Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

0
votes
0answers
24 views

Buffer overflow return address with null byte, workaround

Practising BO using Free Float FTP Server 1.0 on Windows 7 SP1, done simple jmp esp examples on Win XP where system DLL are without rebase or ASLR, trying to write one for Win7 where I haven't got any ...
0
votes
1answer
39 views

How to make a buffer overflow run shell? [on hold]

I have a simple C program that asks for two inputs I'm trying to overflow them so that I can access a shell, but I'm not sure what I need to do to access the shell. I can overflow them to just print ...
0
votes
1answer
70 views

Inconsistent return address with telnet

I am trying to execute a shellcode in the configuration: No VA randomization (set to 0) Server is listening on port 9000 Terminal listening with netcast on port 31337 Server and attacker are the same ...
1
vote
0answers
79 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
1
vote
1answer
73 views

What is Return-Oriented Programming? [closed]

With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
1
vote
2answers
69 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
-1
votes
0answers
68 views

Buffer overflow attack, getting password from locked text file

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a password behind a locked .txt contains the password. I shouldn't need to use GDB for this. vuln.c //no ...
1
vote
0answers
76 views

Buffer overflow attack, executing an uncalled function

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a secret behind a locked .txt (read_secret()). vulnerable.c //no edits here #include <stdlib.h> #...
0
votes
0answers
21 views

Stack overwriting/overflow protection using memory page flags

In a stack overflow/overwriting attack(which primarily either executes code written to stack or changes flow of program by changing return address), the defenses seem to be marking stack code as "data"...
2
votes
0answers
62 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
1
vote
1answer
130 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
0
votes
0answers
42 views

Heap bugs - extinct now?

I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5. While doing my ...
1
vote
0answers
50 views

How to exploit this buffer overflow. Where is the return address?

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code: Code that I need help with:: #include <stdio.h> int ...
1
vote
0answers
75 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
1
vote
3answers
276 views

Buffer Overflow example - strcpy

Practicing and learning buffer overflows by example. I have a question of why a particular buffer overflow is not working with strcpy(). I can trigger the buffer overflow segfault with gets() in ...
0
votes
1answer
51 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
1
vote
2answers
72 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
2
votes
1answer
647 views

Concept of Jump-Oriented-Programming (JOP)

I don't understand the concept of Jump-Oriented-Programming. Can somebody try and explain this to me in an easy to understand way? I see that JOP is a concept that has evolved due to security ...
2
votes
0answers
56 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
3
votes
1answer
153 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
-1
votes
2answers
127 views

Buffer Overflow not working?

Basically I am trying to exploit a buffer overflow, but unfortunately I am not able to get shell. Script buf.c: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]){ ...
2
votes
1answer
82 views

Can stack overflow be prevented by pushing return address first?

I feel that this is a really dumb and obvious questions, but I haven't found any answers online. I mean the textbook example of buffer overflow is done by memcpy into a limited size buffer on stack. ...
0
votes
2answers
128 views

How to prevent buffer overflow attack?

int main(void) { char buff[15]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if (strcmp(buff, "thegeekstuff")) { printf("\n Wrong Password \n"); } ...
1
vote
0answers
160 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
3
votes
0answers
78 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
1
vote
1answer
177 views

Return-oriented programming: Address of system() contains NULL byte

Disclaimer: I am asking this question solely for educational purposes. I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses strcpy(). ...
1
vote
1answer
178 views

Can't overwrite rip with address in simple buffer overflow (Ubuntu x64)

I wrote a simple c program in order to test an buffer overflow. My goal is to overwrite the rip so it points to the beginning of the buffer. The code: #include <stdio.h> #include <string.h&...
1
vote
0answers
40 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
247 views

How does this simple buffer overflow work?

I've got this simple code vuln.c #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buffer[500]; strcpy(buffer, argv[1]); printf("%s", buffer); ...
1
vote
0answers
235 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
2
votes
1answer
406 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
1
vote
1answer
43 views

Buffer Overflow shell question

If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...
2
votes
1answer
52 views

Buffer Overflow protections in custom library

Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
2
votes
1answer
63 views

How do you test buffer overflows in the lab?

I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
1
vote
0answers
255 views

How to find the return address when performing an overflow

for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
2
votes
0answers
236 views

Not able to run the injected shellcode

#include <stdio.h> void secret() { printf("Congratulations!\n"); } void echo() { char array[60]; scanf("%s", array); printf("You entered: %s\n", array); } int main() { ...
1
vote
0answers
133 views

About buffer overflow Win 10 x64

In my job as a system administrator I developed a C program that can handle links like intranet:// from the browser. The software can open ie or url like this intranet ://ie. The url is the same for ...
0
votes
1answer
420 views

Buffer overflow exploit is leading to Segmentation Fault

#include<stdio.h> void secret(){ printf("entered secret function"); } void return_input() { char array[60]; scanf("%s", array); printf("%s\n",array); } int main() { return_input(); ...
2
votes
1answer
419 views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
2
votes
0answers
104 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
2
votes
2answers
213 views

Are managed programming languages immune to arbitrary code execution exploits?

Classic example of arbitrary code execution is when a stack based buffer overflows, overwrites the return address so the control can jump into the attacker's carefully set up data to execute a shell ...
1
vote
0answers
93 views

buffer overflow 64 bit issue

I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. ...
1
vote
0answers
199 views

Buffer overflow experiment: shell code executed but got “failed to read 0 bytes” error

I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
0
votes
2answers
253 views

Buffer Overflow : segmentation error at 0x90909090

why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ? 0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff040: ...
2
votes
2answers
449 views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
2
votes
0answers
48 views

Enclosing piped commands in parentheses *WARGAME SPOILERS*

This problem is "bof" taken from http://pwnable.kr. I was playing around with different payloads, increasing by 4 trash bytes each and searching around for ways to bypass stack smashing canaries. ...
0
votes
0answers
38 views

SEH buffer overflow testing problem

I am testing SEH buffer overflow. My payload format is shellcde+nseh+seh. SEH is address to pop pop ret. NSEH is negative jump to shellocde. But it does not work properly. First it goes to pop pop ...
1
vote
1answer
223 views

Developing MIPS exploit in python memory address getting parse as a value [closed]

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem. below is the HTTP request which occurs the crash POST /...
1
vote
0answers
62 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
2
votes
2answers
536 views

Unable to understand $EIP changes with Buffer Overflow

I am learning Buffer Overflow, so the question might seem silly but here it is. I started with this very simple buggy program int main(int argc, char *argv[]) { char buf[128]; printf("You entered ...