Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
0
votes
2answers
136 views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
2
votes
2answers
71 views

Cannot build a ROP chain

My ROP exploit crashes with segmentation fault for unknown reason. This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2): #include <stdio.h> #include ...
1
vote
0answers
35 views

Can a heap/mmap buffer overflow overwrite the stack

The following questions regard linux processes with a stack that grows downwards from the end of the process memory. If I have a buffer overflow on the heap with unlimited size, are there any ...
1
vote
1answer
50 views

64bit buffer overflow fails with SIGILL, cannot understand the reason

I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z ...
0
votes
0answers
10 views

How Could a Buffer Overflow be Used to Execute Code? [duplicate]

I've heard a lot about buffer overflows, and I understand the basic concept, but I would like to know exactly how buffer overflow vulnerabilities are used to execute code? Because, if an attacker were ...
1
vote
2answers
121 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
0
votes
1answer
57 views

In Buffer overflow exploitation what if JMP ESP address contains bad characters?

I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP ...
0
votes
1answer
71 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
45
votes
3answers
8k views

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Since buffer overflows always let an evil hacker write outside the buffer and overwrite the return pointer to a shellcode the evil hacker can place, does it mean that successful exploitation of a ...
0
votes
0answers
90 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
2
votes
1answer
64 views

Control EIP with ASCII values

I'm trying to overwrite the EIP to cause a buffer overflow. I can write values to the EIP but I'm only able to write ASCII values and I need to redirect the execution to a high stack address e.g. ...
1
vote
1answer
140 views

Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition ...
0
votes
1answer
158 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
2
votes
0answers
64 views

How come buffer overflow happens in whatsapp like app, if canary exists

I recently read that whatsapp has fallen again to buffer overflow attacks. But I wonder, why canary protection isn't used. I guess that for some reason, Facebook, and other code companies don't use it ...
1
vote
1answer
81 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
3
votes
2answers
308 views

Why is a shell not spawning after a buffer overflow exploit?

I started learning about stack-smashing after it came up during a CTF exercise. I have been practicing on an ELF 32-bit executable that I received for the CTF. After disassembling the binary file, I ...
0
votes
0answers
17 views

The difference in address where EIP is stored and that of buffer doesn't quite add up. Please help

I am new to this field and have started learning Cyber Security. I am working on low level attacks and am working on an assignment. void put_wisdom(void) { char wis[DATA_SIZE] = {0}; int r; ...
1
vote
1answer
97 views

Buffer overflow, real life scenario [duplicate]

I've started my PWK Course, and now I'm on Buffer Overflow topic, which contains SLMail 5.5.0 exploitation. Buffer Overflow is so great interesting for me, but I can't imagine how would look real ...
2
votes
0answers
56 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
-1
votes
2answers
87 views

Buffer Overflow

I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
2answers
192 views

Is Objective C (really) affected by buffer overflows?

I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style"). I understand that Objective-C is based on C, but are there any ...
2
votes
0answers
65 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
1
vote
0answers
66 views

Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?

I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
1
vote
1answer
151 views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0
votes
0answers
51 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
0answers
38 views

Different gdb results

I'm trying to use overthewire narnia problems as a way to learn about binary exploitation and I'm getting different results than any of the walkthroughs I was looking at https://tuonilabs.wordpress....
4
votes
1answer
86 views

How are stack canaries padded by unmapped pages?

I was reading the wikipedia article on this subject and it states that when a program starts, the canary is calculated at random, stored in a local variable(which I presume was introduced by the ...
3
votes
1answer
168 views

Is buffer overflow the only way to take control of stack pointer?

I understand how buffer overflow works (in minimal knowledge), which create buffer overflow and take control of stack pointer, to make it execute whatever attacker wants. However, with my current ...
1
vote
1answer
99 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
2
votes
3answers
346 views

How does buffer overread cause arbitrary code execution?

Referenced in the recent VLC vulnerability and other places, apparently buffer overreads can cause arbitrary code execution. How does it do that? Suppose in the following toy example void badcpy(...
1
vote
1answer
97 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
1
vote
1answer
227 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
2
votes
3answers
209 views

Why is this not a buffer overflow?

I'm actually busy with learning more about buffer overflows. I read some interesting tutorials and just got the basic idea behind it. I tried to produce a vulnerable c++ file to test my knowledge ...
1
vote
1answer
260 views

What is the purpose of using hex escape sequences when writing buffer overflow exploits?

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian) #include <stdlib.h> #include <...
0
votes
0answers
85 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
1
vote
1answer
102 views

What can protect a C file from buffer overflows?

Looking around trying to answer my question i found those compilation parameters: PIE RelRO NX Heap exec Sf (source fortification) SSP ASLR (not a compilation parameter, i know) From what I ...
2
votes
1answer
83 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
2
votes
1answer
137 views

Should the shellcode be “reversed” before beeing injected in a simple buffer overflow?

I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts. My goal is to spawn a shell, so I found the asm code to do an execve("/...
1
vote
2answers
207 views

In Return-Oriented Programming how can the machine execute unaligned instructions?

I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)". The author claims that x86 code is like English written without punctuation or spaces, ...
0
votes
1answer
195 views

What does this opcode in my exploit code mean?

I'm trying to develop an already existing exploit for Windows XP. All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes. So far, I followed ...
3
votes
0answers
298 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
2
votes
0answers
274 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
0
votes
1answer
78 views

Inconsistent return address with telnet

I am trying to execute a shellcode in the configuration: No VA randomization (set to 0) Server is listening on port 9000 Terminal listening with netcast on port 31337 Server and attacker are the same ...
2
votes
0answers
146 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
1
vote
1answer
264 views

What is Return-Oriented Programming? [closed]

With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
1
vote
2answers
93 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
3
votes
1answer
247 views

Buffer overflow attack, executing an uncalled function

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a secret behind a locked .txt (read_secret()). vulnerable.c //no edits here #include <stdlib.h> #...
0
votes
0answers
29 views

Stack overwriting/overflow protection using memory page flags

In a stack overflow/overwriting attack(which primarily either executes code written to stack or changes flow of program by changing return address), the defenses seem to be marking stack code as "data"...
2
votes
0answers
236 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
2
votes
1answer
950 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...