A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

2
votes
3answers
47 views

How can I avoid buffer overflows when programming an Android app? [on hold]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
6
votes
2answers
93 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> ...
8
votes
4answers
635 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
0
votes
0answers
49 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx ...
7
votes
2answers
434 views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
2
votes
2answers
105 views

how do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and objective c. I have understood buffer overflow and how ...
2
votes
0answers
36 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
1
vote
1answer
64 views

Buffer Overflow with Big Endian architecture

Could anyone help to solve the following practice problem related to buffer overflow? On this problem, I am confused about how the variables and addresses should be stored within the stack. Here ...
6
votes
1answer
459 views

stack buffer overflow in the main function? [closed]

I am trying to exploit a stack based overflow vulnerability. All the examples I can find make use of a ret address though. The buffer overflow I found is inside the main function, and I cannot find ...
1
vote
0answers
27 views

Having trouble reproducing PHP heap based buffer overflow in quoted_printable_encode [closed]

I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code: <?php // file: test.php $str = ...
2
votes
1answer
144 views

Why should canary values be chosen at runtime instead of compile time?

For buffer overflow attacks, my exam review says that there are drawbacks to choosing canary values at compile time vs runtime. Why would it be better to choose the canary value at runtime?
1
vote
0answers
32 views

Can you get infected by viewing an image? [duplicate]

Lets say I have an infected image by some malware, I double-click it and that triggers the default program that handles images to open it for viewing. Will this also trigger the malware inside the ...
0
votes
0answers
57 views

how does ASLR prevent return to libc / ROP and similar attacks?

I am trying to understand ASLR and how it is implemented. I understand it does not actually "prevent" buffer overflow etc from happening, it will only make it more difficult. But i am not able to ...
5
votes
1answer
91 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
2
votes
1answer
95 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
0
votes
1answer
48 views

is return-to-libc attacks possible Now?

I'v read that to make a successful return to lib-c attack, the attacker should store the address of the command (for example "bin/sh") in stack exactly after the return address to 'system' function ...
1
vote
0answers
63 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
2
votes
1answer
77 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
1
vote
1answer
48 views

Buffer Overflow and Segments

I know by overwriting the return address in vulnerable program we can change the offset of next instruction and make it to point to our injected buffer. but this buffer is in stack segment and the ...
1
vote
0answers
32 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
1
vote
0answers
28 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
35
votes
2answers
5k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
4
votes
2answers
7k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
0
votes
0answers
22 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
0
votes
2answers
59 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
1
vote
1answer
48 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
0
votes
0answers
141 views

Exploiting buffer overflow

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program ...
2
votes
0answers
41 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
5
votes
2answers
396 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
1
vote
1answer
207 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
4
votes
2answers
208 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP ...
0
votes
1answer
35 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
0
votes
0answers
163 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
2answers
73 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...
0
votes
1answer
98 views

3 byte address of system call and exit call

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ? By while exploiting i ...
0
votes
0answers
25 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
1
vote
3answers
487 views

How to gain root privilege after injecting code using a buffer overflow vulnerability?

Once the attacker finds an exploitable vulnerability in a user program, e.g., buffer overflow. Assume his goal is to gain root privilege and typical countermeasures are not present in the system ...
4
votes
1answer
681 views

Explaining a buffer overflow vulnerability in C

Given this C program: #include <stdio.h> #include <string.h> int main(int argc, char **argv) { char buf[1024]; strcpy(buf, argv[1]); } Built with: gcc -m32 -z execstack prog.c -o ...
3
votes
2answers
1k views

buffer overflow in python script

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through ...
7
votes
2answers
471 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
0
votes
2answers
145 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
9
votes
4answers
5k views

How is printf() in C/C++ a Buffer overflow vulnerability?

According to an article I just read, the functions printf and strcpy are considered security vulnerabilities due to Buffer overflows. I understand how strcpy is vulnerable, but could someone possibly ...
2
votes
3answers
2k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> ...
10
votes
1answer
1k views

Exploiting buffer overflow leads to segfault

I am trying to exploit simple stack overflow vulnerability. I have a basic code in c: #include <cstring> int main( int argc, char** argv ) { char buffer[500]; strcpy(buffer, ...
-3
votes
1answer
89 views

Buffer overflow without using environment variables [closed]

I was trying to overflow buffers and I was wondering , Is there anyway to do a buffer overflows without using environment variables ?
3
votes
1answer
176 views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
0
votes
1answer
268 views

In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the ...
1
vote
1answer
940 views

Buffer overflow - terminator canaries

I am reading an article on buffer overflow protection here. For terminator canaries, I follow the part that if a terminator like a zero is used for a canary, the attacker would have a terminator in ...
3
votes
3answers
392 views

C++ memset() memory overflow

I am new to C++. Can any C++ expert tell me would this causing buffer overflow? Sample Code: MyObject op; memset(&op, 0, sizeof(MyObject)); On my view it is ok to be this since the limit is ...
2
votes
1answer
177 views

What should you do if you cannot spawn a shell in a buffer overflow attack?

I have successfully exploited a program using ret2libc but I am running into a problem. Whenever I feed system() with /bin/sh I have nothing in return the program silently exit. However, if I feed ...