A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

2
votes
2answers
66 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> ...
-1
votes
1answer
200 views

Stack-based buffer overflow the program is interpreting the shellcode on its own

I'm beginner in exploits. So I had type simple program in C #include <stdio.h> void func(){ printf("asd"); } main(){ char buf[100]; scanf("%s", &buf); } My goal is to run the ...
-2
votes
1answer
164 views

Buffer Overflow Exploit Shellcode for Windows

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C ...
2
votes
0answers
40 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
1
vote
0answers
42 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
24 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
0
votes
0answers
42 views

how does ASLR prevent return to libc / ROP and similar attacks?

I am trying to understand ASLR and how it is implemented. I understand it does not actually "prevent" buffer overflow etc from happening, it will only make it more difficult. But i am not able to ...
0
votes
0answers
18 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
0
votes
0answers
145 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
0answers
23 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
0
votes
0answers
91 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
0
votes
0answers
136 views

Exploiting buffer overflow

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program ...