Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

1
vote
1answer
92 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
0
votes
0answers
44 views

Why /bin/sh getting permission denied after jumping to a function?

I have a simple buffer overflow code like this : #include <stdlib.h> #include <stdio.h> #include <string.h> char* exec_string = "/bin/sh"; void shell(char* cmd) { system(cmd); } ...
3
votes
1answer
134 views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
4
votes
1answer
83 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
0answers
31 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
1
vote
1answer
89 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
3
votes
1answer
76 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
4
votes
1answer
90 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
0
votes
1answer
126 views

Help in the process arm disassembly

I have an ARM disassembly as follow, I would be happy if you can help me to understand what it does: ldr R14 ,=0X1234 ldr r10 , [r14 , #0x555] mov.w r15, #0x6666 add.w r10,r15,r10,lsl#15 I think ...
0
votes
1answer
696 views

How to exploit an suid root application

I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
0
votes
0answers
343 views

Not enough space for shellcode 42 bytes

hello I am with an exercise of a holding and I have control of EIP and ESP with a CALL ESP now the problem is that I have 42 bytes to put a shell code, so far I could only add an egghunter but I do ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
0
votes
2answers
514 views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
3
votes
1answer
621 views

Why shell code only with nop slide working for me?

I'm trying to understand the exploit for SLMail 5.5. Here is the basic flow : I'm able to control EIP and point to an instruction "JMP ESP" ESP is pointing to the exact start position of my ...
0
votes
2answers
299 views

I have a question about SEH Overwrite

I am trying SEH Overwrite for vulnerable test programs. However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141. The picture is that the ...
1
vote
1answer
414 views

Why always get the message “Illegal Instruction (core dumped)”?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
3
votes
1answer
1k views

explain the vulnerable code used by EternalBlue SMB attack

The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows: unsigned int ...
1
vote
0answers
77 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
1
vote
1answer
91 views

Is it possible to restart over a program by calling an entry point function?

I was wondering if it was possible to restart a program (ignoring previously mapped files) with different argument by either calling main() or a glibc entry point function.
2
votes
1answer
541 views

SWF flash analysis

An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further ...
0
votes
1answer
123 views

Is stack migration a standard attack technique?

I am reading up a writeup on an example attack here where I have come across the technique called stack migration. The page is translated to English. Googling doesn't give me any fruitful pointer on ...
3
votes
1answer
444 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
3
votes
1answer
1k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
0
votes
0answers
706 views

How to understand/reverse ARM code?

I am trying to reverse engineer a certain code from a closed platform. I don't know much about the internals, so I don't know if I can start reversing it using tools like IDA. At the moment, I know: ...
0
votes
1answer
197 views

My nopsled getting Segmentation fault (core dumped)

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger. Then I check the ESP register : (gdb) i r esp esp ...
4
votes
1answer
466 views

How should I approach a basic CTF exploitation challenge?

Complete newbie alert so apologies on what you're about to read. I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to ...
4
votes
1answer
658 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
3
votes
1answer
3k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
0
votes
1answer
271 views

How to find vulnerabilities in stripped binaries?

Do you just use tools like strace and a debugger to disassemble and find syscalls and then read the disassembly to find say for example a buffer overflow? Is that all you can do? I mean after all you ...
2
votes
1answer
769 views

Immunity Debugger - !mona suggest

I have been going through some tutorials for exploit development that use the !pvefindaddr command to help with creating unique patterns and discovering the offset. I know that mona has replaced ...
3
votes
2answers
719 views

Finding a place to inject shellcode

I am following the tutorial for ROP Primer, level0. The tutorial sets the memory at the beginning of [vdso] writeable and executable and copies the shellcode there. I do not know why, but it seems ...
1
vote
1answer
522 views

VirtualProtect return value

VirtualProtect is straightforward but I get some results that I can't explain. Something's going on in the background probably but I'd like to know what. The following is under Windows 7 SP1 Ultimate ...
2
votes
1answer
295 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
0
votes
4answers
2k views

Not enough space for shellcode

I am working on an exploit for a ctf-challenge and could't find any hint about my problem. My steps so far: I could successfully overwrite EIP with an "jmp esp" address and jump to my shellcode. I ...
2
votes
1answer
643 views

Testing for bad characters in building an exploit doesn't seem to work as expected

I am trying to recreate the exploit linked here on Windows XP Professional SP2[x86]. I am building the exploit one step at a time. I have this snippet of code in Python3: f = open("crash.m3u", "wb") ...
-1
votes
1answer
425 views

Stack smashing in X86_64 leads to Segmentation fault .

I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally Here is the vulnerable program ...
8
votes
2answers
255 views

Lego NXT Exploitation and Vulnerabilities?

First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
5
votes
1answer
420 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
2answers
213 views

Why can't I get the EIP to reflect my input

I am going through a tutorial which shows you how to exploit a stack based buffer overflow in a sample C program. The C code is: #include <string.h> void function(char *str) { char buffer[...
1
vote
1answer
200 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
2
votes
0answers
308 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
0
votes
1answer
153 views

Reverse-engineering the generation of a hash?

Using a forward proxy, I have logged two payloads that are POST requests to a site, and I was curious as to what the best way to determine how a particular attribute in the payloads was generated. ...
3
votes
1answer
118 views

Exploitability of Stack-based Buffer Overflows on functions ending with fclose()

I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
4
votes
2answers
4k views

How does Windows SafeSEH mechanism work?

How does Windows SafeSEH mechanism work? I understand how the overwriting SEH exploitation technique works. I do not quite understand how the SafeSEH mechanism works preventing this technique from ...
1
vote
1answer
446 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
3
votes
1answer
1k views

Writing an exploit for sample-application

I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application: #include <stdio.h> #include &...
1
vote
1answer
764 views

One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary

I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm. However, I'm having trouble with the ...
1
vote
1answer
316 views

Execution failure of shellcode in stack without DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, ...
4
votes
1answer
2k views

Illegal Instruction on sample Buffer Overflow exploit

I have followed the example here. Here is my sample program, "oldskool.c": #include <string.h> void go(char *data) { char name[64]; strcpy(name, data); } int main (int argc, char **...
1
vote
1answer
116 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...