A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

1
vote
2answers
509 views

buffer overflow in python script

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through ...
7
votes
2answers
374 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
0
votes
2answers
111 views

Are buffer overflows on websites stoppable?

Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers. One that caught my eye was the "buffer ...
0
votes
1answer
53 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
7
votes
4answers
3k views

How is printf() in C/C++ a Buffer overflow vulnerability?

According to an article I just read, the functions printf and strcpy are considered security vulnerabilities due to Buffer overflows. I understand how strcpy is vulnerable, but could someone possibly ...
2
votes
3answers
1k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> ...
0
votes
1answer
79 views

3 byte address of system call and exit call

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ? By while exploiting i ...
9
votes
1answer
737 views

Exploiting buffer overflow leads to segfault

I am trying to exploit simple stack overflow vulnerability. I have a basic code in c: #include <cstring> int main( int argc, char** argv ) { char buffer[500]; strcpy(buffer, ...
-3
votes
1answer
49 views

Buffer overflow without using environment variables [closed]

I was trying to overflow buffers and I was wondering , Is there anyway to do a buffer overflows without using environment variables ?
3
votes
1answer
57 views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
0
votes
1answer
98 views

In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the ...
1
vote
1answer
353 views

Buffer overflow - terminator canaries

I am reading an article on buffer overflow protection here. For terminator canaries, I follow the part that if a terminator like a zero is used for a canary, the attacker would have a terminator in ...
3
votes
3answers
136 views

C++ memset() memory overflow

I am new to C++. Can any C++ expert tell me would this causing buffer overflow? Sample Code: MyObject op; memset(&op, 0, sizeof(MyObject)); On my view it is ok to be this since the limit is ...
2
votes
1answer
149 views

What should you do if you cannot spawn a shell in a buffer overflow attack?

I have successfully exploited a program using ret2libc but I am running into a problem. Whenever I feed system() with /bin/sh I have nothing in return the program silently exit. However, if I feed ...
2
votes
1answer
75 views

Are stack buffer overflows even possible in this instance?

Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
1
vote
3answers
498 views

Drive-by downlad VS buffer and stack overflow attacks

Today malware is mainly spread thanks to vulnerabilities exploited in browsers and their plugins. The attackers use JavaScript to target those vulnerabilities. Two examples of such attacks are ...
0
votes
1answer
81 views

Does glibc use canary checking to prevent heap buffer overflow?

Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes ...
4
votes
1answer
6k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
0
votes
1answer
212 views

In return to libc how do you know the address of system() in a remote machine?

I have the following scienarion: a vulnerable program running in a server and can be accessed using netcat I have a copy of that program locally and I can exploit it locally using ROP: ./vuln ...
13
votes
1answer
1k views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
11
votes
4answers
2k views

Adding 65K buffer to protect from buffer overflows?

If you had a very complex and important function in C that you wanted to protect, would it be worth it to put a 65K buffer at the top of the stack to protect from buffer overflows? You would put your ...
0
votes
1answer
492 views

Buffer Overflow on Raspberry PI

Is the ARM processor used on the Raspberry Pi vulnerable to standard buffer overflows? That is, if a program that has a BO vulnerability is run on a Pi, will it be vulnerable to exploit? How does ...
0
votes
1answer
138 views

Fomat String vulnerability used to display data outside the function stack frame?

if we run the following code using the input "hi", the output will simply be "hi" main(int argc, char **argv) { char *secret = "This is a secret 1\n"; char *secret2 = "This is ...
2
votes
2answers
81 views

Possible to use buffer overflow on DLL-injected code?

Is it possible to apply buffer overflow on code that was injected using DLL injection? For instance, if I inject a function foo() into the process, is it possible to call foo() using buffer overflow? ...
0
votes
0answers
85 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
4
votes
2answers
176 views

Heap canaries, to protect function pointers in heap objects

I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
1
vote
2answers
185 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
4
votes
1answer
150 views

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples ...
5
votes
1answer
192 views

Information disclosure attack, using a heap overflow

A typical strategy for defeating ASLR is to find both a buffer overflow bug and an information disclosure bug. But when attacking servers that are automatically restarted whenever they crash/die, is ...
0
votes
1answer
66 views

libraries alternative to gcc stack-protector / fortity source feature on linux

is there external library/approach/whatever to add canary protection (stack-protector equivalent) extra buffer boundary check (fortity source equivalent) on a C software without using glibc / ...
-1
votes
1answer
133 views

Stack-based buffer overflow the program is interpreting the shellcode on its own

I'm beginner in exploits. So I had type simple program in C #include <stdio.h> void func(){ printf("asd"); } main(){ char buf[100]; scanf("%s", &buf); } My goal is to run the ...
-2
votes
1answer
143 views

Buffer Overflow Exploit Shellcode for Windows

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C ...
2
votes
1answer
81 views

Does ASLR protect against a buffer overflow within a struct?

Assume a simple struct: struct test { char variable[4]; char variable2; } If I write something like variable[4] = '\0' there is a buffer overflow which modifies variable2. Does ASLR prevent ...
15
votes
5answers
5k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
0
votes
1answer
47 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...
0
votes
0answers
105 views

exploiting buffer overflow

when i download a copy of vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload) it works. but when i made a same type of vulnerable program in c i am ...
1
vote
1answer
76 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
0
votes
1answer
184 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
2
votes
2answers
140 views

Why is it so difficult to protect an application against buffer overflows?

For example, buffer overflow vulnerabilities in Flash are often discovered. Shouldn't a proper verification of all function parameters in Flash source code be enough to protect against buffer ...
28
votes
2answers
4k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
3
votes
1answer
425 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
3
votes
4answers
2k views

Should I worry about this UAC bypass exploit for Windows 7?

It appears that there is an exploit out there that allegedly allows you to bypass the UAC on Windows 7 computers and gain administrator access. I was wondering if this exploit is still a dangerous ...
36
votes
7answers
17k views

How to explain buffer overflow to a layman

Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can't really think of a good metaphor, I end up spending about 10 ...
4
votes
3answers
623 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
6
votes
3answers
3k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
-1
votes
1answer
264 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
2
votes
1answer
360 views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
1
vote
2answers
437 views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
2
votes
1answer
213 views

EIP pointer is overwritten but EBP remains intact

I was trying out a simple stack buffer overflow exploit by creating a malicious crash.m3u file. as you can see the EIP pointer is overwritten by "A" but EBP hasn't changed. isn't EBP supposed to get ...
0
votes
1answer
172 views

Using buffer overflow on word with macro injection

I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like ...