Questions tagged [c]
The C programming language, commonly used for low-level programming
298
questions
3
votes
1
answer
202
views
Is it safe to call mount(2) and pass the password as a parameter?
I wanted to write a daemon that users can start, and that, every 2 hours, automatically mounts an authenticated network share. The daemon will prompt the user for the password only the first time, and ...
- 165
3
votes
1
answer
735
views
Constructing a tainted string for arc injection
I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++.
In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in ...
- 31
3
votes
1
answer
659
views
Best option to fuzz a C Network Program [closed]
I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
- 31
3
votes
0
answers
2k
views
system("/bin/sh") exits without waiting for user input [OverTheWire narnia0 challenge] [closed]
Problem :
Why does system("/bin/sh") process exits immediately instead of waiting for user input?
Code :
int main(){
long val=0x41414141;
char buf[20];
printf("Correct val's value from ...
- 113
2
votes
1
answer
291
views
Why does Kaspersky anti-virus not consider this executable as malicious?
I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code:
#include <stdio.h>
#include <stdlib.h>
int main(...
- 123
2
votes
2
answers
876
views
What's the secure way to change UNIX permissions on a harcoded file often?
I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
- 2,872
2
votes
3
answers
4k
views
Top 10 dangerous mistakes in C programming? [closed]
What is the top dangerous mistakes in C programming?
for example misusing a strcpy causes a stack-overflow and code injection.
I'm looking for at least 10 bad programming pattern in C.
- 123
2
votes
2
answers
2k
views
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
General Background:
I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending ...
- 355
2
votes
3
answers
6k
views
How to perform buffer overflow on non-argument parameters?
I am new to buffer overflow attacks and I am trying to do the same on a sample c code which I have.
I have three variables a, b and buffer.
a and b have values assigned to them in the code itself. ...
- 3,951
2
votes
2
answers
244
views
Is an open TCP port that doesn’t take input secure?
I have written a simple C program (~30 lines) that opens an internet socket and sends data to the client on every connection. The program never read()s from the socket; it just parses the /proc ...
- 123
2
votes
1
answer
3k
views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
- 425
2
votes
1
answer
567
views
Problem while implementing an ARP poisoning software
I'm studying ARP poisoning and I've coded a computer program to poison other computer's ARP cache using raw sockets in C language.
What I've done was: send an ARP reply to the target, always using ...
- 35
2
votes
3
answers
2k
views
How can I execute shell in this CTF exercise?
I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough.
How can I:
Make strcmp to be 0 (evaluate ...
- 997
2
votes
1
answer
1k
views
Unsafe C program accepting malicious string inputs
I have a question regarding to this unsafe C program.
int main(int argc, char **argv)
{
char text[32];
static int some_value = -72;
strcpy(text, argv[1]); /* copy the parameter into the ...
- 161
2
votes
2
answers
4k
views
How do I make a working example of a "Dangling Pointers" exploit? (or where do I find it online)
I was recently reading about buffer overflows and dangling pointers. I read "Smashing the stack for fun and Profit " by Aleph1 and that paper was really clear and concise in explaination. On the ...
- 507
2
votes
2
answers
498
views
Which software scans software for potential vulnerabilities?
Is there any kind of parser software analysis tool that will analyze C code and outputs possible vulnerabilities like buffer overflows?
- 224
2
votes
1
answer
1k
views
Private IPC between two processes
I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
- 23
2
votes
1
answer
856
views
ASLR doesn't work?
I have following code:
#include <stdio.h>
#include <stdlib.h>
int main()
{
int *ptr1 = malloc(16);
int val1 = 0x12345678;
printf("stack: %p\nheap: %p\n", &...
2
votes
1
answer
2k
views
How to find buffer offset for Return to Libc Attack
I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a ...
- 121
2
votes
2
answers
4k
views
Shellcode doesn't execute and EIP is overwritten
I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
2
votes
1
answer
2k
views
Problem exploiting Buffer Overflow in a simple C program
I am new to Buffer Overflow exploits and I started with a simple C program.
My program is as follows :
#include <stdio.h>
#include <strings.h>
void execs(void){
printf("yay!!");
}
...
