Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

Filter by
Sorted by
Tagged with
2
votes
3answers
277 views

Bypassing ASLR without leak address

I have found a stack buffer overflow. Currently, this is the situation: NX/DEP disabled ASLR enabled Not a PIE I am able to override the return address and jump to PLT sections. My problem is that I ...
1
vote
1answer
43 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
3
votes
2answers
1k views

Finding a place to inject shellcode

I am following the tutorial for ROP Primer, level 0. The tutorial sets the memory at the beginning of [vdso] writeable and executable and copies the shellcode there. I do not know why, but it seems ...
4
votes
1answer
277 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
0
votes
1answer
357 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
0answers
27 views

Question About Buffer Overflow And NOP Sled

I am trying to learn buffer overflow but I have a question about one CTF. In "Buffer Overflows" CTF in Tryhackme, while creating the payload, I can use '0x7fffffffe388' or '0x7fffffffe398' ...
13
votes
1answer
26k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
12
votes
1answer
4k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
0
votes
0answers
26 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
-1
votes
1answer
54 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
44 views

Linux allocator and heap exploitation

I have some internal questions regarding linux allocator and heap exploitation: Is there a technique/techniques to discover the type of the memory allocator in linux(for example: dlmalloc/ptmalloc/...
2
votes
1answer
7k views

Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
0
votes
0answers
27 views

Thread keeps generating page fault

So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me. After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
40 views

Fuzzing Third Party Windows Drivers

I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
2
votes
1answer
2k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
1
vote
1answer
727 views

Buffer overflow on server

I have a server (for reference: pastebin.com/ghJX69uH) that I can netcat to and it will ask to input a message. I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to ...
0
votes
4answers
4k views

Not enough space for shellcode

I am working on an exploit for a ctf-challenge and could't find any hint about my problem. My steps so far: I could successfully overwrite EIP with an "jmp esp" address and jump to my shellcode. I ...
1
vote
1answer
304 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
2
votes
2answers
120 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
0
votes
0answers
30 views

I found an arbitrary free, (free(<abitrary address>)), managed to locate a candidate address I wish to free, how do I proceed from here?

While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon my first free() in my target. I managed to find a candiate location where I can control this value and ...
11
votes
4answers
143k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
1
vote
1answer
1k views

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools: #include <stdio.h> #include <stdlib.h> int main(void) { ...
0
votes
0answers
68 views

system doesn't invoke /bin/sh

I am learning libc shellcode attacks and trying to execute /bin/sh from system I can execute other commands from system like whoami and ls -a but can not run /bin/sh the following works string = b&...
1
vote
0answers
35 views

xIP vs xSP vs xBP: How to choose the target?

We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
2
votes
1answer
2k views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
2
votes
1answer
125 views

Format String Direct Parameter Behavior

I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output. From the decompilation, the program has a ...
0
votes
0answers
195 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
0
votes
0answers
178 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
3
votes
1answer
277 views

What is the problem with using inner classes in a class enclosing sensitive information?

I recently heard that using Java inner classes in a class that enclose sensitive information is causing the private data of the class to be changed to protected at the bytecode level (meaning that any ...
2
votes
1answer
78 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
2
votes
1answer
408 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
0
votes
1answer
284 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
2
votes
1answer
310 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
2answers
249 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
3
votes
0answers
309 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
2
votes
1answer
1k views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
0
votes
0answers
93 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
-3
votes
1answer
157 views

Defence against cracking [closed]

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
6
votes
1answer
379 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
2
votes
1answer
3k views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
1
vote
0answers
197 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
2
votes
1answer
1k views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
2
votes
1answer
734 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
1
vote
1answer
240 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
3
votes
1answer
1k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
4
votes
1answer
859 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
1
vote
1answer
225 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
1
vote
0answers
151 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
4
votes
1answer
109 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
3
votes
1answer
209 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...