Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
1 vote
1 answer
48 views

Why do I get a broken pipe when using pwntool with this C code

I am learning about Buffer Overflows (BOF) and came up with this piece of C code: #include <stdio.h> #include <stdlib.h> void win() { system("/bin/bash"); } int main() {...
user avatar
18 votes
6 answers
5k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
user avatar
  • 205
0 votes
0 answers
56 views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
user avatar
  • 1,227
3 votes
1 answer
82 views

Why does my RIP value change after overwriting via an overflow?

I've been working on a buffer overflow on a 64 bit Linux machine for the past few days. The code I'm attacking takes in a file. This original homework ran on a 32-bit system, so a lot is differing. I ...
user avatar
-2 votes
1 answer
79 views

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]

What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
user avatar
2 votes
1 answer
116 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
user avatar
  • 131
0 votes
1 answer
55 views

Buffer overflow not working from different environment

I wrote my first buffer overflow exploit and it worked well with ./vulnerable $(cat payload) but when I tried to launch it from a Python shell it didn't work import os os.system("./vulnerable $(...
user avatar
0 votes
1 answer
79 views

Why I can't perform buffer overflow directly from bash

Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work... Let's me explain with an example. Suppose we have a program written in c. This program has 2 ...
user avatar
  • 3
0 votes
0 answers
80 views

Data-only attack using buffer overflow

For school I need to use the buffer overflow in the program below to get the shell to launch. For this exercise we need to perform a data-only attack, i.e. the stack is non-executable and stack ...
user avatar
  • 101
0 votes
0 answers
79 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
user avatar
1 vote
0 answers
65 views

Addresses of two consecutive buffers

I have two buffers declared one after the another, like this: char A[256]; char B[32]; At first, I thought I could write whatever I wanted in B with a buffer overflow from A. However, some tests ...
user avatar
0 votes
0 answers
145 views

IS there any way to deal with a null byte canary?

I am playing with a binary with a known vulnerability, a stack overflow. I have been able to find the random bytes of the canary, but unfortunately one of them is 00 so I can't write it since the ...
user avatar
  • 1
0 votes
0 answers
81 views

How many canary values are there in a stack or buffer overflow?

Is there one value generated randomly at the start of the program and used in all the functions? One canary per function? One canary per function call, so it has to be generated each time a function ...
user avatar
  • 1
0 votes
0 answers
82 views

Jumping a function inside the code with buffer over flow

My goal is the jump a local function without calling it. Here is my code #include <stdio.h> void bufferoverflow() { printf("bufferoverlow!\n"); } void doSomething() { int ...
user avatar
0 votes
0 answers
111 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
user avatar
0 votes
2 answers
150 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
user avatar
1 vote
1 answer
71 views

Buffer overflow confusion, how do pre-return address payloads work despite stack clearence

I am trying to get deeper into buffer overflow and lower-level stuff in general and am confused regarding one particular topic. I have seen examples of buffer overflows in which the shellcode is ...
user avatar
0 votes
0 answers
118 views

Using msfvenom shellcodes on basic bof demonstration on syswow64 (win10 latest) leads to access violations and StackHash_2beb

I'm currently preparing a course on buffer overflows. The course takes place on the latest version of Windows 10 due to other constraints. Here is my experiment setup: I simulate a basic stack ...
user avatar
  • 131
1 vote
0 answers
194 views

How to find addresses and view stack in buffer overflow?

I am learning buffer overflow and I'm stuck. For the basic examples with very few variables we could spam the stack and kinda overwrite the return address etc. I am having difficulties examining the ...
user avatar
  • 11
0 votes
1 answer
444 views

Instead of JMP ESP can we use it's opcodes?

In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP ...
user avatar
3 votes
2 answers
369 views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
user avatar
  • 131
0 votes
1 answer
144 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
user avatar
0 votes
2 answers
95 views

Stack Smashing Short Problem

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
user avatar
0 votes
1 answer
160 views

Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment. I understand that writing more than 100 ...
user avatar
0 votes
0 answers
151 views

Trouble understanding buffer overflow to print a string

I have the following program: #include<stdio.h> int main() { int i=0; foo(); printf("Hello there!"); func(); } int foo(void) { char str[14]; strncpy(str,&...
user avatar
  • 21
0 votes
1 answer
127 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
user avatar
  • 101
2 votes
1 answer
107 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
user avatar
  • 176
0 votes
1 answer
120 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
user avatar
0 votes
0 answers
147 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
user avatar
  • 1
0 votes
1 answer
297 views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
user avatar
  • 141
4 votes
2 answers
187 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
user avatar
  • 2,012
-1 votes
1 answer
167 views

Do you have to be on the same WIFI for a Buffer Overflow attack to work?

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
user avatar
2 votes
1 answer
273 views

How can hackers find buffer overflow without source code?

I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
user avatar
2 votes
1 answer
282 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
user avatar
3 votes
1 answer
3k views

How to do string buffter overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
user avatar
2 votes
1 answer
671 views

BufferOverflow ESP too small for shellcode

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this. I ...
user avatar
0 votes
2 answers
95 views

Working code examples for stack or heap buffer overflows?

I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
user avatar
  • 29
1 vote
0 answers
101 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
user avatar
  • 23
-1 votes
1 answer
615 views

Doing buffer overflow attack without knowing buffer size and address

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is ...
user avatar
  • 21
1 vote
2 answers
216 views

Execution condition for buffer overflow

I have an old Beaglebone Black board which is similar to Raspberry Pi. Unfortunately, I forgot the Linux login password and can access the Linux using the Cloud9 feature. With this I can log into the ...
user avatar
  • 121
0 votes
1 answer
113 views

Does limiting size of images prevents buffer overflow?

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
user avatar
  • 1
0 votes
1 answer
199 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
user avatar
0 votes
2 answers
199 views

Basic questions about a buffer overflow attack example

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow #include <stdio.h> int main(){ int a[3]={0,1,2}; printf("...
user avatar
  • 125
0 votes
1 answer
699 views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
user avatar
1 vote
1 answer
506 views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
user avatar
  • 13
0 votes
0 answers
197 views

How to avoid segmentation fault in a buffer overflow exploit

I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
user avatar
0 votes
0 answers
398 views

Exploit stdin to call local function in C

Note: this is extra credit for a homework assignment I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
user avatar
  • 1
3 votes
1 answer
158 views

Having trouble with learning Buffer Overflows

So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
user avatar
1 vote
1 answer
124 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
user avatar
  • 121
0 votes
1 answer
367 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
user avatar

1
2 3 4 5
10