31
votes
Accepted
Managing inputs for payload injection?
Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
- 18.9k
25
votes
Knowledge about CPU hardware
To extend the answer of perror:
Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
- 1,257
9
votes
Knowledge about CPU hardware
In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time.
Therefore, it is much more ...
- 18.9k
9
votes
Accepted
Heap Chunk Structure Does Not Contain Previous Section Info
The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free.
This image is more appropriate of what an allocated heap ...
- 6,040
7
votes
What do these 2 Ghidra warnings mean?
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but ...
- 386
6
votes
Accepted
Why shell code only with nop slide working for me?
Let's look up what the "weird instruction" does:
Saves the current FPU operating environment at the memory location
specified with the destination operand, and then masks all
floating-point ...
- 36.4k
5
votes
Accepted
How to find the stack and other info in a memory dump? ARM
The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
- 8,388
5
votes
Accepted
Writing an exploit for sample-application
Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think....
It's because you're overwriting the return address on the stack ...
- 20.7k
5
votes
How does Windows SafeSEH mechanism work?
Regarding your original question: Upon ntdll.dll loading each PE image, the list of exception handler addresses in the PE image is parsed and each address is inserted into a sorted list that ntdll.dll ...
- 51
4
votes
How does Windows SafeSEH mechanism work?
I post my own answer based on my own research. I am not sure about correctness of the parts in bold. Comments correcting my answer or fuller and better answers are welcome. I will edit out the ...
- 211
4
votes
Accepted
Basic Buffer Overflow Help
You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
4
votes
Accepted
How to exploit an suid root application
If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function.
Create a file ls which contains:
#!/bin/sh
/bin/sh
Set it as an ...
- 18.9k
4
votes
Accepted
Extract firmware images from COTS embedded devices
As this question is quite general, it'll be difficult to provide a very technical answer.
You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
- 11.7k
4
votes
Accepted
GDB: Could not load shared library symbols
Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.
...
- 245
3
votes
Accepted
Is stack migration a standard attack technique?
I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
- 36.4k
3
votes
Accepted
Buffer overflow on server
We have two major stack protection for buffer overflows:
Stack canaries
Non-executable stack
You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
3
votes
Accepted
Why is otkloadr.WRAssembly.1 reference present in a office file?
Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion.
otkloadr.dll is a library used for Visual Studio / ...
- 11.7k
3
votes
Testing for bad characters in building an exploit doesn't seem to work as expected
Already replied to you in the mailing list, But as this may help someone else,
err = "\x90\x90\xEB\x04" # NOP NOP JMP 0x6
This JMP instruction is wrong. I suppose it's \xEB\x06. Also this is little ...
- 31
3
votes
Accepted
Immunity Debugger - !mona suggest
mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form.
pvefindaddr already suggested a payload layout based on that ...
- 11.7k
3
votes
Fuzzing Adobe Reader - Exploit Development
There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
- 4,470
3
votes
Converting assembly code to c
There's also asm2c that works on assembly source code instead of executables or objects files.
Tool to convert DOS Assembly code to C code Edit
- 131
3
votes
Accepted
Working Linux assembly XOR Encoder/Decoder Failing on Windows
There are few issues with your code.
1st is what Igor mentioned - .text section is RO. This was solved in this answer.
The 2nd is that you did not copy correctly the bytes or lost some of them in ...
- 4,912
3
votes
Accepted
Defence against cracking
Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
- 10.9k
3
votes
Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools
I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows:
ret = p64(0x?????)
payload = junk + ret + pop_rdi + sh_addr + ...
- 31
3
votes
Accepted
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) ...
- 156
3
votes
Accepted
Finding Ropper/ROPgadget offsets in Ghidra disassembly
ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output
In Ghidra go to Window > Memory Map.
...
- 2,629
2
votes
Where to start with iOS debugging?
In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension
As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
- 136
2
votes
Not enough space for shellcode
Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter.
You have to search for a ...
- 21
2
votes
How should I approach a basic CTF exploitation challenge?
As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand.
If the vulnerable ...
- 11.7k
2
votes
Working Linux assembly XOR Encoder/Decoder Failing on Windows
I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible