A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

2
votes
2answers
64 views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
0
votes
1answer
40 views

Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?

when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...
-1
votes
0answers
18 views

Does trying to realize a exploit buffer overflow t is good choice for my first exploit [closed]

I have 2 years experience with C and bases notion in ASM. I'm not yet on root-me but does trying to realize an exploit of buffer overflow is a good choice for my first exploit ? Thanks
0
votes
0answers
39 views

Shellcode problem for a remote service (Encoding)

I have an excercise to exploit a remote service after a short dialog with it using stack buffer overflow. I've downloaded a binary on my local Ubuntu 14.04 and tested it with gdb. What I do is ...
1
vote
1answer
43 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
1
vote
1answer
59 views

Why do browsers not protect against scripts coming with images?

I understand that this is how it goes: Malformed Image --> Buffer Overrun --> Stack Over Flow --> Execute Malware Pushed On Stack And though I don't a huge amount about this, I know that I ...
5
votes
1answer
91 views

After a bufferoverflow does an attacker only have access to calls which are present in the library where the C code was compiled?

Or are there techniques to just get a shell? What I am interested in is if I have compiled some C code using only a small library with insignificant possible calls, does this restrict the attacker ...
2
votes
1answer
79 views

How can I find the size of an array just from compiled C program?

I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, ...
1
vote
1answer
95 views

s this an exploit attempt and where can I analyse it?

Edited: Never mind the MinGW or .bash_history, I can see that is unlikely. Somebody attacking me and those bytes ending up in the frequently used file .bash_history by accident is not that unlikely ...
0
votes
0answers
58 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
4
votes
1answer
152 views

Unable to overwrite EIP register

Source code for both programs at the end of the post So, I've working through Hacking: The Art Of Exploitation, and so far so good. I've managed to control EIP in the vulnerable program notesearch.c. ...
-1
votes
3answers
62 views

What is the future of exploitations? [closed]

With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to ...
4
votes
1answer
124 views

What kind of bugs can be found by dumb fuzzing a desktop app?

I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What ...
3
votes
2answers
97 views

Exploit a buffer overflow without SIGSEGV

For my studies I try to create a payload so that it overflows the buffer and calls a "secret" function called "target" This is the code I use for testing on an i686 #include "stdio.h" #include "...
2
votes
3answers
324 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
4
votes
1answer
95 views

What is an example of arithmetic and buffer overflows in a php application?

I'm trying to find evidence whether it is possible to have overflows in a php application, whether buffer overflows or arithmetic overflows. I believe it's possible to have these overflows in the ...
0
votes
0answers
82 views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
1
vote
1answer
83 views

Are stack overflows using memcpy possible with modern compilers?

These days memcpy is protected by an interface named _memcpy_chk, which checks the size of the destination buffer at runtime. After reading the source code for _memcpy_chk at http://www.opensource....
3
votes
0answers
46 views

Bypass Stack Canary by going past the return address

I was testing a simple C program with stack canary protection. I attempted to bypass the protection by overwriting past the function's return address and overwriting main's address. I am overwriting ...
4
votes
2answers
92 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
0
votes
0answers
51 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
3
votes
0answers
89 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
2
votes
1answer
118 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
2
votes
2answers
110 views

why can't i overwrite stack frame

I'm currently reading Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition and I have a question with an exercise in the book. The lab "Lab 10 - 1 Overflow of meet.c" is a lab in which we ...
124
votes
7answers
18k views

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

When I look at the exploits from the past few years related to implementations, I see that quite a lot of them are from C or C++, and a lot of them are overflow attacks. Heartbleed was a buffer ...
3
votes
1answer
133 views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
8
votes
1answer
231 views

Using cat to overcome 'Stack smash detected'

I'm trying now buffer overflow exercise from the site pwnable.kr I found the string that should be entered to the gets frunction but got "Stack Smash Detected" then I found a solution in rickgray.me ...
0
votes
0answers
82 views

Put shellcode in writable sections -> .bss & .data

so, I have following issue. Let's say, I have a simple vulnerable program, such as this one: #include <stdio.h> #include <string.h> #include <stdlib.h> void vuln_function(char *); ...
4
votes
3answers
130 views

Strange address change during Buffer Overflow

I was testing out a buffer overflow and the following strange thing happened: The return address is at 0xbffff7bc which I discovered from testing. I replaced it with the value I wanted 0xbffff636. ...
4
votes
1answer
78 views

Will Intel's MPX extension make C/C++ completely safe to use?

This is apparently an extension that will eliminate buffer overflow and format string vulnerabilities in C/C++ programs, I would guess by providing hardware support for, e.g. converting scanf to fgets ...
3
votes
0answers
53 views

ASCII Armoring in a little endian system

With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?: How the armored region prevents the attack? If the most significant byte of the return address is 0x00 ...
3
votes
1answer
153 views

Buffer overflow exploit works with gdb but not without

I am learning about buffer overflows and I’m developing my very first exploit. There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
4
votes
0answers
58 views

Environment variable and scripting for return-to-libc exploit

For school we have to perform a return-to-libc exploit. Doing this, we need to spawn a shell from /bin/xh which will print a message that we succeeded with our exploit. To do this exploit, I used ...
4
votes
5answers
235 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
1
vote
1answer
117 views

Arduino buffer overflow and arbitrary code execution

Is it possible to overflow a buffer on an Arduino Uno R3 ? The following code is vulnerable on modern computers: #include <stdio.h> #include <string.h> int main(void) { char buff[15]; ...
0
votes
1answer
151 views

Shellcode to buffer overflow not working linux m32

What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it. I have compiled the program cc -o real real.c -g -...
3
votes
3answers
84 views

Preventing buffer overruns when performance is no concern

Anti-exploitation technologies (DEP, ASLR, stack protector, etc.) do not provide complete protection. One reason for this is performance; these technologies are designed to work with a low performance ...
0
votes
0answers
91 views

Buffer overflow, unable to overwrite return address

I can't write over return address completely and I don't know why. Here is gdb when I put 30 'A's: Stopped reason: SIGSEGV 0x00000a4141414141 in ?? () It overwrites RIP but not completely, so I ...
-1
votes
1answer
151 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
1
vote
0answers
77 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
5
votes
3answers
170 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
3
votes
2answers
276 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
2
votes
1answer
341 views

How a buffer underflow can lead to remote code execution on 64‐bits?

I have the following summarized pseudo code in C89 from an ssh server library that provide only access to things like git‑shell (/bin/bashis replaced with the program to run, so it’s not possible to ...
5
votes
2answers
282 views

Can Silicon Secured Memory prevent buffer overruns?

Oracle have recently announced the new SPARC M7 chip. It has an interesting feature called Silicon Secured Memory which claims to prevent memory corruption bugs like Heartbleed and Venom. The idea is ...
4
votes
1answer
174 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
8
votes
2answers
415 views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
2
votes
1answer
114 views

Problems executing shellcode via nop-sled

My shellcode instructions are changing during execution. I'm not sure why. Here is what my shellcode looks like: => 0xbffff0b3: nop 0xbffff0b4: nop 0xbffff0b5: xor eax,eax ...
3
votes
0answers
81 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
9
votes
2answers
131 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...