31 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
perror's user avatar
  • 19.1k
25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
knx's user avatar
  • 1,257
9 votes

Knowledge about CPU hardware

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more ...
perror's user avatar
  • 19.1k
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
0xec's user avatar
  • 6,090
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
Shane Reilly's user avatar
6 votes
Accepted

Why shell code only with nop slide working for me?

Let's look up what the "weird instruction" does: Saves the current FPU operating environment at the memory location specified with the destination operand, and then masks all floating-point ...
Igor Skochinsky's user avatar
  • 36.6k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
w s's user avatar
  • 8,488
4 votes
Accepted

Basic Buffer Overflow Help

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
Kerim Can Kalıpcıoğlu's user avatar
4 votes
Accepted

How to exploit an suid root application

If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function. Create a file ls which contains: #!/bin/sh /bin/sh Set it as an ...
perror's user avatar
  • 19.1k
4 votes
Accepted

Extract firmware images from COTS embedded devices

As this question is quite general, it'll be difficult to provide a very technical answer. You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

GDB: Could not load shared library symbols

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. ...
Chris Stratton's user avatar
3 votes
Accepted

Working Linux assembly XOR Encoder/Decoder Failing on Windows

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in ...
Paweł Łukasik's user avatar
3 votes
Accepted

Is stack migration a standard attack technique?

I don't know Chinese but It seems the post describes stack pivoting. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

Buffer overflow on server

We have two major stack protection for buffer overflows: Stack canaries Non-executable stack You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
Kerim Can Kalıpcıoğlu's user avatar
3 votes
Accepted

Why is otkloadr.WRAssembly.1 reference present in a office file?

Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. otkloadr.dll is a library used for Visual Studio / ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Immunity Debugger - !mona suggest

mona.py only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form. pvefindaddr already suggested a payload layout based on that ...
NirIzr's user avatar
  • 11.8k
3 votes

Testing for bad characters in building an exploit doesn't seem to work as expected

Already replied to you in the mailing list, But as this may help someone else, err = "\x90\x90\xEB\x04" # NOP NOP JMP 0x6 This JMP instruction is wrong. I suppose it's \xEB\x06. Also this is little ...
xboz's user avatar
  • 31
3 votes

Converting assembly code to c

There's also asm2c that works on assembly source code instead of executables or objects files. Tool to convert DOS Assembly code to C code Edit
franck's user avatar
  • 131
3 votes
Accepted

Defence against cracking

Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and ...
0xC0000022L's user avatar
  • 10.9k
3 votes

Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools

I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows: ret = p64(0x?????) payload = junk + ret + pop_rdi + sh_addr + ...
1chk0v's user avatar
  • 31
3 votes
Accepted

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

If you change your process startup to p = process(["strace", "-o", "strace.out", "./bof"]) and check the resulting strace.out file, you will see: close(0) ...
mephi42's user avatar
  • 156
3 votes
Accepted

Finding Ropper/ROPgadget offsets in Ghidra disassembly

ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output In Ghidra go to Window > Memory Map. ...
sudhackar's user avatar
  • 2,699
2 votes

Where to start with iOS debugging?

In iOS all sandboxing and security are handled by the AppleMobileFileIntegrity Kernel Extension As wat i know with Pod-Gizmo board you can pass the amfi_get_out_of_my_way boot-arg and with this arg ...
Karim H's user avatar
  • 136
2 votes

Not enough space for shellcode

Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter. You have to search for a ...
wehgrzhb63's user avatar
2 votes

Knowledge about CPU hardware

Modern microprocessors are quite complex, but probably can be represented in fewer lines of code than an OS plus libs, etc. (Although one would be coded in Verilog and the other in C.) Nonetheless, ...
Joseph Byrne's user avatar
2 votes

How should I approach a basic CTF exploitation challenge?

As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand. If the vulnerable ...
NirIzr's user avatar
  • 11.8k
2 votes

Working Linux assembly XOR Encoder/Decoder Failing on Windows

I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes
Accepted

Automatically find intput required to trigger a specific code path in a program

One common method of finding out the needed input to reach a specific execution flow (or a target instruction/function) is done using SMT solvers. SMT solvers are programs that accept a set of ...
NirIzr's user avatar
  • 11.8k
2 votes

My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?

well, you can’t execute non-executable pages, so you have the following options: use an executable memory area for your shellcode if available. somehow force the program to mark the memory with ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes
Accepted

Question regarding ASLR

When the process is created it is the job of the loader to parse the ELF and allocate/map memory segments, resolve and load libraries. The base offset for any shared object is decided by the loader at ...
sudhackar's user avatar
  • 2,699

Only top scored, non community-wiki answers of a minimum length are eligible