2
votes
2answers
292 views

How should I reach my shellcode?

I am trying to exploit this little program I found on opensecuritytraining.info. But, somehow, I am stuck at this point. What I did was to create a file which gets read from the program. Here is the ...
6
votes
1answer
3k views

ROP exploitation in x86_64 linux

I am working on return oriented programming exploitation on a x86_64 Linux. However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are ...
3
votes
0answers
294 views

I want to know more about how a particular exploit works. How do I do that? [closed]

I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect ...
-2
votes
4answers
1k views

Does learning Metasploit help me in reverse engineering and malware analysis?

I learned basis of assembly language with, both, AT&T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for Metasploit now?
11
votes
1answer
4k views

Understanding the most recent heap implementation under Linux

A few days ago, I was wondering how one could teach himself heap-based overflow exploitation. So I searched through documentation, subsequently practicing what I read in order to have a better ...
6
votes
1answer
8k views

Illegal Instruction exploiting sample Buffer Overflow code

Some days ago I coded a simple code to test a buffer overflow exploitation on x86 system. In order to keep it simple I disabled ASLR and NX so there are no protection that could cause weird behaviours....
7
votes
1answer
1k views

Understanding this Buffer Overflow exploitation

some days ago I took this piece of code from opensecuritytraining.info to test a buffer overflow exploitation: #include <stdio.h> char *secret = "pepito"; void go_shell(){ char *shell = "/...
5
votes
1answer
210 views

Program won't crash on heap overflow

I'm trying to learn about heap overflows for this exploitation challenge I have to solve. In short, the program allocates 3 consecutive buffers on the heap, and I have access to write whatever I want ...
6
votes
1answer
1k views

GDB Error “Too many array elements”

I'm trying to understand very basic stack-based buffer overflow I'm running Debian wheezy on a x86_64 Macbook Pro. I have the following unsafe program: #include <stdlib.h> #include <stdio.h&...