A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

2
votes
1answer
67 views

How can I find the size of an array just from compiled C program?

I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, ...
0
votes
1answer
69 views

s this an exploit attempt and where can I analyse it?

Edited: Never mind the MinGW or .bash_history, I can see that is unlikely. Somebody attacking me and those bytes ending up in the frequently used file .bash_history by accident is not that unlikely ...
0
votes
0answers
29 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
0answers
39 views

How to put specific hex characters in terminal to exploit the script [migrated]

I try to exploit a simple vulnerability in the following code, but I'm not successful, because I can't put the specific characters in the terminal by hand. For e.g. if the application read a character ...
4
votes
1answer
113 views

What kind of bugs can be found by dumb fuzzing a desktop app?

I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What ...
4
votes
2answers
81 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
2
votes
3answers
225 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
7
votes
1answer
150 views

using cat to overcome 'Stack smash detected'

I'm trying now buffer overflow exercise from the site http://pwnable.kr I found the string that should be entered to the gets frunction but got "Stack Smash Detected" then I found a solution in ...
3
votes
1answer
179 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
2
votes
1answer
114 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
4
votes
1answer
70 views

Unable to overwrite EIP register

Source code for both programs at the end of the post So, I've working through Hacking: The Art Of Exploitation, and so far so good. I've managed to control EIP in the vulnerable program notesearch.c. ...
2
votes
2answers
882 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
-1
votes
3answers
55 views

What is the future of exploitations? [closed]

With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to ...
2
votes
0answers
142 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
4
votes
0answers
51 views

Environment variable and scripting for return-to-libc exploit

For school we have to perform a return-to-libc exploit. Doing this, we need to spawn a shell from /bin/xh which will print a message that we succeeded with our exploit. To do this exploit, I used ...
3
votes
2answers
75 views

Exploit a buffer overflow without SIGSEGV

For my studies I try to create a payload so that it overflows the buffer and calls a "secret" function called "target" This is the code I use for testing on an i686 #include "stdio.h" #include ...
4
votes
1answer
79 views

What is an example of arithmetic and buffer overflows in a php application?

I'm trying to find evidence whether it is possible to have overflows in a php application, whether buffer overflows or arithmetic overflows. I believe it's possible to have these overflows in the ...
44
votes
3answers
36k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
0
votes
0answers
55 views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
1
vote
1answer
60 views

Are stack overflows using memcpy possible with modern compilers?

These days memcpy is protected by an interface named _memcpy_chk, which checks the size of the destination buffer at runtime. After reading the source code for _memcpy_chk at ...
3
votes
0answers
40 views

Bypass Stack Canary by going past the return address

I was testing a simple C program with stack canary protection. I attempted to bypass the protection by overwriting past the function's return address and overwriting main's address. I am overwriting ...
0
votes
0answers
44 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
3
votes
0answers
82 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
124
votes
7answers
18k views

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

When I look at the exploits from the past few years related to implementations, I see that quite a lot of them are from C or C++, and a lot of them are overflow attacks. Heartbleed was a buffer ...
2
votes
2answers
99 views

why can't i overwrite stack frame

I'm currently reading Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition and I have a question with an exercise in the book. The lab "Lab 10 - 1 Overflow of meet.c" is a lab in which we ...
2
votes
1answer
168 views

Return-to-libc attack with the argument read from registers (EDI/RDI)

I've read that to make a successful return-to-libc attack, the attacker should store the address of the command (for example /bin/sh) in the stack exactly after the return address of the system ...
3
votes
1answer
109 views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
1
vote
1answer
2k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
0
votes
0answers
67 views

Put shellcode in writable sections -> .bss & .data

so, I have following issue. Let's say, I have a simple vulnerable program, such as this one: #include <stdio.h> #include <string.h> #include <stdlib.h> void vuln_function(char *); ...
4
votes
3answers
121 views

Strange address change during Buffer Overflow

I was testing out a buffer overflow and the following strange thing happened: The return address is at 0xbffff7bc which I discovered from testing. I replaced it with the value I wanted 0xbffff636. ...
5
votes
3answers
167 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
3
votes
1answer
74 views

Will Intel's MPX extension make C/C++ completely safe to use?

This is apparently an extension that will eliminate buffer overflow and format string vulnerabilities in C/C++ programs, I would guess by providing hardware support for, e.g. converting scanf to fgets ...
3
votes
0answers
50 views

ASCII Armoring in a little endian system

With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?: How the armored region prevents the attack? If the most significant byte of the return address is 0x00 ...
2
votes
1answer
117 views

Buffer overflow exploit works with gdb but not without

I am learning about buffer overflows and I’m developing my very first exploit. There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
4
votes
5answers
224 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
2
votes
1answer
290 views

How a buffer underflow can lead to remote code execution on 64‐bits?

I have the following summarized pseudo code in C89 from an ssh server library that provide only access to things like git‑shell (/bin/bashis replaced with the program to run, so it’s not possible to ...
1
vote
1answer
102 views

Arduino buffer overflow and arbitrary code execution

Is it possible to overflow a buffer on an Arduino Uno R3 ? The following code is vulnerable on modern computers: #include <stdio.h> #include <string.h> int main(void) { char buff[15]; ...
0
votes
1answer
124 views

Shellcode to buffer overflow not working linux m32

What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it. I have compiled the program cc -o real real.c -g ...
8
votes
2answers
375 views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
1
vote
0answers
75 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
3
votes
3answers
84 views

Preventing buffer overruns when performance is no concern

Anti-exploitation technologies (DEP, ASLR, stack protector, etc.) do not provide complete protection. One reason for this is performance; these technologies are designed to work with a low performance ...
0
votes
0answers
85 views

Buffer overflow, unable to overwrite return address

I can't write over return address completely and I don't know why. Here is gdb when I put 30 'A's: Stopped reason: SIGSEGV 0x00000a4141414141 in ?? () It overwrites RIP but not completely, so I ...
-1
votes
1answer
117 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
3
votes
2answers
238 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
5
votes
2answers
267 views

Can Silicon Secured Memory prevent buffer overruns?

Oracle have recently announced the new SPARC M7 chip. It has an interesting feature called Silicon Secured Memory which claims to prevent memory corruption bugs like Heartbleed and Venom. The idea is ...
4
votes
1answer
149 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
2
votes
1answer
102 views

Problems executing shellcode via nop-sled

My shellcode instructions are changing during execution. I'm not sure why. Here is what my shellcode looks like: => 0xbffff0b3: nop 0xbffff0b4: nop 0xbffff0b5: xor eax,eax ...
3
votes
0answers
73 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
9
votes
2answers
123 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...