The C programming language, commonly used for low-level programming

learn more… | top users | synonyms

1
vote
1answer
68 views

Is or was it possible to register a wildcard certificate to third level subdomain?

The use of a null byte in a certificate cn is very well known… and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of ...
0
votes
1answer
25 views

Non-identified algorithm for RSA decryption in tpm-emulator

While analyzing the source code of tpm-emulator I found that the RSA key decryption uses an algorithm that is unknown to me. The original file with this mystery is located in rsa.c, where the ...
1
vote
1answer
70 views

Unsafe C program accepting malicious string inputs

I have a question regarding to this unsafe C program. int main(int argc, char **argv) { char text[32]; static int some_value = -72; strcpy(text, argv[1]); /* copy the parameter into the ...
2
votes
0answers
49 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
-2
votes
1answer
42 views

Exploiting C99 VLAs to cause stack overflow [closed]

In my project one of the command-line arguments is loaded into a C99 VLA (variable-length array) as shown in the example code below. My question is: can this be exploited? If yes, I'd like to be ...
-2
votes
0answers
11 views

Double Free - crash or no crash [migrated]

Can someone explain me why freeing a twice in a row causes a crash, but freeing a first, then b, and then a again does not crash? I know that a free will insert the heap chunk in a double linked free ...
1
vote
1answer
82 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
4
votes
2answers
97 views

C shellcode explanation

I've found this shellcode at https://www.exploit-db.com/exploits/39624/: #include <stdio.h> char ...
40
votes
3answers
4k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
1
vote
0answers
11 views

snort spp_sfPortscan Preprocessor Customization [closed]

I am working in snort 2.9.8.0. I want to modify the snort code for Portscanning Detection,i.e spp_sfPortscan.c and its related code to build a customized portScan detector. Ex:suppose A is scanning ...
4
votes
3answers
675 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
35
votes
6answers
3k views

Is C a good choice for security-related software any longer? [closed]

C is a rock-solid and widespread programming language that is very popular especially in the FOSS community. Many security-related software (such as encryption libraries) are written in C and will ...
1
vote
3answers
83 views

Since when can't any program get MS-DOS and MS-Windows admin rights?

I'm certain that I read that in the 80s with 8-bit Intel processorn, any DOS program that was run with MS-DOS was run in administrative mode and could do anything that any C program could do. Now I'm ...
3
votes
0answers
75 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
124
votes
7answers
18k views

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

When I look at the exploits from the past few years related to implementations, I see that quite a lot of them are from C or C++, and a lot of them are overflow attacks. Heartbleed was a buffer ...
1
vote
2answers
45 views

Static vs Dynamic Linking

I came across DJB's Curve25519 implementation site (https://cr.yp.to/ecdh.html) and noticed he states in reference to using it: You can and should include it in your own programs, rather than ...
0
votes
0answers
31 views

Rootkit driver to change executed instructions

Say I have a process that has a bunch of functions I want to NOP out. From userland, I want anyone viewing the virtual memory to see the normal instructions. However physical memory, and in the end ...
1
vote
1answer
2k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
4
votes
3answers
116 views

Strange address change during Buffer Overflow

I was testing out a buffer overflow and the following strange thing happened: The return address is at 0xbffff7bc which I discovered from testing. I replaced it with the value I wanted 0xbffff636. ...
2
votes
2answers
94 views

when defining constants, is #define more secure than static const?

I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if #define TimeLimit 30 is ...
3
votes
1answer
72 views

Will Intel's MPX extension make C/C++ completely safe to use?

This is apparently an extension that will eliminate buffer overflow and format string vulnerabilities in C/C++ programs, I would guess by providing hardware support for, e.g. converting scanf to fgets ...
3
votes
2answers
106 views

How to know the time of compilation

I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
4
votes
0answers
55 views

Privilege escalation fails outside gdb

I have an application with the following source code: #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { char buffer[12]; strcpy(buffer, str); ...
4
votes
5answers
219 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
7
votes
1answer
187 views

How to exactly create a CVE? [duplicate]

I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10). When it ...
49
votes
4answers
7k views

Old OS memory space protection - was it really that bad?

In his book Security Engineering, Anderson really focuses on how in the 90s and early 2000s programs would need to access memory that wasn't their own, and programmers programmed with the assumption ...
0
votes
1answer
105 views

Shellcode to buffer overflow not working linux m32

What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it. I have compiled the program cc -o real real.c -g ...
2
votes
1answer
88 views

Should I compile as root?

When I am compiling software for local installation, what factors should I take into consideration when deciding whether to compile as root or to compile under my regular user account? ./configure ...
4
votes
2answers
412 views

ASLR Randomization BSS

When I asked this question before, it was close and voted negative, I definitely feel bad about it. But I would really like to know the answer, so I ll make it more clear this time. Here is some ...
2
votes
1answer
115 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
-1
votes
1answer
108 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
3
votes
1answer
115 views

LibTomCrypt weird ECC Keys

I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography. In my first little program I created an ...
1
vote
0answers
649 views

verifying digest signed with private key using a C program

I'll explain all the steps I've done so far and conclude with my question. using OpenSSL 1.0.1e-fips 11 Feb 2013 Generating a private and public key openssl genrsa -des3 -out private.pem 2048 ...
19
votes
4answers
2k views

Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays

Please Consider: English is my second language. On the Security Now! podcast episode 518 (HORNET: A Fix for TOR?), at the 27:51 mark Steve Gibson quotes an example of vulnerable code in C/C++: ...
11
votes
3answers
3k views

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers Could somebody please ...
11
votes
7answers
5k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
7
votes
2answers
351 views

Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?

Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone. I have a simple HTTP server that I want to ...
5
votes
2answers
186 views

Is compiling untrusted code safe?

I'm curious about compiling with gcc/g++/clang with the assumption that headers and implementation files are user-provided, but not the build configuration. (i.e., no cd lib && make) What if ...
3
votes
0answers
95 views

How to encrypt and authenticate large amounts of data with NaCl

In a current project the NaCl-library crypto_box function has been used to encode and crypto_box_open to authenticate and decode data. However the library does not seem to support de- / encoding of ...
1
vote
1answer
30 views

Expand user login in Path - Filter malicious values

I have a function that takes a pathname and substitutes every occurrence of '%u' with a given String. For my scenario this given String is the login that a user/attacker enters via ssh during ...
7
votes
2answers
372 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> ...
1
vote
2answers
417 views

Is `arc4random` secure enough?

I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
2
votes
1answer
345 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
88 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
1
vote
0answers
173 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
0
votes
0answers
243 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
4
votes
4answers
141 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
4
votes
1answer
867 views

Explaining a buffer overflow vulnerability in C

Given this C program: #include <stdio.h> #include <string.h> int main(int argc, char **argv) { char buf[1024]; strcpy(buf, argv[1]); } Built with: gcc -m32 -z execstack prog.c -o ...
3
votes
2answers
4k views

buffer overflow in python script

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through ...
11
votes
4answers
8k views

How is printf() in C/C++ a Buffer overflow vulnerability?

According to an article I just read, the functions printf and strcpy are considered security vulnerabilities due to Buffer overflows. I understand how strcpy is vulnerable, but could someone possibly ...