Questions tagged [buffer-overflow]

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Could it be suspicious if I see a lot of buffer overflows in Process Monitor, among the processes of Microsoft Defender for Endpoint network scanner?

I see a LOT of buffer overflows in Process Monitor, and it is also among processes that are responsible for the security of the machine. The program ran for 2-3 minutes, and 16751 out of 773514 events ...
  • 49
1 vote
0 answers
25 views

Is there any combination of memory mitigations COOP doesn't bypass?

I recently seen a paper where COOP exploit dev was used to bypass DEP+ASLR+CET+CFG+SEHOP. JIT attack surfaces like v8 seem to have even less hardening. Is there a form of exploitable memory corruption ...
  • 11
0 votes
1 answer
50 views

64-bit ROP-based Buffer Overflow Attack

I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below: #include <stdio.h> #include <stdint.h> #include <stdbool.h> #include <sys/...
1 vote
1 answer
138 views

Is obtaining a shell from this buffer overflow possible?

I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address. In these cases, you can hijack a ...
1 vote
0 answers
85 views

Buffer overflow on a program that only accepts arguments as input

I've got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, ...
  • 11
1 vote
2 answers
238 views

Finding offset using Buffer overflow pattern generator

I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator #include <stdio.h> #include <string.h> int main (int argc, ...
0 votes
0 answers
34 views

_libc_csu_init address is getting corrupted in x86_64

I am trying to bypass the ASLR using the returntoplt attack for this I have to use a gadget pop rdi; ret I was able to find this gadget in __libc_csu_inint but for some reason whenever I use this ...
0 votes
0 answers
44 views

which methods are used beside ASLR for Stack-Randomization?

I've been working with Buffer Overflow attacks, and I would like to know if there is another method for Stack-Randomization beside the ASLR method.
0 votes
0 answers
54 views

Find other addresses with libc address

TLDR: With PIE and ASLR enabled, am I able to calculate the base address of other parts of an x64 elf binary (e.g data segment, stack) if I know the base address of libc? I'm looking at an x64 elf ...
  • 189
0 votes
0 answers
118 views

Rop With Null Bytes

I'm running into a challenge where I have control over the return address and the base pointer through my input, however the program null byte terminates and the addressing scheme only takes up 6 ...
  • 189
0 votes
0 answers
97 views

Buffer Overflow with ROP Chain Output Problem

I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output. I want to stop the printf() call in the vuln function to get ...
0 votes
1 answer
611 views

Why do I get a broken pipe when using pwntool with this C code

I am learning about Buffer Overflows (BOF) and came up with this piece of C code: #include <stdio.h> #include <stdlib.h> void win() { system("/bin/bash"); } int main() {...
19 votes
6 answers
6k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
  • 225
0 votes
0 answers
650 views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
  • 1,237
4 votes
1 answer
227 views

Why does my RIP value change after overwriting via an overflow?

I've been working on a buffer overflow on a 64 bit Linux machine for the past few days. The code I'm attacking takes in a file. This original homework ran on a 32-bit system, so a lot is differing. I ...
-2 votes
1 answer
256 views

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]

What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
2 votes
1 answer
131 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
  • 131
1 vote
1 answer
100 views

Buffer overflow not working from different environment

I wrote my first buffer overflow exploit and it worked well with ./vulnerable $(cat payload) but when I tried to launch it from a Python shell it didn't work import os os.system("./vulnerable $(...
0 votes
1 answer
207 views

Why I can't perform buffer overflow directly from bash

Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work... Let's me explain with an example. Suppose we have a program written in c. This program has 2 ...
  • 15
0 votes
0 answers
148 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
0 votes
0 answers
74 views

Addresses of two consecutive buffers

I have two buffers declared one after the another, like this: char A[256]; char B[32]; At first, I thought I could write whatever I wanted in B with a buffer overflow from A. However, some tests ...
0 votes
0 answers
196 views

Jumping a function inside the code with buffer over flow

My goal is the jump a local function without calling it. Here is my code #include <stdio.h> void bufferoverflow() { printf("bufferoverlow!\n"); } void doSomething() { int ...
0 votes
2 answers
301 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
1 vote
1 answer
74 views

Buffer overflow confusion, how do pre-return address payloads work despite stack clearence

I am trying to get deeper into buffer overflow and lower-level stuff in general and am confused regarding one particular topic. I have seen examples of buffer overflows in which the shellcode is ...
1 vote
0 answers
415 views

How to find addresses and view stack in buffer overflow?

I am learning buffer overflow and I'm stuck. For the basic examples with very few variables we could spam the stack and kinda overwrite the return address etc. I am having difficulties examining the ...
  • 11
0 votes
1 answer
1k views

Instead of JMP ESP can we use it's opcodes?

In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP ...
2 votes
2 answers
782 views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
  • 121
0 votes
1 answer
230 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
0 votes
2 answers
119 views

Stack Smashing Short Problem

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
0 votes
1 answer
294 views

Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment. I understand that writing more than 100 ...
0 votes
1 answer
207 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
  • 101
1 vote
1 answer
128 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
  • 166
0 votes
1 answer
195 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
0 votes
0 answers
259 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
  • 1
1 vote
1 answer
556 views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
  • 161
4 votes
2 answers
213 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
  • 2,032
-1 votes
1 answer
200 views

Do you have to be on the same WIFI for a Buffer Overflow attack to work?

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
2 votes
1 answer
405 views

How can hackers find buffer overflow without source code?

I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
2 votes
1 answer
355 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
3 votes
1 answer
6k views

How to do string buffer overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
2 votes
1 answer
1k views

BufferOverflow ESP too small for shellcode

I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this. I ...
0 votes
2 answers
100 views

Working code examples for stack or heap buffer overflows?

I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
  • 29
1 vote
0 answers
105 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
  • 23
-1 votes
1 answer
1k views

Doing buffer overflow attack without knowing buffer size and address

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is ...
  • 21
1 vote
2 answers
254 views

Execution condition for buffer overflow

I have an old Beaglebone Black board which is similar to Raspberry Pi. Unfortunately, I forgot the Linux login password and can access the Linux using the Cloud9 feature. With this I can log into the ...
  • 121
0 votes
1 answer
135 views

Does limiting size of images prevents buffer overflow?

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
  • 1
0 votes
1 answer
251 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
0 votes
2 answers
338 views

Basic questions about a buffer overflow attack example

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow #include <stdio.h> int main(){ int a[3]={0,1,2}; printf("...
  • 125
0 votes
1 answer
991 views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
1 vote
1 answer
693 views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
  • 13

1
2 3 4 5
10