31
votes
Accepted
Managing inputs for payload injection?
Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
- 19.2k
25
votes
Knowledge about CPU hardware
To extend the answer of perror:
Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
- 1,257
9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 6,110
9
votes
Knowledge about CPU hardware
In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time.
Therefore, it is much more ...
- 19.2k
7
votes
What do these 2 Ghidra warnings mean?
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but ...
- 386
6
votes
Accepted
Why shell code only with nop slide working for me?
Let's look up what the "weird instruction" does:
Saves the current FPU operating environment at the memory location
specified with the destination operand, and then masks all
floating-point ...
- 36.9k
5
votes
Accepted
How to find the stack and other info in a memory dump? ARM
The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
- 8,538
4
votes
Accepted
Basic Buffer Overflow Help
You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
4
votes
Accepted
How to exploit an suid root application
If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function.
Create a file ls which contains:
#!/bin/sh
/bin/sh
Set it as an ...
- 19.2k
4
votes
Accepted
Extract firmware images from COTS embedded devices
As this question is quite general, it'll be difficult to provide a very technical answer.
You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
- 11.8k
4
votes
Accepted
GDB: Could not load shared library symbols
Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.
...
- 245
3
votes
Accepted
Is stack migration a standard attack technique?
I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
- 36.9k
3
votes
Accepted
Buffer overflow on server
We have two major stack protection for buffer overflows:
Stack canaries
Non-executable stack
You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
3
votes
Accepted
Working Linux assembly XOR Encoder/Decoder Failing on Windows
There are few issues with your code.
1st is what Igor mentioned - .text section is RO. This was solved in this answer.
The 2nd is that you did not copy correctly the bytes or lost some of them in ...
- 4,952
3
votes
Converting assembly code to c
There's also asm2c that works on assembly source code instead of executables or objects files.
Tool to convert DOS Assembly code to C code Edit
- 131
3
votes
Accepted
Immunity Debugger - !mona suggest
mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form.
pvefindaddr already suggested a payload layout based on that ...
- 11.8k
3
votes
Accepted
Defence against cracking
Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
- 10.9k
3
votes
Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools
I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows:
ret = p64(0x?????)
payload = junk + ret + pop_rdi + sh_addr + ...
- 31
3
votes
Accepted
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) ...
- 156
3
votes
Accepted
Finding Ropper/ROPgadget offsets in Ghidra disassembly
ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output
In Ghidra go to Window > Memory Map.
...
- 2,739
2
votes
Not enough space for shellcode
Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter.
You have to search for a ...
- 21
2
votes
How should I approach a basic CTF exploitation challenge?
As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand.
If the vulnerable ...
- 11.8k
2
votes
Working Linux assembly XOR Encoder/Decoder Failing on Windows
I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
- 36.9k
2
votes
Accepted
Automatically find intput required to trigger a specific code path in a program
One common method of finding out the needed input to reach a specific execution flow (or a target instruction/function) is done using SMT solvers.
SMT solvers are programs that accept a set of ...
- 11.8k
2
votes
Knowledge about CPU hardware
Modern microprocessors are quite complex, but probably can be represented in fewer lines of code than an OS plus libs, etc. (Although one would be coded in Verilog and the other in C.) Nonetheless, ...
- 29
2
votes
My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?
well, you can’t execute non-executable pages, so you have the following options:
use an executable memory area for your shellcode if available.
somehow force the program to mark the memory with ...
- 36.9k
2
votes
Accepted
Question regarding ASLR
When the process is created it is the job of the loader to parse the ELF and allocate/map memory segments, resolve and load libraries. The base offset for any shared object is decided by the loader at ...
- 2,739
2
votes
How to reverse engineer a Black Box?
First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?
IDA directly handles raw image, ...
- 1,179
2
votes
Why stack canary can be brute-force one byte at a time?
A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes.
The problem with a fork() is that is uses a copy of the memory to start over. Of course, ...
- 19.2k
2
votes
Accepted
Explanation of heap shaping technique and how it is different from heap spraying
Heap shaping (also called heap grooming, for a more passive approach) is the slightly more intelligent sibling of heap spraying while developing exploits. Therefore, to properly explain heap shaping ...
- 11.8k
Only top scored, non community-wiki answers of a minimum length are eligible