Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
0
votes
0answers
52 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
0
votes
0answers
63 views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
3
votes
1answer
107 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
-1
votes
1answer
71 views

Do you have to be on the same WIFI for a Buffer Overflow attack to work?

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
2
votes
1answer
138 views

How can hackers find buffer overflow without source code?

I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
2
votes
1answer
53 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
0
votes
0answers
59 views

Ret2libc attack with DEP and ASLR - offset confusion

I'm following a course on exploit devlopment. I got the general idea but in the real world I'm a bit lost regarding the offset calculation part. Context I have to design a ret2libc attack on a ...
2
votes
1answer
222 views

How to do string buffter overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
0
votes
0answers
41 views

Exploiting buffer overflow in 64-bit macOS executable

I'm following this tutorial to create a buffer overflow demo. The article illustrates a 32-bit executable, but I'm feeling adventurous and decided to do a 64-bit one. Below is the deliberately ...
1
vote
1answer
159 views

BufferOverflow ESP too small for shellcode

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this. I ...
0
votes
2answers
49 views

Working code examples for stack or heap buffer overflows?

I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
0
votes
0answers
44 views

Is it possible to pass hexadecimal chars to edb-debugger?

I'm trying to find bad chars using edb-debugger. When I open the binary through file --> Open I add the string which causes the program to crash as program arguments value. Anyway I don't know how ...
1
vote
0answers
59 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
0
votes
0answers
133 views

Doing buffer overflow attack without knowing buffer size and address

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is ...
1
vote
2answers
117 views

Execution condition for buffer overflow

I have an old Beaglebone Black board which is similar to Raspberry Pi. Unfortunately, I forgot the Linux login password and can access the Linux using the Cloud9 feature. With this I can log into the ...
0
votes
1answer
43 views

Does limiting size of images prevents buffer overflow?

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
0
votes
1answer
66 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
0
votes
2answers
96 views

Basic questions about a buffer overflow attack example

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow #include <stdio.h> int main(){ int a[3]={0,1,2}; printf("...
0
votes
1answer
242 views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
1
vote
1answer
201 views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
0
votes
0answers
79 views

How to avoid segmentation fault in a buffer overflow exploit

I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
0
votes
0answers
128 views

Exploit stdin to call local function in C

Note: this is extra credit for a homework assignment I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
3
votes
1answer
100 views

Having trouble with learning Buffer Overflows

So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
1
vote
1answer
52 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
0
votes
1answer
285 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
0
votes
0answers
42 views

Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]

Background In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
1
vote
1answer
619 views

vulnserver - Can't find JMP ESP in ntdll.dll

This tutorial shows how to find a JMP ESP in nttdll.dll http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/ Find address for EIP In this step we have to check the registers and ...
0
votes
0answers
42 views

buffer overflow exploit: vulnserver with additional 20 bytes of data?

Vulnserver is a multithreaded Windows based TCP server that listens for client connections on port 9999 (by default) and allows the user to run a number of different commands that are vulnerable to ...
0
votes
1answer
194 views

How do you adjust offest and kernel stack size from an exploit?

Needless to I say I have no idea how to do this. I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298 In the exploit comments, the author said : ...
1
vote
4answers
345 views

Are buffer overflows pretty much a thing of the past in 2020

After learning about buffer overflows: In the 90's finding a buffer overflow nearly always meant you could exploit it. Nowadays there are a lot of protection mechanisms like address layout space ...
0
votes
0answers
32 views

Where does the SP (Stack Pointer) point to when the buffer is overflown?

Let's consider a stack that grows downwards and a function that has a local variable for a buffer that takes 100 bytes of memory. So, reading from top to bottom, it would be a 4-byte long return ...
0
votes
0answers
100 views

Problem with return 2 libc in 64 bit arch

I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143): cbcd8: 00 00 cbcda: 4c 89 ea ...
26
votes
2answers
7k views

Is there any security risk in not setting a maximum password length?

I'm a listener of the podcast "Security Now" where they often claim that there are no reasons to limit the number of characters a user can use in their passwords when they create an account ...
0
votes
1answer
75 views

BufferOverFlow - How come ESP points to the end of the payload

I just don't understand how ESP points to the shellcode let's say we've sent this string string = 100 * 'A' + 'BBBB' + 'CCCC' I have filled the stack with 'AAAA..' and overwritten the EIP value and ...
0
votes
0answers
135 views

Bypass ASLR in buffer overflow

Iam new in buffer overflow and i have some questions : Is all dll files in windows are loaded at memory or some of them only , If some of them , Who tell windows to load this and leave this How an ....
2
votes
2answers
155 views

Are call stack addresses predictable with all protections disabled?

I'm currently practicing buffer overflows, but there is one thing I don't understand yet. I have read this similar question. I understand that if you don't know the address of ESP you must look for an ...
1
vote
1answer
208 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
8
votes
1answer
393 views

How can I exploit a Buffer Overflow on a Raspberry Pi 4?

I am trying to exploit a bufferoverflow on raspberry pi 4 which makes use of Cortex-A72 (ARM v8) 64-bit SoC. The linux kernel version is v4.19 and the OS a Debian Buster compiled for the raspberry pi ...
0
votes
3answers
452 views

Buffer overflow with zeros

I'm starting to learn about buffer overflow, and I'm trying to change the contents of the return address to a specific location using gdb, but the problem is that the address starts with some zeros. ...
0
votes
1answer
127 views

Esp changes to different (incorrect) value when overwritten

I am attempting to overwrite the eip of a binary (in order to perform a ret2libc attack). The program has full relro, PIE and NX. Here's my thought process. First I try this, I input "C"*260 + "...
2
votes
1answer
451 views

segmentation fault at strcpy while perforforming a buffer overflow

I have this code that I need to use to perform a ret2libc #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buf[256]; printf("buff is at:%p\n",buf); ...
1
vote
0answers
56 views

What is this “prepare” variable used for in this SEH based buffer overflow payload?

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
1
vote
1answer
103 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
109 views

Understanding why this buffer overflow attack isn't working

I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
2
votes
1answer
396 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
1
vote
1answer
391 views

Cannot execute shellcode using buffer overflow

As a home exercise I'm trying to achieve buffer overflow attack by running a simple char array program that stores the input argument in the program stack and then overflowing that stack with long ...
2
votes
2answers
288 views

Overwrite eip twice for buffer overflow?

So I have a binary I've been tasked with exploiting. However, I need to have root privileges to execute a function in it that (hopefully) gives the password. There is a function in the program that ...
0
votes
3answers
179 views

C Security Code Review

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
629 views

How to find buffer offset for Return to Libc Attack

I am trying to find the buffer for where the implement my buffer overflow attack The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf How I find X Y Z in a ...

1
2 3 4 5
10