Questions tagged [assembly]
Assembly language is a low-level programming language whose instructions map almost 1-to-1 to a computer's machine code.
63
questions
1
vote
1answer
76 views
Remote Buffer Overflow w/out Memory Leak
I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
0
votes
0answers
44 views
How to overwrite \x00 on the memory address
I'm trying to overwrite a return address by using buffer overflow.
1 #include <stdio.h>
2 #include <string.h>
3
4 void jumphere(){
5 printf("SUCCESS!!");
6 }
7
8 int ...
1
vote
1answer
394 views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
1answer
373 views
What is the purpose of the instruction fldz on the Aaron Adams shellcode?
I'm studying the Aaron Adams assembly code. You can find the documentation here (section --[ 2.b.i Getting EIP).
I understand that the goal is to get the EIP.
I know that the FPU environment looks ...
3
votes
1answer
520 views
How does this simple buffer overflow work?
I've got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf("%s", buffer);
...
3
votes
1answer
56 views
Running a brief asm script inline for dynamic analysis
Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop?
There's only one system call to time, and at ...
1
vote
2answers
325 views
Why does my stack contain the return address to __libc_csu_init after main is initialised?
I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack.
1 #include<stdio.h>
2
3 int main(int argc, char *argv[]){
4 char ...
1
vote
2answers
123 views
is it possible to craft exploits for non-open source C/C++ software without fuzzing?
imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it.
the program is open source and is written in C/C++ . would this even be possible ...
1
vote
0answers
114 views
Why can't I see my shellcode executing in Immunity Debugger?
I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file.
I successfully spawned a reverse shell with metasploit, using a ...
29
votes
4answers
11k views
I feel like it's impossible to learn reverse engineering [closed]
I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie.
I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
737 views
Overflowing the buffer yet not jumping to address
I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here)
I think understand the basic concept i write more than 64 bytes characters ...
4
votes
3answers
976 views
What assembly should I learn? [closed]
I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn?
I have prior experience in programming, and I did a degree in Computer Science but ...
2
votes
2answers
962 views
Why do we need to remove null bytes from shell code?
I'm studying the basics of making shell codes. I have a question about it.
In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
1
vote
1answer
184 views
Binary Exploitation - How to set GID of a SUID binary using shellcode?
I have a binary that is SUID which I can currently use a buffer overflow exploit to obtain an elevated EUID shell.
However I haven't worked much with changing IDs through shellcode, and the file I ...
7
votes
1answer
779 views
Why would legitimate programs have a `jmp esp` instruction?
It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
1
vote
1answer
3k views
Buffer overflow: Why does the ESP Register change its value after access violation
Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
2
votes
2answers
520 views
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
General Background:
I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending ...
2
votes
1answer
2k views
Shellcode doesn't execute and EIP is overwritten
I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
0
votes
1answer
71 views
Can an attacker add malicious instructions to a cracked Password Manager app to exfiltrate credentials ? (1Password, oneSafe, etc.)
(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the ...
0
votes
1answer
303 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
4
votes
1answer
646 views
Custom EXE Template Metasploit 64-bit ASM PE Syntax
I asked this previously then deleted since I think I asked the question without gearing it towards msfvenom and custom EXE templates.
There is a 64-bit Windows PE written in assembly that ships with ...
1
vote
2answers
377 views
Why is this shellcode execution considered an exploit?
I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss
Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
2
votes
2answers
3k views
Buffer Overflow doesn't have enough space for exploit after being crashed
So I'm trying to write a buffer overflow for a knowingly vulnerable server application, I want to learn how to do this on my own and just want some direction.
I'm watching it in immunity debugger on ...
1
vote
1answer
306 views
Challenge: Shellcode with unique bytes
Is it possible to have a (small) shellcode with unique bytes only?
So far I noticed the smallest shellcode I can find online is 19 bytes for Linux x86, but it does repeat bytes, especially the "/" ...
6
votes
1answer
333 views
Curious about Microsoft “Buffer Security Check” implementation
A very quick background to help you answering my questions :
Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist)
15 year Linux Sysadmin & DBA experience
...
5
votes
1answer
4k views
How to bypass ASLR with ROP
I was reading this article by the InfoSec institute:
http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref
And was able to follow along until he did the ...
0
votes
1answer
272 views
Mov byte to addres inside a register
I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault.
The error happens in this ...
4
votes
1answer
819 views
How can Malware authors be determined? [duplicate]
My question is:
How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it?
...
1
vote
2answers
1k views
Segmentation fault error when calling user defined function in shellcode
I am getting the segmentation fault error when I called function "target" in my shellcode.
