Questions tagged [exploit]
Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.
123
questions
0
votes
0
answers
59
views
ARM64 Stack Layout - Why 100x'A' Doesn't Crash?
I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog.
When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
- 101
0
votes
0
answers
97
views
i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain
I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
1
vote
0
answers
39
views
What factors affect the base address of a shared object?
I'm looking at a CVE for an old thrift shop router that amounts to a stack based buffer overflow with no NULL characters allowed. I can control the instruction pointer register as well as a few less ...
- 105
2
votes
0
answers
163
views
Overwriting the Global Offset Table + format string vulnerability
I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get:
objdump -R ./fmt ...
- 31
1
vote
0
answers
93
views
Binary Exploitation
I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C.
I've found some references on "Hacking - the art of ...
- 31
3
votes
0
answers
100
views
format-string + ret2libc (or format string only)?
I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
- 31
2
votes
0
answers
32
views
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
- 21
3
votes
0
answers
53
views
plugin/script for radare2 similar to mona for immunity debugger
I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
- 31
1
vote
0
answers
121
views
Reversing Assembly Code (ASM) to Extract Password (Pin)
I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file ...
3
votes
1
answer
667
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
3
votes
1
answer
407
views
What is data only exploitation?
I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
- 31
0
votes
0
answers
42
views
There is a course in which they teach you to use WinAFL?
I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
- 9
-1
votes
1
answer
116
views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
- 9
3
votes
1
answer
1k
views
Advanced Binary Exploitation CTF
I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
- 56
2
votes
3
answers
1k
views
Bypassing ASLR without leak address
I have found a stack buffer overflow.
Currently, this is the situation:
NX/DEP disabled
ASLR enabled
Not a PIE
I am able to override the return address and jump to PLT sections.
My problem is that I ...
- 21
1
vote
1
answer
952
views
Finding Ropper/ROPgadget offsets in Ghidra disassembly
How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
- 113
0
votes
0
answers
81
views
I found an arbitrary free, (free(<abitrary address>)), managed to locate a candidate address I wish to free, how do I proceed from here?
While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon
my first free() in my target.
I managed to find a candiate location where I can control this value and ...
1
vote
1
answer
4k
views
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools:
#include <stdio.h>
#include <stdlib.h>
int main(void) {
...
0
votes
0
answers
83
views
system doesn't invoke /bin/sh
I am learning libc shellcode attacks and trying to execute /bin/sh from system
I can execute other commands from system like whoami and ls -a but can not run /bin/sh
the following works
string = b&...
- 109
1
vote
0
answers
46
views
xIP vs xSP vs xBP: How to choose the target?
We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
3
votes
1
answer
5k
views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
- 41
2
votes
2
answers
242
views
Newbie problems exploiting a format string vulnerability
I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
- 161
2
votes
1
answer
313
views
Format String Direct Parameter Behavior
I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output.
From the decompilation, the program has a ...
- 609
2
votes
0
answers
374
views
Shellcode execution segfault
I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
- 21
0
votes
0
answers
310
views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
- 1
2
votes
1
answer
88
views
How to “unprotect” malicious workbook without knowing password
Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
- 173
6
votes
1
answer
391
views
The buffer is too short to insert addresses when exploiting buffer overflow
Newbie here. Sorry for what you about to read .
I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary:
Its checksec information using pwntools:
...
- 63
0
votes
1
answer
651
views
Abusing the strlen output
My question is related to the strlen function from the C and C++.
I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
2
votes
1
answer
721
views
Get NonPagedPool (NPP) Base Address on any Windows OS
Is there a way to get the the base(start) address of the NonPagedPool in Windows ?
I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
- 131
2
votes
1
answer
349
views
Decompiler attack
I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.:
So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
- 2,475
0
votes
2
answers
303
views
Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS
I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error.
Checking position of AAAA on stack:
$ ./fmt_vuln ...
- 103
3
votes
1
answer
14k
views
Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools
I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
- 295
3
votes
0
answers
510
views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
- 151
2
votes
1
answer
2k
views
Explanation of heap shaping technique and how it is different from heap spraying
Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique.
Can anyone please explain in details what is actually involved in using this tactic.
Thanks
- 712
0
votes
0
answers
158
views
Cannot rewrite the rip even after disabling all the security features
I was trying to exploit a simple buffer overflow on a self created binary.
i have disabled all the security features by compiling with the flags -
--fno-stack-protector -z execstack -no-pie.
my ...
- 1
-3
votes
1
answer
168
views
Defence against cracking [closed]
Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
- 3,369
2
votes
1
answer
4k
views
GDB: Could not load shared library symbols
I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here:
https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
- 23
6
votes
1
answer
472
views
Returning to usermode shellcode from windows kernel (Win10)
I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland.
The ...
- 329
1
vote
0
answers
229
views
Need help understanding basic buffer overflow
So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
- 11
2
votes
1
answer
1k
views
Why stack canary can be brute-force one byte at a time?
I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
- 21
2
votes
1
answer
1k
views
How to reverse engineer a Black Box?
I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already ...
- 154
1
vote
1
answer
298
views
Question regarding ASLR
If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time?
Or the address will ...
- 765
3
votes
1
answer
2k
views
Extract firmware images from COTS embedded devices
I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points.
Is it in general possible to ...
- 2,475
4
votes
1
answer
1k
views
Heap Chunk Structure Does Not Contain Previous Section Info
I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
- 143
1
vote
0
answers
199
views
Challenges to learn jemalloc exploitation on FreeBSD [closed]
I'm studying this phrack article: http://www.phrack.org/issues/68/10.html
Very interesting but the only valid way to be confident with an exploitation technique is an hands-on.
I'm searching for ...
1
vote
1
answer
287
views
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
- 23
3
votes
1
answer
275
views
Shellcode issue
I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified:
As you can see on the radare2 output, my ...
- 33
4
votes
1
answer
121
views
Automatically find intput required to trigger a specific code path in a program
Assuming I have the following scenario:
I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
- 143
1
vote
1
answer
4k
views
How to exploit an suid root application
I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
- 13
23
votes
4
answers
4k
views
Knowledge about CPU hardware
Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc...
Up until now I have been treating the CPU as a black box that runs assembly ...
- 331