Questions tagged [buffer-overflow]
A classical programming bug that may lead to a possible security flaw in software. Exploitation of this bug is usually taking place either in the stack or in the heap.
26
questions with no upvoted or accepted answers
4
votes
0
answers
956
views
Using Angr in Vulnerability Research
I would like to use angr for vulnerability research.
I was thinking that if I did the following:
p = angr.Project('a.out', auto_load_libs=False)
sm = p.factory.simulation_manager()
while len(sm....
- 41
3
votes
0
answers
45
views
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:
int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory
int main(int argc, char**...
- 31
3
votes
0
answers
142
views
How to leak buffer address on the stack?
I am new to buffer overflows and I was trying to overwrite the saved RIP to point to a buffer containing a shellcode. The buffer is located onto the stack so its address is randomized. How can I leak ...
- 51
3
votes
0
answers
40
views
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)
In Ida I see that the buffer that has the overflow located in SP+200
In the beginning if function I can see the stack size because I see the ...
- 281
2
votes
0
answers
203
views
Overwriting the Global Offset Table + format string vulnerability
I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get:
objdump -R ./fmt ...
- 31
2
votes
0
answers
67
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
2
votes
0
answers
81
views
Invalid address when overwriting saved rip with buffer's address
I have an executable vulnerable to buffer overflows. The program takes a buffer of 104 chars and prints it (unfortunately, there is no format string vulnerability) until we feed it with a 0 or a \n, ...
- 51
2
votes
0
answers
161
views
How do I calculate where to put the canary value in a program
I am trying to exploit a program with a buffer overflow for a class. The program has a canary enabled and when you smash the stack it exits. When running the program in gdb you can set a breakpoint ...
- 21
2
votes
0
answers
459
views
Buffer overrun overwrittens dynamic function table
I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
- 41
1
vote
0
answers
215
views
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?
I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
- 111
1
vote
0
answers
712
views
How do I convert an adress to little endian such that I can feed it to my exploit?
I'm doing a small exploit exercise.
For this purpose, I have the following file:
#include <stdio.h>
void secretFunction() {
printf("Congratulations!\n");
printf("...
- 111
1
vote
0
answers
190
views
Trying to call the Exit Shellcode in a c program
#include<stdio.h>
#include<stdint.h>
char shellcode[] = "\xb8\x3c\x00\x00\x00"
"\xbf\x14\x00\x00\x00"
"\x0f\x05";
int ...
- 11
1
vote
0
answers
163
views
RopGadget buffer overflow
I have a question,
I have a device that i can perform on it buffer overflow.
The problem is that is that there is an ASLR(on all addresses in /proc/binary/maps, but not on the binary itself, but all ...
- 71
1
vote
0
answers
827
views
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:
#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>
char *decode(char *s){
...
- 143
1
vote
0
answers
235
views
Need help understanding basic buffer overflow
So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
- 11
1
vote
0
answers
215
views
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.
So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-...
- 11
1
vote
0
answers
345
views
Stack buffer overflow SIGSEGV help
I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV.
Here's the stdout of me stepping through the ...
- 153
1
vote
0
answers
32
views
Possible to execute cgi application locally and preserve the permissions?
This was part of a challenge which is now ended.
On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to ...
0
votes
0
answers
31
views
Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?
First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
0
votes
0
answers
697
views
Basic buffer-overflow on a remote program with Python/pwntools
I work on a online program in which I should do a buffer Overflow.
When I run the program, I have to complete a sum of two numbers generated randomly) :
>>> 451389913 + 1587598959 =
If I put ...
- 101
0
votes
0
answers
689
views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
0
votes
0
answers
330
views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
- 1
0
votes
0
answers
54
views
Performing Buffer overflow in Linux
I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system ...
0
votes
0
answers
125
views
Bufferoverflow Stack
I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function.
void ExploitMe()
{
char buffer[256];
gets(buffer);
}
I compile this file with
gcc test.c -...
- 49
0
votes
0
answers
172
views
Cannot rewrite the rip even after disabling all the security features
I was trying to exploit a simple buffer overflow on a self created binary.
i have disabled all the security features by compiling with the flags -
--fno-stack-protector -z execstack -no-pie.
my ...
- 1
0
votes
0
answers
68
views
What memory security settings are needed to allow a basic buffer overflow on Fedora 25?
I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
- 1,860