Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
2
votes
0answers
46 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
1
vote
0answers
21 views

Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?

I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
1
vote
1answer
52 views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0
votes
0answers
40 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
0answers
31 views

Different gdb results

I'm trying to use overthewire narnia problems as a way to learn about binary exploitation and I'm getting different results than any of the walkthroughs I was looking at https://tuonilabs.wordpress....
4
votes
1answer
74 views

How are stack canaries padded by unmapped pages?

I was reading the wikipedia article on this subject and it states that when a program starts, the canary is calculated at random, stored in a local variable(which I presume was introduced by the ...
3
votes
1answer
128 views

Is buffer overflow the only way to take control of stack pointer?

I understand how buffer overflow works (in minimal knowledge), which create buffer overflow and take control of stack pointer, to make it execute whatever attacker wants. However, with my current ...
1
vote
1answer
79 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
2
votes
3answers
174 views

How does buffer overread cause arbitrary code execution?

Referenced in the recent VLC vulnerability and other places, apparently buffer overreads can cause arbitrary code execution. How does it do that? Suppose in the following toy example void badcpy(...
1
vote
1answer
66 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
1
vote
1answer
93 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
2
votes
3answers
200 views

Why is this not a buffer overflow?

I'm actually busy with learning more about buffer overflows. I read some interesting tutorials and just got the basic idea behind it. I tried to produce a vulnerable c++ file to test my knowledge ...
1
vote
1answer
125 views

What is the purpose of using hex escape sequences when writing buffer overflow exploits?

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian) #include <stdlib.h> #include <...
0
votes
0answers
47 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
1
vote
1answer
97 views

What can protect a C file from buffer overflows?

Looking around trying to answer my question i found those compilation parameters: PIE RelRO NX Heap exec Sf (source fortification) SSP ASLR (not a compilation parameter, i know) From what I ...
1
vote
1answer
60 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
2
votes
1answer
77 views

Should the shellcode be “reversed” before beeing injected in a simple buffer overflow?

I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts. My goal is to spawn a shell, so I found the asm code to do an execve("/...
1
vote
2answers
185 views

In Return-Oriented Programming how can the machine execute unaligned instructions?

I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)". The author claims that x86 code is like English written without punctuation or spaces, ...
0
votes
1answer
133 views

What does this opcode in my exploit code mean?

I'm trying to develop an already existing exploit for Windows XP. All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes. So far, I followed ...
3
votes
0answers
179 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
2
votes
0answers
210 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
0
votes
1answer
76 views

Inconsistent return address with telnet

I am trying to execute a shellcode in the configuration: No VA randomization (set to 0) Server is listening on port 9000 Terminal listening with netcast on port 31337 Server and attacker are the same ...
1
vote
0answers
115 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
1
vote
1answer
216 views

What is Return-Oriented Programming? [closed]

With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
1
vote
2answers
79 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
1
vote
0answers
184 views

Buffer overflow attack, executing an uncalled function

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a secret behind a locked .txt (read_secret()). vulnerable.c //no edits here #include <stdlib.h> #...
0
votes
0answers
25 views

Stack overwriting/overflow protection using memory page flags

In a stack overflow/overwriting attack(which primarily either executes code written to stack or changes flow of program by changing return address), the defenses seem to be marking stack code as "data"...
2
votes
0answers
166 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
1
vote
1answer
400 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
0
votes
0answers
51 views

Heap bugs - extinct now?

I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5. While doing my ...
1
vote
1answer
140 views

How to exploit this buffer overflow. Where is the return address?

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code: Code that I need help with:: #include <stdio.h> int ...
1
vote
0answers
85 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
1
vote
3answers
875 views

Buffer Overflow example - strcpy

Practicing and learning buffer overflows by example. I have a question of why a particular buffer overflow is not working with strcpy(). I can trigger the buffer overflow segfault with gets() in ...
0
votes
1answer
102 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
1
vote
2answers
97 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
4
votes
1answer
3k views

Concept of Jump-Oriented-Programming (JOP)

I don't understand the concept of Jump-Oriented-Programming. Can somebody try and explain this to me in an easy to understand way? I see that JOP is a concept that has evolved due to security ...
2
votes
0answers
67 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
3
votes
1answer
269 views

Where in a binary can '/bin/sh' be written to get a shell?

I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it. The CTF challenge was the can-you-gets-me challenge in ...
-1
votes
2answers
283 views

Buffer Overflow not working?

Basically I am trying to exploit a buffer overflow, but unfortunately I am not able to get shell. Script buf.c: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]){ ...
2
votes
1answer
84 views

Can stack overflow be prevented by pushing return address first?

I feel that this is a really dumb and obvious questions, but I haven't found any answers online. I mean the textbook example of buffer overflow is done by memcpy into a limited size buffer on stack. ...
0
votes
2answers
157 views

How to prevent buffer overflow attack?

int main(void) { char buff[15]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if (strcmp(buff, "thegeekstuff")) { printf("\n Wrong Password \n"); } ...
1
vote
0answers
250 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
3
votes
0answers
128 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
1
vote
1answer
307 views

Return-oriented programming: Address of system() contains NULL byte

Disclaimer: I am asking this question solely for educational purposes. I am trying to chain some function calls using return-oriented programming, exploiting a vulnerable binary which uses strcpy(). ...
1
vote
1answer
421 views

Can't overwrite rip with address in simple buffer overflow (Ubuntu x64)

I wrote a simple c program in order to test an buffer overflow. My goal is to overwrite the rip so it points to the beginning of the buffer. The code: #include <stdio.h> #include <string.h&...
1
vote
0answers
52 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
531 views

How does this simple buffer overflow work?

I've got this simple code vuln.c #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buffer[500]; strcpy(buffer, argv[1]); printf("%s", buffer); ...
1
vote
0answers
371 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
2
votes
1answer
578 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
1
vote
1answer
60 views

Buffer Overflow shell question

If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...