Questions tagged [c]
The C programming language, commonly used for low-level programming
267
questions
0
votes
0answers
19 views
How can setuid C program be used to exploit open() system call for Privilege Escalation [closed]
There is one SetUID program in C that passes command-line arguments to open system call as open(argv[1], O_RDONLY);
Can this be exploited for privilege escalation? If yes with which command line?
0
votes
0answers
53 views
Where is the source for OpenSSL RSA_private_encrypt? [closed]
I'm currently doing research on OpenSSL's encryption algorithm for RSA. The problem I'm facing is actually finding where the source code for the RSA_private_encrypt function is defined.
What I've ...
2
votes
1answer
110 views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
2
votes
1answer
50 views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
2
votes
1answer
144 views
How to do string buffter overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
0
votes
0answers
39 views
Exploiting buffer overflow in 64-bit macOS executable
I'm following this tutorial to create a buffer overflow demo. The article illustrates a 32-bit executable, but I'm feeling adventurous and decided to do a 64-bit one. Below is the deliberately ...
1
vote
0answers
59 views
Question on stack overflow
I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
1
vote
1answer
128 views
Why does Kaspersky anti-virus not consider this executable as malicious?
I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code:
#include <stdio.h>
#include <stdlib.h>
int main(...
1
vote
1answer
117 views
The hidden meaning of the source code of the malware?
I'm studying the source code of malware developed in c++ and I have two questions in the source code below
This is probably code that loads malicious dlls into memory.
typedef BOOL (WINAPI *...
0
votes
1answer
60 views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
-1
votes
1answer
42 views
is it possible to call libc function with rop
let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
23
votes
6answers
8k views
Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]
I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
0
votes
1answer
192 views
Can you perform a buffer overflow and a format string attack at the same time?
So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h&...
1
vote
1answer
80 views
Why does my compiler warn me about gets but not about scanf?
If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used:
<source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations]
...
0
votes
0answers
76 views
How to avoid segmentation fault in a buffer overflow exploit
I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
0
votes
0answers
106 views
Exploit stdin to call local function in C
Note: this is extra credit for a homework assignment
I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
3
votes
1answer
100 views
Having trouble with learning Buffer Overflows
So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
0
votes
1answer
281 views
Is following code vulnerable?
Consider following C code snippet:
void barfoo (int authstatus) {
char packet[1024];
fgets (packet, 1023, stdin);
if (authstatus != 0)
system (packet);
else
syslog (&...
1
vote
1answer
70 views
CRL date formats and conversion from GMT to epoch
I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists).
I am using the following command openssl asn1parse -inform DER ...
1
vote
1answer
48 views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
-1
votes
1answer
81 views
How a can be decoded as 61 and b as 62…? [closed]
I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms.
I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
0
votes
0answers
90 views
Problem with return 2 libc in 64 bit arch
I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143):
cbcd8: 00 00
cbcda: 4c 89 ea ...
0
votes
0answers
81 views
Reflective DLL Injection using mingw compiles with no Errors, But doesn't work
I've been playing around with the Reflective DLL injection code, I can compile the Dll's in mingw easily and inject them using the original compiled binaries given here. I can also compile the ...
0
votes
1answer
100 views
Send hex code into standard input after getting some output
I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.
I'm trying to input hex code into my ...
2
votes
1answer
244 views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
1
vote
0answers
89 views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
1
vote
1answer
66 views
Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]
Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
2
votes
1answer
55 views
Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?
Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
1
vote
1answer
100 views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
58 views
ASLR doesn't work?
I have following code:
#include <stdio.h>
#include <stdlib.h>
int main()
{
int *ptr1 = malloc(16);
int val1 = 0x12345678;
printf("stack: %p\nheap: %p\n", &...
0
votes
1answer
103 views
Understanding why this buffer overflow attack isn't working
I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
1
vote
1answer
291 views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
0
votes
0answers
37 views
Encforce W^X on a specific program
TL;DR: I want to enforce security rules like W^X in user mode.
So, I am writing a program that will parse input that can be easily be compromised by an adversary (It reads data from a socket that is ...
2
votes
1answer
357 views
Buffer Overflow Works Locally But Not Remotely
So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
3answers
166 views
C Security Code Review
I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
590 views
How to find buffer offset for Return to Libc Attack
I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a ...
0
votes
0answers
202 views
How to exploit this C program to call a certain function?
The goal is to call the function foo in the following program:
struct object {
unsigned char buf[36];
void (*fp)();
};
void baz(struct object * obj, unsigned int num) {
for (int i = 0; i ...
-3
votes
1answer
2k views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE];
printf("%lld\n", (long long) ...
1
vote
0answers
381 views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
217 views
EIP pointing to shellcode but shellcode is not executing?
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
1
vote
0answers
166 views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
1
vote
0answers
166 views
Is overbuffered done on 10th byte past alocated space?
I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
1
vote
2answers
478 views
DLL injector in C doesn't inject the DLL
I am trying to write a DLL injector to perform a DLL injector on a calculator process.
I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
2
votes
1answer
349 views
Buffer Overflow in the C program
I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.
Here is the question. Sorry the original condition ...
2
votes
1answer
212 views
What are the security implications of invalid free()?
CVE-2009-5030
OpenJPEG: Heap memory corruption leading to invalid free
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
allows remote attackers to cause a denial of service (...
1
vote
2answers
91 views
How do I program a function to generate a secure Block Cipher Encryption-Key?
I am currently studying the most widely known encryption algorithms and methodologies. For practice purposes, I want to implement everything from ECB to RSA as some kind of a C crypto library. How ...
1
vote
0answers
862 views
C/C++ code injection
I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
0
votes
0answers
140 views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
-1
votes
2answers
106 views
Buffer Overflow
I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
0answers
140 views
Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?
I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
