Hot answers tagged

29 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
perror's user avatar
  • 18.7k
25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
knx's user avatar
  • 1,257
9 votes

Knowledge about CPU hardware

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more ...
perror's user avatar
  • 18.7k
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
0xec's user avatar
  • 5,990
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
Shane Reilly's user avatar
6 votes
Accepted

Why shell code only with nop slide working for me?

Let's look up what the "weird instruction" does: Saves the current FPU operating environment at the memory location specified with the destination operand, and then masks all floating-point ...
Igor Skochinsky's user avatar
  • 35.9k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
w s's user avatar
  • 8,225
5 votes
Accepted

Writing an exploit for sample-application

Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think.... It's because you're overwriting the return address on the stack ...
Jason Geffner's user avatar
5 votes

How does Windows SafeSEH mechanism work?

Regarding your original question: Upon ntdll.dll loading each PE image, the list of exception handler addresses in the PE image is parsed and each address is inserted into a sorted list that ntdll.dll ...
vulture's user avatar
  • 51
4 votes

How does Windows SafeSEH mechanism work?

I post my own answer based on my own research. I am not sure about correctness of the parts in bold. Comments correcting my answer or fuller and better answers are welcome. I will edit out the ...
golem's user avatar
  • 211
4 votes
Accepted

Basic Buffer Overflow Help

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
Kerim Can Kalıpcıoğlu's user avatar
4 votes
Accepted

How to exploit an suid root application

If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function. Create a file ls which contains: #!/bin/sh /bin/sh Set it as an ...
perror's user avatar
  • 18.7k
4 votes
Accepted

Extract firmware images from COTS embedded devices

As this question is quite general, it'll be difficult to provide a very technical answer. You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
NirIzr's user avatar
  • 11.7k
4 votes
Accepted

GDB: Could not load shared library symbols

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. ...
Chris Stratton's user avatar
3 votes
Accepted

Immunity Debugger - !mona suggest

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that ...
NirIzr's user avatar
  • 11.7k
3 votes
Accepted

Is stack migration a standard attack technique?

I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
Igor Skochinsky's user avatar
  • 35.9k
3 votes
Accepted

Buffer overflow on server

We have two major stack protection for buffer overflows: Stack canaries Non-executable stack You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
Kerim Can Kalıpcıoğlu's user avatar
3 votes

Fuzzing Adobe Reader - Exploit Development

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
joxeankoret's user avatar
  • 4,415
3 votes

Converting assembly code to c

There's also asm2c that works on assembly source code instead of executables or objects files. Tool to convert DOS Assembly code to C code Edit
franck's user avatar
  • 131
3 votes

Testing for bad characters in building an exploit doesn't seem to work as expected

Already replied to you in the mailing list, But as this may help someone else, err = "\x90\x90\xEB\x04" # NOP NOP JMP 0x6 This JMP instruction is wrong. I suppose it's \xEB\x06. Also this is little ...
xboz's user avatar
  • 31
3 votes
Accepted

Why is otkloadr.WRAssembly.1 reference present in a office file?

Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. otkloadr.dll is a library used for Visual Studio / ...
NirIzr's user avatar
  • 11.7k
3 votes
Accepted

Working Linux assembly XOR Encoder/Decoder Failing on Windows

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in ...
Paweł Łukasik's user avatar
3 votes
Accepted

Defence against cracking

Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
0xC0000022L's user avatar
  • 10.8k
3 votes

Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools

I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows: ret = p64(0x?????) payload = junk + ret + pop_rdi + sh_addr + ...
1chk0v's user avatar
  • 31
3 votes
Accepted

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

If you change your process startup to p = process(["strace", "-o", "strace.out", "./bof"]) and check the resulting strace.out file, you will see: close(0) ...
mephi42's user avatar
  • 156
3 votes
Accepted

Finding Ropper/ROPgadget offsets in Ghidra disassembly

ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output In Ghidra go to Window > Memory Map. ...
sudhackar's user avatar
  • 2,464
2 votes

Where to start with iOS debugging?

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
Karim H's user avatar
  • 136
2 votes

Not enough space for shellcode

Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter. You have to search for a ...
wehgrzhb63's user avatar
2 votes

How should I approach a basic CTF exploitation challenge?

As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand. If the vulnerable ...
NirIzr's user avatar
  • 11.7k
2 votes
Accepted

Chrome Vulnerability Issue

Chrome != Chromium. Google makes several changes to the Chromium code base before building Chrome. This may be one of the changes. Nonetheless, the snapshot for the 41.0.2272.89 version of Chromium ...
Jason Geffner's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible