Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
1 vote
0 answers
20 views

Can't print hexadecimal formatted address in buffer overflow

I'm trying to overwrite the return address caused by a buffer overflow. I've already calculated the distance between the buffer and the return address. The address that I want to jump to is ...
CJG's user avatar
  • 71
0 votes
1 answer
72 views

Simple Buffer Overflow (Function Call) Problem

I'm trying to develop a simple buffer overflow CTF challenge inspired by the "Csaw 2016 Quals Warmup" challenge, here. I've managed to replicate the source code: #include <stdio.h> #...
FreezeLuiz's user avatar
0 votes
0 answers
82 views

push /bin/sh to get a shell

I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one : Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
tpau's user avatar
  • 1
0 votes
1 answer
90 views

How to return to main after performing stack buffer overflow

#include <stdio.h> #include <stdlib.h> void reading(); void reading_hexa(char*); void secret(); int main() { reading(); printf("Input done\n"); exit(0); } void ...
user88178's user avatar
1 vote
0 answers
102 views

How to properly pack address into bytes to overwrite EIP register

I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html I am very close to ...
Jay's user avatar
  • 111
0 votes
0 answers
122 views

Problem exploiting buffer overflow

I have the following program in C: #include <stdio.h> #include <string.h> void some_function(char * name) { char buf[128]; strcpy(buf, "The next step is... "); strcat(...
Jan's user avatar
  • 3
1 vote
0 answers
278 views

Buffer Overflow Attack when size of Buffer is small on 64bit CPU architecture

I was trying to solve the Buffer Overflow SetUID lab but stuck in Task 6: L4, to perform the attack when the Buffer Size is small 10. I understood that since len(shellcode) would be larger the ...
SpEcHiDe's user avatar
0 votes
1 answer
451 views

Unable to execute shellcode on x86_64 architecture

I currently got interested in binary exploitation (even though I do not know if today is still useful). I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
KmerPadreDiPdor's user avatar
0 votes
0 answers
138 views

Specifying an integer within the maximum of an unsigned 64-bit integer does **not** cause a buffer overflow

The program I am working with has a POC published for it, but not a full explanation. I have been told by my mentor (I am part of a research program) to disclose as little information as possible ...
MrCaters's user avatar
0 votes
1 answer
252 views

Buffer Overflow not working. Don't know why?

Here's the output: pwndbg> p give_shell $5 = {void ()} 0x8049217 <give_shell> So if I write this payload python2 -c "print 'A'*104 + '\x1B\x92\x04\x08' + '\x17\x92\x04\x08'" > ...
NobinPegasus's user avatar
1 vote
1 answer
133 views

bufferoverflow chars gets replaced on stack [closed]

So I try to understand stack based buffer-overflow but now I am stuck. This is the vulnerable function (32 bit ELF). int test(char* input) { char buf[100]; printf("Buffer is at %p\n",...
atcheckmate's user avatar
0 votes
0 answers
407 views

Help creating an exploit for CVE-2019-11500

I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
pwhx's user avatar
  • 1
0 votes
0 answers
338 views

Program segfaults when ran with GDB

this is my first time posting a question here, so forgive me if I don't give enough details. I will provide any extra details that are requested. Basically, I'm practicing a buffer overflow, and I'm ...
Joseph Seed's user avatar
1 vote
1 answer
419 views

Buffer overflow stops executing shellcode in the middle of it

I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory). This is the vulnerable C code:...
ramon's user avatar
  • 121
1 vote
0 answers
78 views

Is there any combination of memory mitigations COOP doesn't bypass?

I recently seen a paper where COOP exploit dev was used to bypass DEP+ASLR+CET+CFG+SEHOP. JIT attack surfaces like v8 seem to have even less hardening. Is there a form of exploitable memory corruption ...
TJCoder's user avatar
  • 11
0 votes
1 answer
293 views

64-bit ROP-based Buffer Overflow Attack

I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below: #include <stdio.h> #include <stdint.h> #include <stdbool.h> #include <sys/...
justsobad's user avatar
1 vote
1 answer
428 views

Is obtaining a shell from this buffer overflow possible?

I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address. In these cases, you can hijack a ...
A. Trevelyan's user avatar
1 vote
0 answers
242 views

Buffer overflow on a program that only accepts arguments as input

I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, ...
Coop's user avatar
  • 11
1 vote
2 answers
1k views

Finding offset using Buffer overflow pattern generator

I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator #include <stdio.h> #include <string.h> int main (int argc, ...
Stokes's user avatar
  • 11
0 votes
0 answers
182 views

Buffer Overflow with ROP Chain Output Problem

I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output. I want to stop the printf() call in the vuln function to get ...
Flowless Man's user avatar
0 votes
1 answer
1k views

Why do I get a broken pipe when using pwntool with this C code

I am learning about Buffer Overflows (BOF) and came up with this piece of C code: #include <stdio.h> #include <stdlib.h> void win() { system("/bin/bash"); } int main() {...
netrunner's user avatar
20 votes
6 answers
9k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
blank's user avatar
  • 235
0 votes
0 answers
1k views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
MrDuk's user avatar
  • 1,237
4 votes
1 answer
629 views

Why does my RIP value change after overwriting via an overflow?

I've been working on a buffer overflow on a 64 bit Linux machine for the past few days. The code I'm attacking takes in a file. This original homework ran on a 32-bit system, so a lot is differing. I ...
sneakyfishies's user avatar
-2 votes
1 answer
568 views

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]

What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
Nathan Aw's user avatar
2 votes
1 answer
228 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
Cream's user avatar
  • 131
1 vote
1 answer
202 views

Buffer overflow not working from different environment

I wrote my first buffer overflow exploit and it worked well with ./vulnerable $(cat payload) but when I tried to launch it from a Python shell it didn't work import os os.system("./vulnerable $(...
Elliottheprince's user avatar
0 votes
1 answer
682 views

Why I can't perform buffer overflow directly from bash

Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work... Let's me explain with an example. Suppose we have a program written in c. This program has 2 ...
NeCro's user avatar
  • 25
0 votes
0 answers
339 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
Greg Gregson's user avatar
0 votes
0 answers
113 views

Addresses of two consecutive buffers

I have two buffers declared one after the another, like this: char A[256]; char B[32]; At first, I thought I could write whatever I wanted in B with a buffer overflow from A. However, some tests ...
Katoptriss's user avatar
0 votes
0 answers
577 views

Jumping a function inside the code with buffer over flow

My goal is the jump a local function without calling it. Here is my code #include <stdio.h> void bufferoverflow() { printf("bufferoverlow!\n"); } void doSomething() { int ...
avax899's user avatar
0 votes
2 answers
809 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
questioner's user avatar
1 vote
1 answer
154 views

Buffer overflow confusion, how do pre-return address payloads work despite stack clearence

I am trying to get deeper into buffer overflow and lower-level stuff in general and am confused regarding one particular topic. I have seen examples of buffer overflows in which the shellcode is ...
poyraz04's user avatar
1 vote
0 answers
812 views

How to find addresses and view stack in buffer overflow?

I am learning buffer overflow and I'm stuck. For the basic examples with very few variables we could spam the stack and kinda overwrite the return address etc. I am having difficulties examining the ...
Jack's user avatar
  • 11
0 votes
1 answer
2k views

Instead of JMP ESP can we use it's opcodes?

In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP ...
Kavishka Gihan's user avatar
2 votes
2 answers
2k views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
Toma's user avatar
  • 121
0 votes
1 answer
470 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
Mohammed Abdu's user avatar
0 votes
2 answers
274 views

Stack Smashing Short Problem

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
Travis Taylor's user avatar
0 votes
1 answer
409 views

Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment. I understand that writing more than 100 ...
Travis Taylor's user avatar
0 votes
1 answer
596 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
nickelpro's user avatar
  • 111
1 vote
1 answer
224 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
Tom Atix's user avatar
  • 166
0 votes
1 answer
434 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
Aditya Singh Rathore's user avatar
0 votes
0 answers
574 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
malpa's user avatar
  • 1
1 vote
1 answer
1k views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
n00b.exe's user avatar
  • 181
4 votes
2 answers
299 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
Stone True's user avatar
  • 2,042
-1 votes
1 answer
334 views

Do you have to be on the same WIFI for a Buffer Overflow attack to work?

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
user251200's user avatar
2 votes
1 answer
702 views

How can hackers find buffer overflow without source code?

I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
init_first's user avatar
2 votes
1 answer
639 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
Abhirup Bakshi's user avatar
5 votes
1 answer
12k views

How to do string buffer overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
Abhirup Bakshi's user avatar
2 votes
1 answer
2k views

BufferOverflow ESP too small for shellcode

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this. I ...
Nightwolf's user avatar

1
2 3 4 5
11