A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

6
votes
1answer
53 views

using cat to overcome 'Stack smash detected'

I'm trying now buffer overflow exercise from the site http://pwnable.kr I found the string that should be entered to the gets frunction but got "Stack Smash Detected" then I found a solution in ...
2
votes
1answer
154 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
0
votes
1answer
66 views

Shellcode to buffer overflow not working linux m32

What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it. I have compiled the program cc -o real real.c -g ...
-1
votes
1answer
318 views

Stack-based buffer overflow the program is interpreting the shellcode on its own

I'm beginner in exploits. So I had type simple program in C #include <stdio.h> void func(){ printf("asd"); } main(){ char buf[100]; scanf("%s", &buf); } My goal is to run the ...
-2
votes
1answer
224 views

Buffer Overflow Exploit Shellcode for Windows

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C ...
4
votes
0answers
73 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
3
votes
0answers
40 views

ASCII Armoring in a little endian system

With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?: How the armored region prevents the attack? If the most significant byte of the return address is 0x00 ...
3
votes
0answers
53 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
2
votes
0answers
107 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
2
votes
0answers
81 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
2
votes
0answers
53 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
1
vote
0answers
61 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
0answers
50 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
1
vote
0answers
115 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx ...
1
vote
0answers
261 views

how does ASLR prevent return to libc / ROP and similar attacks?

I am trying to understand ASLR and how it is implemented. I understand it does not actually "prevent" buffer overflow etc from happening, it will only make it more difficult. But i am not able to ...
1
vote
0answers
65 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
1
vote
0answers
221 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
0answers
26 views

Put shellcode in writable sections -> .bss & .data

so, I have following issue. Let's say, I have a simple vulnerable program, such as this one: #include <stdio.h> #include <string.h> #include <stdlib.h> void vuln_function(char *); ...
0
votes
0answers
57 views

Buffer overflow, unable to overwrite return address

I can't write over return address completely and I don't know why. Here is gdb when I put 30 'A's: Stopped reason: SIGSEGV 0x00000a4141414141 in ?? () It overwrites RIP but not completely, so I ...
0
votes
0answers
166 views

Exploiting buffer overflow

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program ...
-1
votes
0answers
15 views

Why isn't my program crashing in Windows XP SP3 when attempting to cause a buffer overflow? It works in Windows Server 2003

I have Windows XP Professional SP3 installed on a victim machine, and I'm testing for buffer overflow vulnerabilities in Ability FTP Server. I sent a 5000 byte "A" with the STOR command the victim's ...