Questions tagged [buffer-overflow]

A classical programming bug that may lead to a possible security flaw in software. Exploitation of this bug is usually taking place either in the stack or in the heap.

Filter by
Sorted by
Tagged with
2
votes
0answers
47 views

Using Angr in Vulnerability Research

I would like to use angr for vulnerability research. I was thinking that if I did the following: p = angr.Project('a.out', auto_load_libs=False) sm = p.factory.simulation_manager() while len(sm....
3
votes
1answer
73 views

Illegal instruction error in simple buffer overflow

I using following C code for testing stack based simple buffer overflow #include<stdio.h> #include<string.h> void copier(char *arg){ char buffer[100]; strcpy(buffer,arg); } int ...
0
votes
0answers
49 views

Buffer overflow resources

What are prerequisites for learning buffer overflow? What should I learn before I dive into this subject? What are the best resources for learning buffer overflow from scratch? I'm a pentester but I ...
0
votes
0answers
41 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
1
vote
0answers
152 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
0
votes
1answer
142 views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
1
vote
0answers
91 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
1answer
86 views

why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv[1]); return 0; }
2
votes
1answer
131 views

ROP chain: Buffer Overflow Return Pointer

I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit. I have a 64 bit binary (Nx enabled, ASLR disabled) with vuln function as follows: public vuln vuln proc near var_100= byte ptr -...
-2
votes
1answer
164 views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
1
vote
1answer
246 views

Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault

I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip. Here's my code of vuln.c #include <stdio.h> #include <string.h> #include <stdlib.h&...
4
votes
1answer
476 views

x86-64 bit Buffer Overflow, help with overwriting %rip

I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit. To this end I use the following vulnerable program: #include <stdio.h> #include <string.h> #include <...
3
votes
2answers
313 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
1
vote
1answer
181 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
7
votes
1answer
291 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
1answer
174 views

someone can help me recognize the vulnerability

I get this code and I can not find the vulnerability. I think this code may be vulnerable to buffer overflow. How do I prove it? #include <stdio.h> #include <stdlib.h> #include <...
-2
votes
1answer
102 views

I have control to EIP but no have idea when put the shellcode - not have any dll return adress

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use #include <stdio.h> #include <string.h> int main(void) ...
4
votes
1answer
124 views

GS Cookie and exception handlers

I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the ...
2
votes
1answer
94 views

Why do we need to know the address of shellcode?

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow. "It's difficult to know the starting address of the shellcode" Why do we need to know the address ...
0
votes
1answer
65 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
1
vote
0answers
111 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
2
votes
1answer
191 views

Why SUID Shellcode not working but Basic Shellcode working?

I'm playing with Basic Buffer Overflow Protostar - Stack 5 #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> //gcc -z execstack -fno-stack-...
3
votes
1answer
363 views

Buffer overflow challenge - shell not opening

I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a give_shell function (they cover shellcode in the next challenge) I can successfully overwrite the saved EIP on ...
3
votes
3answers
169 views

Debug vs Release binaries - Overflow detection

I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build: push ebp mov ebp, esp sub esp, 0F0h push ebx push esi push edi lea edi, [ebp+var_F0] mov ecx, ...
1
vote
0answers
200 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
8
votes
2answers
1k views

What causes the need for NOP sleds?

So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is: NOP Sled -> Shellcode -> Padding -> New RET Address (...
4
votes
2answers
877 views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
2
votes
1answer
4k views

A buffer overflow exercise using a shellcode

I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to get the root shell once I have inserted a shellcode into the program. This is what I have until now:...
1
vote
1answer
533 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
1
vote
0answers
29 views

Possible to execute cgi application locally and preserve the permissions?

This was part of a challenge which is now ended. On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to ...
2
votes
1answer
545 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
2
votes
1answer
1k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
0
votes
1answer
262 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
3
votes
1answer
2k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
56 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
3
votes
1answer
577 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
4
votes
1answer
788 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
0answers
55 views

Reverse Engineer an iOS MP4 Bug [duplicate]

Recently I came across and malformed mp4 that when played on the iPhone would crash the device. I am trying to figure out which bits are specifically responsible for the crash. I am wondering if ...
1
vote
1answer
2k views

Access violation error only when stepping after breakpoint in Immunity

Following a tutorial at http://www.fuzzysecurity.com/tutorials/expDev/2.html, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as ...
1
vote
2answers
275 views

Why can't I get the EIP to reflect my input

I am going through a tutorial which shows you how to exploit a stack based buffer overflow in a sample C program. The C code is: #include <string.h> void function(char *str) { char buffer[...
1
vote
1answer
261 views

Trouble understanding this rop chain

I recently saw a video of someone doing some rop work. And I have a lot of trouble about what is going on. His setup is like this: [garbage] [xor eax] [xor ebx] [address of "sh"] [pop ecx] [address ...
4
votes
3answers
7k views

How to effectively bypass GCC stack smashing detection

I was solving bof challenge on http://pwnable.kr/play.php it is required to smash the stack of the following code #include <stdio.h> #include <string.h> #include <stdlib.h> void ...
2
votes
0answers
348 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
0
votes
1answer
245 views

buffer overflow-seg fault

I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to ptrace() (on itself), therefore the shellcode I'm using ...
2
votes
1answer
147 views

Passing arrays to a function call (Buffer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
0
votes
1answer
596 views

Null Byte not breaking shellcode

While exploiting a strcpy() buffer overflow in Win XP, I used the address of ESP after the crash to overwrite EIP. The address contained a null byte so it did not work, so I found a jmp esp ...
1
vote
1answer
97 views

The Addressing Problem?

I'm reading about buffer overflow and there's this part i didn't understand , it says : Eliminating Data Segments That assembly code works completely. However, it is useless. You can compile ...
0
votes
1answer
306 views

Address is 3 bytes - need 4 bytes to overwrite RET

I have an issue. The address for a function that I need to overwrite the RET to (buffer overflow) is only 3 bytes. However, I need 4 bytes to overwrite the RET exactly. What do I do?
0
votes
1answer
1k views

Beginner buffer overflow - why isn't my shellcode executing?

I'm following the video here: https://www.youtube.com/watch?v=N0DBu3TGejI ExploitMe.c #include<stdio.h> #include<string.h> main(int argc, char **argv) { char buffer[80]; ...
2
votes
1answer
10k views

Problem finding return address for shellcode

Howdy guys and ghouls, I've got a classic b0f, in fact it's the protostar stack5 exercise link to stack5 code Now I have the buffer + shellcode running up to overwriting EIP and I need to provide ...