Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [c]

The C programming language, commonly used for low-level programming

Filter by
Sorted by
Tagged with
0 votes
1 answer
92 views

How to return to main after performing stack buffer overflow

#include <stdio.h> #include <stdlib.h> void reading(); void reading_hexa(char*); void secret(); int main() { reading(); printf("Input done\n"); exit(0); } void ...
user88178's user avatar
1 vote
0 answers
65 views

String format exploit works differentely on my machine than on remote target

I'm learning binary exploitation with the picoCTF challenges. I solved Stonks, but I'm trying to learn more about how the stack works. What I did was the following: checked out the source, here is ...
lnc3l0t's user avatar
  • 11
1 vote
0 answers
83 views

How can I exploit the following code using string format vulnerabilities, Global offset table & GDB? [closed]

The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I ...
A M's user avatar
  • 11
0 votes
0 answers
123 views

Problem exploiting buffer overflow

I have the following program in C: #include <stdio.h> #include <string.h> void some_function(char * name) { char buf[128]; strcpy(buf, "The next step is... "); strcat(...
Jan's user avatar
  • 3
0 votes
0 answers
91 views

Proof of concept: Services File Permissions Weakness (T1574.010)

I am trying to do a proof of concept where I use technique T1574.010. In this technique, I should rewrite the binpath of some service in Windows 10 so that when the service starts again the payload ...
P00's user avatar
  • 1
0 votes
0 answers
207 views

Decoding shellcode gets detected in memory on runtime

I am developing a custom shellcode encoder in C++. It takes shellcode as a command line argument and generates encoded shellcode (unsigned char array) and the instructions to decode it (C/C++ code). I ...
str4nger's user avatar
0 votes
1 answer
118 views

Does the presence of an "unsafe" function in an object file pose a security risk

I've read that there are unsafe functions that we should try to avoid when writing C/C++ programs for example the gets() or strlen() functions. Let's say I compile a .cpp/.c file into an object file ...
KetDog's user avatar
  • 101
0 votes
0 answers
93 views

How do I prevent the random alignment of the instructions during debugging using gdb? Even tried turning off the optimization with -O0 in gcc

I have started with the book 'Hacking: The art of exploitation!'. I know some of you might suggest that it's pretty old... But I think great buildings withstand due to their strong foundational base. ...
Aniket D.'s user avatar
1 vote
1 answer
133 views

bufferoverflow chars gets replaced on stack [closed]

So I try to understand stack based buffer-overflow but now I am stuck. This is the vulnerable function (32 bit ELF). int test(char* input) { char buf[100]; printf("Buffer is at %p\n",...
atcheckmate's user avatar
3 votes
1 answer
286 views

accessing ELF in memory (Unix/Linux)

On Linux (and maybe UNIX), you can access and even modify process's stack with things like ptrace, process_vm_ready, etc., but is there a way to access the copy of the binary that's being executed ...
R-Rothrock's user avatar
0 votes
0 answers
340 views

Program segfaults when ran with GDB

this is my first time posting a question here, so forgive me if I don't give enough details. I will provide any extra details that are requested. Basically, I'm practicing a buffer overflow, and I'm ...
Joseph Seed's user avatar
0 votes
1 answer
244 views

Vulnerability in the source code, but can't elevate do Privilege Escalation

Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
Fit Tony's user avatar
2 votes
1 answer
176 views

Void pointer and their attribute constructor

I am supposed to find the vulnerability in the code (as a part of a ctf) and I feel it's hidden either in the __attribute__((constructor)) or the pointer. Here I can make out that it's a void pointer ...
Haaziq Jamal's user avatar
1 vote
1 answer
100 views

Is switching my C/C++ compiler for security testing generally reliable?

If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
the_endian's user avatar
  • 1,179
2 votes
0 answers
232 views

What is missing to reproduce CVE-2022-32250?