Here's the C code of program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#...
2
votes
1answer
1k views
Can anyone explain what Ret2plt means and how it works?
I'm reading about stack overflow protection mechanism like DEP, and it's written that Ret2plt and system() can be used to bypass it.
What is Ret2plt and how does it work? I cannot find a single ...
4
votes
2answers
850 views
What lies behind this complicated shellcode on linux?
It's pretty much my first time playing around with a buffer overflow exploit. I've written a simple C program that is vulnerable to buffer overflows:
#include <stdio.h>
#include <stdlib.h>...
1
vote
1answer
177 views
Large header/footer of shellcode bytes when going from x86 asm to exe?
I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...
1
vote
0answers
379 views
Eliminating 0x0a from ShellCode for unlink file
I have written a shellcode to unlink a file from the system, but when I extracted the hexcode off the binary file, it consists of \x0a byte, because the sys call number for unlink function is 10, so ...
2
votes
1answer
212 views
Need help in bypassing Structured Exception Handling (SEH) + egghunter
I am practicing exploit development and trying to remake this exploit by myself in the same environment:
exploit link
I face an issue that the egghunter is not running I even tried the one in the ...
3
votes
1answer
118 views
Is it “normal” to find procedures in the middle of a .mov file with a disassembler?
I used hopper disassembler to see if there was any strange activity on this particular mov file. What was bizarre and unexpected was
This .mov file is particularly strange such as it seems to lower ...
1
vote
2answers
1k views
Shellcode doesn't execute despite correct address on EIP
I need to produce a presentation on buffer overflows for a college class. I managed to create a simple buffer overflow where i inject the address of a specific function on the EIP and the function ...
17
votes
3answers
30k views
What does EIP stand for?
There are a ton of questions on here that make reference to the eip:
How can I partially overwrite the EIP in order to bypass ASLR?
Unable to overwrite EIP register
Do I always have to overwrite EIP ...
8
votes
1answer
7k views
How to detect suspicious content in a TrueType Font (.ttf) font file
I got curious about how to scan or assess the risk of a particular font file before deploying it to hosts. First line of defense, of course, is to make sure that our hosts are patched against any ...
2
votes
0answers
84 views
Problem when disassembling 16-bit binary one instruction at the time
I am currently disassembling a binary that enters vm86 mode, so 32-bit binary in 16-bit mode. While IDA fails to do that correctly, I took the initiative to do it by myself.
Problem is, I very often ...
7
votes
1answer
2k views
ROP Programming/Exploitation on ARM - Gadget chain
Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions:
pop {r0, r1, r2, r3, pc}
Which instructions will achieve the same? What gadgets I have ...
-4
votes
3answers
229 views
Reverse Engineer and Exploits researching [closed]
Can some one give me a start point for finding exploits in software and reverse engineering?
I need some kind of a book or a site...
I have background with programming with high and low level such as ...
31
votes
3answers
8k views
Why can't reverse engineering be automated?
I am still in college for a Computer Security degree and took my first assembly language based class last semester. We touched upon the subject of reverse engineering and why it is an important part ...
1
vote
1answer
289 views
Possible shellcode mailed to me
When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
5
votes
1answer
2k views
How to find stack pointer for overflow bug?
I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
2
votes
1answer
685 views
Buffer Overflow and Segments
I know by overwriting the return address in vulnerable program we can change the offset of next instruction and make it to point to our injected buffer. but this buffer is in stack segment and the ...
9
votes
1answer
2k views
Intel SGX and MSRs - what do developers need to know?
Intel SGX is an intriguing new technology that will ship as part of upcoming Intel processors. It is designed to enable running software in a secure enclave. Code running in the enclave will be ...
2
votes
0answers
291 views
Assembly decoder with jmp-pop-call technique
This is a part of code in which I cannot figure out the mistake. I am using the jmp-pop-call technique and what I get is "Segmentation Fault". Tried to use GDB but things are really vague. Each byte ...
0
votes
1answer
90 views
Is there a solution for runing processes in encrypted mode on runtime?
Is there any solution for securely running encrypted processes on an untrusted machine over the WAN?
In public clouding, you can split your processes and send process request over the WAN, but you ...
2
votes
1answer
1k views
Metasploit generating strange shellcode
So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode:
$ xxd -p shellcode
...
1
vote
1answer
99 views
When I controll EIP, how do I discover what the next steps are?
Lets say I can control the EIP CPU Register, and I want to jump to a specific function of which I know the correct memory address. This address is inside the same memory page. We have no exploit ...
