Questions tagged [buffer-overflow]
A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.
503
questions
1
vote
0
answers
19
views
How to properly pack address into bytes to overwrite EIP register
I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html
I am very close to ...
- 111
0
votes
0
answers
73
views
Problem exploiting buffer overflow
I have the following program in C:
#include <stdio.h>
#include <string.h>
void some_function(char * name) {
char buf[128];
strcpy(buf, "The next step is... ");
strcat(...
- 3
1
vote
0
answers
91
views
Buffer Overflow Attack when size of Buffer is small on 64bit CPU architecture
I was trying to solve the Buffer Overflow SetUID lab but stuck in Task 6: L4, to perform the attack when the Buffer Size is small 10.
I understood that since len(shellcode) would be larger the ...
- 11
0
votes
1
answer
210
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
0
votes
0
answers
64
views
Specifying an integer within the maximum of an unsigned 64-bit integer does **not** cause a buffer overflow
The program I am working with has a POC published for it, but not a full explanation. I have been told by my mentor (I am part of a research program) to disclose as little information as possible ...
- 1
0
votes
1
answer
157
views
Buffer Overflow not working. Don't know why?
Here's the output:
pwndbg> p give_shell
$5 = {void ()} 0x8049217 <give_shell>
So if I write this payload python2 -c "print 'A'*104 + '\x1B\x92\x04\x08' + '\x17\x92\x04\x08'" > ...
- 101
1
vote
0
answers
71
views
bufferoverflow chars gets replaced on stack
So I try to understand stack based buffer-overflow but now I am stuck. This is the vulnerable function (32 bit ELF).
int test(char* input)
{
char buf[100];
printf("Buffer is at %p\n",...
- 11
0
votes
0
answers
216
views
Help creating an exploit for CVE-2019-11500
I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
- 1
0
votes
0
answers
207
views
Anyone can help with this buffer ovewrflow (ctf) question?
I am new to bufferoverflow and was told that this code can lead to a buffer overflow.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/sha.h>
#...
- 1
0
votes
0
answers
192
views
Program segfaults when ran with GDB
this is my first time posting a question here, so forgive me if I don't give enough details. I will provide any extra details that are requested.
Basically, I'm practicing a buffer overflow, and I'm ...
1
vote
1
answer
243
views
Buffer overflow stops executing shellcode in the middle of it
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:...
- 121
0
votes
0
answers
184
views
Could it be suspicious if I see a lot of buffer overflows in Process Monitor, among the processes of Microsoft Defender for Endpoint network scanner?
I see a LOT of buffer overflows in Process Monitor, and it is also among processes that are responsible for the security of the machine.
The program ran for 2-3 minutes, and 16751 out of 773514 events ...
- 39
1
vote
0
answers
45
views
Is there any combination of memory mitigations COOP doesn't bypass?
I recently seen a paper where COOP exploit dev was used to bypass DEP+ASLR+CET+CFG+SEHOP. JIT attack surfaces like v8 seem to have even less hardening. Is there a form of exploitable memory corruption ...
- 11
0
votes
1
answer
207
views
64-bit ROP-based Buffer Overflow Attack
I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below:
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/...
1
vote
1
answer
304
views
Is obtaining a shell from this buffer overflow possible?
I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address.
In these cases, you can hijack a ...
- 230
1
vote
0
answers
167
views
Buffer overflow on a program that only accepts arguments as input
I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, ...
- 11
1
vote
2
answers
773
views
Finding offset using Buffer overflow pattern generator
I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator
#include <stdio.h>
#include <string.h>
int main (int argc, ...
- 11
0
votes
0
answers
146
views
Buffer Overflow with ROP Chain Output Problem
I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output.
I want to stop the printf() call in the vuln function to get ...
0
votes
1
answer
1k
views
Why do I get a broken pipe when using pwntool with this C code
I am learning about Buffer Overflows (BOF) and came up with this piece of C code:
#include <stdio.h>
#include <stdlib.h>
void win()
{
system("/bin/bash");
}
int main()
{...
20
votes
6
answers
8k
views
Do high level languages allow for buffer / heap overflow?
