Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Exploit education stack-five: trouble getting the shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1
vote
2answers
58 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
2
votes
1answer
24 views

Format String Direct Parameter Behavior

I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output. From the decompilation, the program has a ...
0
votes
0answers
28 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
0answers
41 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
0
votes
0answers
10 views

How to give multiple inputs to IDA when using remote linux debugger every time the program is restarted?

So this is a problem I'm facing when solving pwn CTF challenges i usually need to give many inputs for a program to reach certain point every time i restart it i tried to do it like this, by putting ...
0
votes
0answers
38 views

fuzzing GDI/BITMAP kernel vulnerabilities

i was wondering about gdi/bitmap vulnerabilities in windows kernel(preferably windowds 10). i saw several exploits and papers regarding this subject, and while it all seem really interesting, i did ...
2
votes
1answer
67 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
3
votes
1answer
107 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
0
votes
0answers
30 views

Missing Heap prev Size

I am currently working on a challenge and I think I have to exploit it using the House of Einherjar. I can create chunks on the heap, I can free them and I can overflow them, so everything I would ...
0
votes
1answer
82 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
2
votes
1answer
142 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
2
votes
1answer
265 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
2answers
152 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
1
vote
0answers
3k views

Receiving “Got EOF while reading in interactive” after properly executing system(“/bin/sh”) using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
2
votes
0answers
210 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
2
votes
1answer
552 views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
0
votes
0answers
63 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
-3
votes
1answer
148 views

Defence against cracking [closed]

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
2
votes
1answer
2k views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
6
votes
1answer
254 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
1
vote
0answers
164 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
2
votes
1answer
755 views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
2
votes
1answer
544 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
1
vote
1answer
174 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
3
votes
1answer
1k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
4
votes
1answer
645 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
0answers
96 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
1
vote
1answer
193 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
3
votes
1answer
154 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
4
votes
1answer
104 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
0
votes
1answer
3k views

How to exploit an suid root application

I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
0
votes
2answers
881 views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
3
votes
1answer
1k views

Why shell code only with nop slide working for me?

I'm trying to understand the exploit for SLMail 5.5. Here is the basic flow : I'm able to control EIP and point to an instruction "JMP ESP" ESP is pointing to the exact start position of my ...
0
votes
2answers
594 views

I have a question about SEH Overwrite

I am trying SEH Overwrite for vulnerable test programs. However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141. The picture is that the ...
1
vote
1answer
710 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
3
votes
1answer
1k views

explain the vulnerable code used by EternalBlue SMB attack

The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows: unsigned int ...
1
vote
0answers
125 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
1
vote
1answer
98 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
2
votes
1answer
726 views

SWF flash analysis

An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further ...
0
votes
1answer
136 views

Is stack migration a standard attack technique?

I am reading up a writeup on an example attack here where I have come across the technique called stack migration. The page is translated to English. Googling doesn't give me any fruitful pointer on ...
2
votes
1answer
657 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
2
votes
1answer
2k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
0
votes
1answer
316 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
3
votes
1answer
646 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
4
votes
1answer
950 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
9
votes
1answer
16k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
0
votes
1answer
395 views

How to find vulnerabilities in stripped binaries?

Do you just use tools like strace and a debugger to disassemble and find syscalls and then read the disassembly to find say for example a buffer overflow? Is that all you can do? I mean after all you ...
2
votes
1answer
1k views

Immunity Debugger - !mona suggest

I have been going through some tutorials for exploit development that use the !pvefindaddr command to help with creating unique patterns and discovering the offset. I know that mona has replaced ...