Skip to main content

Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

Filter by
Sorted by
Tagged with
1 vote
0 answers
40 views

Potential vulnerabilities in a binary run as root

I am given a vulnerable 64-bit stripped application, it conducts basic password strength checks on linux(/etc/shadow). The application receives workers(which creates worker process for performing the ...
emotional_piper's user avatar
1 vote
0 answers
84 views

How do you get into Vulnerability Research as a career?

How do you break into Vulnerability Research (with focus on mobile security). I noticed that all vulnerability research positions expect you to already have the knowledge and career experience, other ...
0xFFFFFFF0's user avatar
1 vote
1 answer
196 views

ARM64 Stack Layout - Why 100x'A' Doesn't Crash?

I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog. When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
alond22's user avatar
  • 113
0 votes
0 answers
138 views

i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain

I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
New2wheels-Pray4Me's user avatar
1 vote
0 answers
56 views

What factors affect the base address of a shared object?

I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
Matthew Tingum's user avatar
2 votes
0 answers
210 views

Overwriting the Global Offset Table + format string vulnerability

I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get: objdump -R ./fmt ...
LianoQ's user avatar
  • 31
1 vote
0 answers
108 views

Binary Exploitation

I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C. I've found some references on "Hacking - the art of ...
LianoQ's user avatar
  • 31
3 votes
0 answers
139 views

format-string + ret2libc (or format string only)?

I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
98m16's user avatar
  • 31
2 votes
0 answers
47 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
3 votes
0 answers
60 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
1 vote
0 answers
139 views

Reversing Assembly Code (ASM) to Extract Password (Pin)

I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
Анатолий Городничий's user avatar
3 votes
1 answer
826 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
RosterPantyhose's user avatar
3 votes
1 answer
648 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
one1one's user avatar
  • 31
0 votes
0 answers
44 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
Jhon's user avatar
  • 9
-1 votes
1 answer
136 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
Jhon's user avatar
  • 9
3 votes
1 answer
1k views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
BegiNO's user avatar
  • 56
2 votes
3 answers
1k views

Bypassing ASLR without leak address

I have found a stack buffer overflow. Currently, this is the situation: NX/DEP disabled ASLR enabled Not a PIE I am able to override the return address and jump to PLT sections. My problem is that I ...
alpico's user avatar
  • 21
1 vote
1 answer
1k views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
joshu's user avatar
  • 113
0 votes
0 answers
125 views

I found an arbitrary free, (free(<abitrary address>)), managed to locate a candidate address I wish to free, how do I proceed from here?

While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon my first free() in my target. I managed to find a candiate location where I can control this value and ...
user34866's user avatar
1 vote
1 answer
5k views

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools: #include <stdio.h> #include <stdlib.h> int main(void) { ...
TigerThePredator's user avatar
0 votes
0 answers
84 views

system doesn't invoke /bin/sh

I am learning libc shellcode attacks and trying to execute /bin/sh from system I can execute other commands from system like whoami and ls -a but can not run /bin/sh the following works string = b&...
Devharsh Trivedi's user avatar
1 vote
0 answers
52 views

xIP vs xSP vs xBP: How to choose the target?

We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
ChocolateOverflow's user avatar
3 votes
1 answer
6k views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
adg's user avatar
  • 41
2 votes
2 answers
284 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
Polly's user avatar
  • 161
2 votes
1 answer
355 views

Format String Direct Parameter Behavior

I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output. From the decompilation, the program has a ...
multithr3at3d's user avatar
2 votes
0 answers
407 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
user32914's user avatar
0 votes
0 answers
334 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
aguilbau's user avatar
2 votes
1 answer
91 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
solumnant's user avatar
  • 173
6 votes
1 answer
408 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
Thành Vũ's user avatar
0 votes
1 answer
723 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
Matthew Darens's user avatar
2 votes
1 answer
801 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
Ihab's user avatar
  • 131
2 votes
1 answer
358 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
lllllllllllll's user avatar
0 votes
2 answers
308 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
coder's user avatar
  • 103
3 votes
1 answer
15k views

Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
Shuzheng's user avatar
  • 295
3 votes
1 answer
686 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
Redouane Red's user avatar
2 votes
1 answer
2k views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
GelosSnake's user avatar
0 votes
0 answers
175 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
3xpl017's user avatar
-3 votes
1 answer
171 views

Defence against cracking [closed]

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
bart1e's user avatar
  • 3,409
2 votes
1 answer
5k views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
Lord Vapor's user avatar
6 votes
1 answer
492 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
Jaewon Min's user avatar
1 vote
0 answers
236 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
Omar Elgafri's user avatar
2 votes
1 answer
1k views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
Just's user avatar
  • 21
2 votes
1 answer
1k views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
78dtat78da's user avatar
1 vote
1 answer
310 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
Neon Flash's user avatar
3 votes
1 answer
2k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
lllllllllllll's user avatar
4 votes
1 answer
1k views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
Solidak's user avatar
  • 143
1 vote
0 answers
212 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
Andrea Fioraldi's user avatar
1 vote
1 answer
296 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
sif's user avatar
  • 23
3 votes
1 answer
292 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
Kodoque's user avatar
  • 33
4 votes
1 answer
121 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
stacklikemind's user avatar