Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory

I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from https://blog.lamarranet.com/index.php/exploit-education-...
user avatar
0 votes
0 answers
126 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
0 votes
0 answers
86 views

Put pwntools in DEBUG mode when using library

When using pwntools as a library (that is, not importing everything as an exploit kit, just individual libraries), how can I turn on debug mode, so that tubes print to the screen everything they read ...
user avatar
0 votes
0 answers
61 views

Question About Buffer Overflow And NOP Sled

I am trying to learn buffer overflow but I have a question about one CTF. In "Buffer Overflows" CTF in Tryhackme, while creating the payload, I can use '0x7fffffffe388' or '0x7fffffffe398' ...
user avatar
  • 1
1 vote
1 answer
83 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
user avatar
  • 11
0 votes
0 answers
29 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
user avatar
  • 9
-1 votes
1 answer
63 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
user avatar
  • 9
0 votes
1 answer
587 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
user avatar
  • 26
2 votes
3 answers
424 views

Bypassing ASLR without leak address

I have found a stack buffer overflow. Currently, this is the situation: NX/DEP disabled ASLR enabled Not a PIE I am able to override the return address and jump to PLT sections. My problem is that I ...
user avatar
  • 21
1 vote
1 answer
478 views

Finding Ropper/ROPgadget offsets in Ghidra disassembly

How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset 0x0002ae74 in libuClibc.0.9.3.so ...
user avatar
  • 113
0 votes
0 answers
39 views

I found an arbitrary free, (free(<abitrary address>)), managed to locate a candidate address I wish to free, how do I proceed from here?

While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon my first free() in my target. I managed to find a candiate location where I can control this value and ...
user avatar
1 vote
1 answer
2k views

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools: #include <stdio.h> #include <stdlib.h> int main(void) { ...
user avatar
0 votes
0 answers
70 views

system doesn't invoke /bin/sh

I am learning libc shellcode attacks and trying to execute /bin/sh from system I can execute other commands from system like whoami and ls -a but can not run /bin/sh the following works string = b&...
user avatar
1 vote
0 answers
40 views

xIP vs xSP vs xBP: How to choose the target?

We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ...
user avatar
2 votes
1 answer
3k views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
user avatar
  • 31
2 votes
2 answers
148 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
user avatar
  • 151
2 votes
1 answer
187 views

Format String Direct Parameter Behavior

I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output. From the decompilation, the program has a ...
user avatar
0 votes
0 answers
250 views

Shellcode execution segfault

I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But ...
user avatar
0 votes
0 answers
233 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
user avatar
2 votes
1 answer
85 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
user avatar
  • 153
5 votes
1 answer
323 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
user avatar
0 votes
1 answer
405 views

Abusing the strlen output

My question is related to the strlen function from the C and C++. I am reversing a program, that reads a byte data from allocated memory and sends to the strlen directly. To be completely honest ...
user avatar
2 votes
1 answer
485 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
user avatar
  • 131
2 votes
1 answer
320 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
user avatar
0 votes
2 answers
273 views

Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS

I am studying from "Hacking: The Art of Exploitation" and in program fmt_vuln.c format string is exploited. I am getting Segmentation Fault error. Checking position of AAAA on stack: $ ./fmt_vuln ...
user avatar
  • 103
2 votes
1 answer
9k views

Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools

I've followed some tutorials on writing a pwntools-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. Got EOF while ...
user avatar
  • 265
3 votes
0 answers
347 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
user avatar
2 votes
1 answer
1k views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
user avatar
0 votes
0 answers
109 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
user avatar
-3 votes
1 answer
160 views

Defence against cracking [closed]

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
user avatar
  • 3,189
2 votes
1 answer
3k views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
user avatar
6 votes
1 answer
400 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
user avatar
1 vote
0 answers
207 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
user avatar
2 votes
1 answer
1k views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
user avatar
  • 21
2 votes
1 answer
794 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
user avatar
1 vote
1 answer
260 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
user avatar
3 votes
1 answer
2k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
user avatar
4 votes
1 answer
941 views

Heap Chunk Structure Does Not Contain Previous Section Info

I'm reading Shellcoder's Handbook to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains ...
user avatar
  • 143
1 vote
0 answers
167 views

Challenges to learn jemalloc exploitation on FreeBSD [closed]

I'm studying this phrack article: http://www.phrack.org/issues/68/10.html Very interesting but the only valid way to be confident with an exploitation technique is an hands-on. I'm searching for ...
user avatar
1 vote
1 answer
247 views

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not ...
user avatar
  • 23
3 votes
1 answer
225 views

Shellcode issue

I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified: As you can see on the radare2 output, my ...
user avatar
  • 31
4 votes
1 answer
112 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
user avatar
1 vote
1 answer
4k views

How to exploit an suid root application

I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the ls -al command for a ...
user avatar
22 votes
4 answers
4k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
user avatar
0 votes
2 answers
1k views

Working Linux assembly XOR Encoder/Decoder Failing on Windows

Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect ...
user avatar
3 votes
1 answer
2k views

Why shell code only with nop slide working for me?

I'm trying to understand the exploit for SLMail 5.5. Here is the basic flow : I'm able to control EIP and point to an instruction "JMP ESP" ESP is pointing to the exact start position of my ...
user avatar
  • 133
0 votes
2 answers
713 views

I have a question about SEH Overwrite

I am trying SEH Overwrite for vulnerable test programs. However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141. The picture is that the ...
user avatar
1 vote
1 answer
1k views

Why always get the message "Illegal Instruction (core dumped)"?

I tried to exploiting buffer overflow. In the exploit code I use the Aleph-One shellcode. "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\...
user avatar
3 votes
1 answer
2k views

explain the vulnerable code used by EternalBlue SMB attack

The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows: unsigned int ...
user avatar
  • 131
1 vote
0 answers
134 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
user avatar
  • 11