Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
0
votes
1answer
28 views

Esp changes to different (incorrect) value when overwritten

I am attempting to overwrite the eip of a binary (in order to perform a ret2libc attack). The program has full relro, PIE and NX. Here's my thought process. First I try this, I input "C"*260 + "...
0
votes
0answers
25 views

Cannot overwrite eip in order to carry out ret2libc attack

I have a binary file vulnerable to a format strings attack with the following protections: (Full relro, NX and PIE) I have managed to find the libc version and hence the address of system and bin/sh ...
2
votes
1answer
70 views

segmentation fault at strcpy while perforforming a buffer overflow

I have this code that I need to use to perform a ret2libc #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buf[256]; printf("buff is at:%p\n",buf); ...
-1
votes
0answers
9 views

How may bytes should you send for buffer overflow? [duplicate]

If someone is trying to hack a laptop with buffer overflow how would he know the specific amount of bytes you are supposed to send to that laptop in order to cause buffer overflow?
1
vote
0answers
47 views

What is this “prepare” variable used for in this SEH based buffer overflow payload?

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
1
vote
1answer
81 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
63 views

Understanding why this buffer overflow attack isn't working

I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
2
votes
1answer
102 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
1
vote
1answer
78 views

Cannot execute shellcode using buffer overflow

As a home exercise I'm trying to achieve buffer overflow attack by running a simple char array program that stores the input argument in the program stack and then overflowing that stack with long ...
2
votes
2answers
70 views

Overwrite eip twice for buffer overflow?

So I have a binary I've been tasked with exploiting. However, I need to have root privileges to execute a function in it that (hopefully) gives the password. There is a function in the program that ...
0
votes
2answers
101 views

C Security Code Review

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
114 views

How to find buffer offset for Return to Libc Attack

I am trying to find the buffer for where the implement my buffer overflow attack The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf How I find X Y Z in a ...
0
votes
0answers
33 views

how to get this into a stack oveflow performed into integer overflow?

I'm trying to understand stack buffer overflow performed by an integer overflow , and am working with a simple piece of code, as below, but however I am not sure how can I add to this code an integer ...
1
vote
1answer
55 views

Dealing with a large number of bad chars

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
0
votes
1answer
82 views

How many actions do you need to take to disable DEP

I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works. The application is a C++ app written in visual studio and I am running into ...
1
vote
0answers
136 views

Buffer bomb level 3 - Prevent stack corruption

I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
98 views

EIP pointing to shellcode but shellcode is not executing?

I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
0
votes
1answer
92 views

Overwrite pointer with an address

struct record { char name[24]; char * message; }; int main() { puts("GOT Overwrite"); // Create the struct record struct record student; strcpy(student.name, "Alice"); student.message = (char *) ...
2
votes
1answer
134 views

Should security canaries be short?

I had an exam question on why security canaries should be short. I suspect that is so that the attacker has a harder time finding the canary. Is that right?
0
votes
0answers
63 views

memcpy() in device/program with jemalloc allocator does not crash

Managed to get signed length value to memcpy() 02-16 01:44:49.096 6423 6471 W bt_hci_packet_fragmenter: reassemble_and_dispatch reassemble_and_dispatch 02-16 01:44:49.096 6423 6471 W ...
1
vote
0answers
90 views

Stack Smashing Challenge

I know what I need to do in this challenge, but I am completely lost on how to do the first crucial step. What needs to happen is that I need to overwrite the global structure variable pin_len, which ...
2
votes
1answer
150 views

Jumping to shellcode: Blind return

In famous buffer overflow tutorial by Corelan Team (part 2) a technique called "blind return" is mentioned. So if you overwrite EIP with the address that will perform a RET instruction, you will ...
1
vote
0answers
164 views

Is overbuffered done on 10th byte past alocated space?

I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
0
votes
0answers
55 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
0
votes
1answer
108 views

Buffer Overflow PoC code \x11(setup sound

I am reading the PWK course book, the chapter of Linux Buffer Overflow: Once the crossfire application is running, we can use the following Proof of Concept (PoC) code, found on the Exploit ...
0
votes
2answers
231 views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
2
votes
2answers
123 views

Cannot build a ROP chain

My ROP exploit crashes with segmentation fault for unknown reason. This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2): #include <stdio.h> #include ...
1
vote
0answers
57 views

Can a heap/mmap buffer overflow overwrite the stack

The following questions regard linux processes with a stack that grows downwards from the end of the process memory. If I have a buffer overflow on the heap with unlimited size, are there any ...
1
vote
1answer
114 views

64bit buffer overflow fails with SIGILL, cannot understand the reason

I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z ...
0
votes
0answers
11 views

How Could a Buffer Overflow be Used to Execute Code? [duplicate]

I've heard a lot about buffer overflows, and I understand the basic concept, but I would like to know exactly how buffer overflow vulnerabilities are used to execute code? Because, if an attacker were ...
1
vote
2answers
174 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
0
votes
1answer
146 views

In Buffer overflow exploitation what if JMP ESP address contains bad characters?

I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP ...
0
votes
1answer
111 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
45
votes
3answers
8k views

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Since buffer overflows always let an evil hacker write outside the buffer and overwrite the return pointer to a shellcode the evil hacker can place, does it mean that successful exploitation of a ...
0
votes
0answers
98 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
2
votes
1answer
91 views

Control EIP with ASCII values

I'm trying to overwrite the EIP to cause a buffer overflow. I can write values to the EIP but I'm only able to write ASCII values and I need to redirect the execution to a high stack address e.g. ...
2
votes
1answer
192 views

Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition ...
0
votes
1answer
172 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
2
votes
0answers
66 views

How come buffer overflow happens in whatsapp like app, if canary exists

I recently read that whatsapp has fallen again to buffer overflow attacks. But I wonder, why canary protection isn't used. I guess that for some reason, Facebook, and other code companies don't use it ...
1
vote
3answers
135 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
3
votes
2answers
794 views

Why is a shell not spawning after a buffer overflow exploit?

I started learning about stack-smashing after it came up during a CTF exercise. I have been practicing on an ELF 32-bit executable that I received for the CTF. After disassembling the binary file, I ...
0
votes
0answers
50 views

The difference in address where EIP is stored and that of buffer doesn't quite add up. Please help

I am new to this field and have started learning Cyber Security. I am working on low level attacks and am working on an assignment. void put_wisdom(void) { char wis[DATA_SIZE] = {0}; int r; ...
1
vote
1answer
106 views

Buffer overflow, real life scenario [duplicate]

I've started my PWK Course, and now I'm on Buffer Overflow topic, which contains SLMail 5.5.0 exploitation. Buffer Overflow is so great interesting for me, but I can't imagine how would look real ...
2
votes
0answers
61 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
-1
votes
2answers
95 views

Buffer Overflow

I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
2answers
235 views

Is Objective C (really) affected by buffer overflows?

I'm trying to find a buffer overflow sample code in Objective-C but the only samples I found are written in C (without "bracket style"). I understand that Objective-C is based on C, but are there any ...
2
votes
0answers
83 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
1
vote
0answers
111 views

Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?

I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
1
vote
1answer
256 views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0
votes
0answers
62 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...

1
2 3 4 5
9