A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

1
vote
0answers
77 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
3
votes
3answers
84 views

Preventing buffer overruns when performance is no concern

Anti-exploitation technologies (DEP, ASLR, stack protector, etc.) do not provide complete protection. One reason for this is performance; these technologies are designed to work with a low performance ...
0
votes
0answers
91 views

Buffer overflow, unable to overwrite return address

I can't write over return address completely and I don't know why. Here is gdb when I put 30 'A's: Stopped reason: SIGSEGV 0x00000a4141414141 in ?? () It overwrites RIP but not completely, so I ...
-1
votes
1answer
151 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
3
votes
2answers
282 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
5
votes
2answers
282 views

Can Silicon Secured Memory prevent buffer overruns?

Oracle have recently announced the new SPARC M7 chip. It has an interesting feature called Silicon Secured Memory which claims to prevent memory corruption bugs like Heartbleed and Venom. The idea is ...
4
votes
1answer
174 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
2
votes
1answer
116 views

Problems executing shellcode via nop-sled

My shellcode instructions are changing during execution. I'm not sure why. Here is what my shellcode looks like: => 0xbffff0b3: nop 0xbffff0b4: nop 0xbffff0b5: xor eax,eax ...
3
votes
0answers
81 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
9
votes
2answers
132 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...
4
votes
1answer
125 views

How did the Code Red worm work?

So I've been reading a bit about the Code Red worm, and I get the gist but the overflow string doesn't make sense to me. From this site, it says that the overflow string the worm used was /default....
19
votes
4answers
2k views

Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays

Please Consider: English is my second language. On the Security Now! podcast episode 518 (HORNET: A Fix for TOR?), at the 27:51 mark Steve Gibson quotes an example of vulnerable code in C/C++: ...
11
votes
7answers
5k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
7
votes
2answers
516 views

Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?

Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone. I have a simple HTTP server that I want to ...
6
votes
2answers
621 views

How do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
1
vote
0answers
51 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
3
votes
2answers
207 views

How to overwrite ebp on stack alignment?

I want to exploit a simple program #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buf[128]; strcpy(buf, argv[1]); return 0; } The disassembly ...
3
votes
1answer
567 views

Removing null bytes from shell code

I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example: xor %edi,%...
5
votes
1answer
89 views

Buffer Overflow due to wrong data type

I am reading the OWASP page on buffer overflow. It mentions: buffer overflow can be prevented using higher-level programming languages that are strongly typed and developer should validate input to ...
5
votes
3answers
13k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
2
votes
0answers
106 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
0
votes
3answers
547 views

How can I avoid buffer overflows when programming an Android app? [closed]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
7
votes
2answers
405 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> #...
9
votes
4answers
944 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
1
vote
0answers
127 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx $...
10
votes
2answers
1k views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
2
votes
0answers
37 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
2
votes
1answer
130 views

Buffer Overflow with Big Endian architecture

Could anyone help to solve the following practice problem related to buffer overflow? On this problem, I am confused about how the variables and addresses should be stored within the stack. Here ...
6
votes
1answer
1k views

stack buffer overflow in the main function? [closed]

I am trying to exploit a stack based overflow vulnerability. All the examples I can find make use of a ret address though. The buffer overflow I found is inside the main function, and I cannot find ...
1
vote
0answers
49 views

Having trouble reproducing PHP heap based buffer overflow in quoted_printable_encode [closed]

I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code: <?php // file: test.php $str = ...
3
votes
1answer
472 views

Why should canary values be chosen at runtime instead of compile time?

For buffer overflow attacks, my exam review says that there are drawbacks to choosing canary values at compile time vs runtime. Why would it be better to choose the canary value at runtime?
1
vote
0answers
37 views

Can you get infected by viewing an image? [duplicate]

Lets say I have an infected image by some malware, I double-click it and that triggers the default program that handles images to open it for viewing. Will this also trigger the malware inside the ...
1
vote
0answers
387 views

how does ASLR prevent return to libc / ROP and similar attacks?

I am trying to understand ASLR and how it is implemented. I understand it does not actually "prevent" buffer overflow etc from happening, it will only make it more difficult. But i am not able to ...
6
votes
1answer
313 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
2
votes
1answer
390 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
139 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
4
votes
1answer
313 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
2
votes
1answer
84 views

Buffer Overflow and Segments

I know by overwriting the return address in vulnerable program we can change the offset of next instruction and make it to point to our injected buffer. but this buffer is in stack segment and the ...
1
vote
0answers
38 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
41
votes
2answers
9k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
1
vote
0answers
103 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
1
vote
2answers
145 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
2
votes
1answer
83 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
4
votes
0answers
99 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
5
votes
2answers
867 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
4
votes
2answers
494 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP proxy/...
1
vote
1answer
128 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
0
votes
0answers
264 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
2answers
91 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...