I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
- 235
0
votes
0
answers
1k
views
Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP
While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark:
[Malformed Packet: Laplink: length of contained item exceeds length of containing ...
- 1,237
4
votes
1
answer
464
views
Why does my RIP value change after overwriting via an overflow?
I've been working on a buffer overflow on a 64 bit Linux machine for the past few days. The code I'm attacking takes in a file. This original homework ran on a 32-bit system, so a lot is differing. I ...
-2
votes
1
answer
447
views
What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]
What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
2
votes
1
answer
170
views
Avoid stack addresses containing zeros
I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).
...
- 131
1
vote
1
answer
159
views
Buffer overflow not working from different environment
I wrote my first buffer overflow exploit and it worked well with
./vulnerable $(cat payload)
but when I tried to launch it from a Python shell it didn't work
import os
os.system("./vulnerable $(...
0
votes
1
answer
508
views
Why I can't perform buffer overflow directly from bash
Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work...
Let's me explain with an example.
Suppose we have a program written in c.
This program has 2 ...
- 25
0
votes
0
answers
288
views
64 Bit ELF Buffer Overflow Not working possibly due to if statement
I wrote the following:
#include <stdio.h>
int win(){
printf("Won!\n");
return 0;
}
int vulnerable(){
char buffer[20];
memset(buffer, 0, 10);
printf("Input: &...
0
votes
0
answers
85
views
Addresses of two consecutive buffers
I have two buffers declared one after the another, like this:
char A[256];
char B[32];
At first, I thought I could write whatever I wanted in B with a buffer overflow from A. However, some tests ...
0
votes
0
answers
409
views
Jumping a function inside the code with buffer over flow
My goal is the jump a local function without calling it. Here is my code
#include <stdio.h>
void bufferoverflow()
{
printf("bufferoverlow!\n");
}
void doSomething()
{
int ...
- 1
0
votes
2
answers
622
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 191
1
vote
1
answer
93
views
Buffer overflow confusion, how do pre-return address payloads work despite stack clearence
I am trying to get deeper into buffer overflow and lower-level stuff in general and am confused regarding one particular topic. I have seen examples of buffer overflows in which the shellcode is ...
- 13
1
vote
0
answers
685
views
How to find addresses and view stack in buffer overflow?
I am learning buffer overflow and I'm stuck. For the basic examples with very few variables we could spam the stack and kinda overwrite the return address etc.
I am having difficulties examining the ...
- 11
0
votes
1
answer
2k
views
Instead of JMP ESP can we use it's opcodes?
In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP ...
2
votes
2
answers
1k
views
ROP executes system("/bin/sh") but does not attach to it
Here is the code:
import struct
buf = ""
buf += "A" * 552
buf += struct.pack('<Q', 0x401493) # pop rdi; ret
buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh
buf += ...
- 121
0
votes
1
answer
401
views
Buffer overread
I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
0
votes
2
answers
209
views
Stack Smashing Short Problem
I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
0
votes
1
answer
368
views
Exploting a Stack Buffer Overflow vulnerability to get privilege access to system
I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment.
I understand that writing more than 100 ...
0
votes
1
answer
451
views
Segfault after reaching system
I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle.
I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
- 101
1
vote
1
answer
174
views
How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?
I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
- 166
0
votes
1
answer
341
views
Bufferoverflow for small return address
I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload
(...
0
votes
0
answers
471
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
1
vote
1
answer
938
views
Can't overwrite EIP in bufferoverflow example
I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it.
However, ...
- 181
4
votes
2
answers
262
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 2,042
-1
votes
1
answer
273
views
Do you have to be on the same WIFI for a Buffer Overflow attack to work?
I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
2
votes
1
answer
599
views
How can hackers find buffer overflow without source code?
I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
- 55
2
votes
1
answer
494
views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
- 177
4
votes
1
answer
10k
views
How to do string buffer overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
- 177
2
votes
1
answer
2k
views
BufferOverflow ESP too small for shellcode
I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.
I ...
- 21
0
votes
2
answers
137
views
Working code examples for stack or heap buffer overflows?
I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
- 29
1
vote
0
answers
114
views
Question on stack overflow
I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
- 23