- 123
2
votes
2
answers
1k
views
Static vs Dynamic Linking
I came across DJB's Curve25519 implementation site (https://cr.yp.to/ecdh.html) and noticed he states in reference to using it:
You can and should include it in your own programs, rather than going ...
- 1,179
2
votes
1
answer
165
views
Void pointer and their attribute constructor
I am supposed to find the vulnerability in the code (as a part of a ctf) and I feel it's hidden either in the __attribute__((constructor)) or the pointer.
Here I can make out that it's a void pointer ...
- 23
2
votes
1
answer
290
views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
- 21
2
votes
1
answer
1k
views
Buffer Overflow Works Locally But Not Remotely
So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
2
votes
1
answer
125
views
Buffer Overflow protections in custom library
Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
- 1,860
2
votes
2
answers
265
views
Software overflow exploitation lab
Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
- 101
2
votes
2
answers
174
views
Ensuring File is Write-Only For Specific Program
So in this scenario there are several programs that exist that can open and read a binary file, but my program must be the final arbitrator in creating and writing to these files.
In this program I ...
- 23
2
votes
1
answer
219
views
Avoid stack addresses containing zeros
I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).
...
- 131
2
votes
1
answer
596
views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
- 187
2
votes
1
answer
321
views
Having trouble with learning Buffer Overflows
So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
- 21
2
votes
1
answer
860
views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
2
votes
1
answer
256
views
Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?
Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
- 23
2
votes
1
answer
886
views
Buffer Overflow in the C program
I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.
Here is the question. Sorry the original condition ...
2
votes
2
answers
3k
views
Overflowing the buffer yet not jumping to address
I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here)
I think understand the basic concept i write more than 64 bytes characters ...
- 461
2
votes
1
answer
2k
views
Securing .so file access permissions
I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps.
The issue is that there are only two exported functions in the .so ...
- 145
2
votes
1
answer
906
views
Is it possible to execute code in this program using heap overflow?
Program code (with Pseudo code part):
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv)
{
int controlled1=10;
int controlled2=20;
int controlled3=300;
//test.bin ...
- 997
2
votes
1
answer
726
views
Interactive shell not opening
I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell.
When I type ...
2
votes
1
answer
1k
views
How to implement ECDHE-RSA-AES256-GCM-SHA-2 communication in OpenSSL?
Full question
How do you implement client and server based solution-pair to secure network communication for simple C++-based desktop (non-browser) programs utilising the ECDHE-RSA-AES256-GCM-SHA-2 ...
- 21
2
votes
1
answer
877
views
PHP BLENC extension security concern
PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
- 436
2
votes
1
answer
1k
views
How to exploit this piece of code? (format string in printf?) [closed]
So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
- 139
2
votes
1
answer
1k
views
exploiting Heap Overflow in gdb segfaults
I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04.
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int n = 5;
...
- 191
2
votes
1
answer
1k
views
SSH Protocol classification version exchange messages
I am trying to classify network protocols over network traffic . Now my task is SSH protocol. I read the RFC and know SSH starts with protocol exchange message from both client and server .
Format ...
2
votes
0
answers
221
views
What is missing to reproduce CVE-2022-32250?
I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here.
So I installed Ubuntu 22.04 on VM, and installed kernel ...
- 31
2
votes
0
answers
446
views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
- 21
2
votes
0
answers
626
views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
- 21
2
votes
1
answer
1k
views
How do I bypass a return address overwrite not doing anything?
This is main:
(gdb) disass main
Dump of assembler code for function main:
0x000000000040057c <+0>: push rbp
0x000000000040057d <+1>: mov rbp,rsp
0x0000000000400580 <+4&...
2
votes
1
answer
641
views
Security implications of setting the broadcast flag on a UDP socket
Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
- 626
2
votes
0
answers
1k
views
Snort Portscan Preprocessor Analysis
Remarks
I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
- 191
2
votes
0
answers
9k
views
verifying digest signed with private key using a C program
I'll explain all the steps I've done so far and conclude with my question.
using OpenSSL 1.0.1e-fips 11 Feb 2013
Generating a private and public key
openssl genrsa -des3 -out private.pem 2048
...
- 121