I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here. So I installed Ubuntu 22.04 on VM, and installed kernel ...
E Epsylon's user avatar
0 votes
1 answer
300 views

64-bit ROP-based Buffer Overflow Attack

I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below: #include <stdio.h> #include <stdint.h> #include <stdbool.h> #include <sys/...
justsobad's user avatar
1 vote
1 answer
430 views

Is obtaining a shell from this buffer overflow possible?

I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address. In these cases, you can hijack a ...
A. Trevelyan's user avatar
0 votes
0 answers
85 views

Making time(0) produce an error

I'm currently reviewing/reversing a software (coded in C) and it has a line like this : time_t var = time(0); My goal it to get this time(0) call to return -1. (I cannot modify the parameter.) ...
531-M31C's user avatar
1 vote
2 answers
1k views

Finding offset using Buffer overflow pattern generator

I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator #include <stdio.h> #include <string.h> int main (int argc, ...
Stokes's user avatar
  • 11
0 votes
0 answers
183 views

Buffer Overflow with ROP Chain Output Problem

I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output. I want to stop the printf() call in the vuln function to get ...
Flowless Man's user avatar
0 votes
1 answer
1k views

Why do I get a broken pipe when using pwntool with this C code

I am learning about Buffer Overflows (BOF) and came up with this piece of C code: #include <stdio.h> #include <stdlib.h> void win() { system("/bin/bash"); } int main() {...
netrunner's user avatar
-3 votes
1 answer
292 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
Nikunj Chovatiya's user avatar
20 votes
6 answers
9k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
blank's user avatar
  • 235
2 votes
2 answers
251 views

Is an open TCP port that doesn’t take input secure?

I have written a simple C program (~30 lines) that opens an internet socket and sends data to the client on every connection. The program never read()s from the socket; it just parses the /proc ...
tjcaul's user avatar
  • 123
2 votes
1 answer
228 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
Cream's user avatar
  • 131
1 vote
0 answers
391 views

C - Remote string format attack exploit - %n Does not seem to write anything on the stack

[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
Desperados's user avatar
0 votes
2 answers
399 views

I invoked undefined behaviour. Do I need a new computer?

Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
Hugh's user avatar
  • 101
0 votes
0 answers
578 views

Jumping a function inside the code with buffer over flow

My goal is the jump a local function without calling it. Here is my code #include <stdio.h> void bufferoverflow() { printf("bufferoverlow!\n"); } void doSomething() { int ...
avax899's user avatar
2 votes
1 answer
1k views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
Andrea Rubi's user avatar
1 vote
1 answer
205 views

Is there any security flaw in this C program to generate a tabula recta?

In order to generate and store my passwords, I decided to use a tabula recta as described in this article. So I coded a simple C program to create such a table, I wanted to know if it contained a ...
user avatar
-1 votes
1 answer
248 views

code and memory safety issues

I'm preparing for a computer security exam, and I found this question in previous exams To create an authentication program, we write a check_auth function as follows: int check_auth(char *password) {...
Bella's user avatar
  • 3
0 votes
1 answer
472 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
Mohammed Abdu's user avatar
0 votes
2 answers
274 views

Stack Smashing Short Problem

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
Travis Taylor's user avatar
0 votes
1 answer
409 views

Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment. I understand that writing more than 100 ...
Travis Taylor's user avatar
0 votes
1 answer
597 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
nickelpro's user avatar
  • 111
0 votes
1 answer
436 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
Jolly Roger's user avatar
0 votes
0 answers
578 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
malpa's user avatar
  • 1
2 votes
1 answer
306 views

How do I compare the safety of a compiled program with optimization flag?

I would like to know how I can know which is the safest compilation line, that is: Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
sgio's user avatar
  • 21
2 votes
1 answer
643 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
Abhirup Bakshi's user avatar
5 votes
1 answer
12k views

How to do string buffer overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
Abhirup Bakshi's user avatar
1 vote
0 answers
141 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
Unknown's user avatar
  • 23
2 votes
1 answer
301 views

Why does Kaspersky anti-virus not consider this executable as malicious?

I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code: #include <stdio.h> #include <stdlib.h> int main(...
FakeMod's user avatar
  • 123
1 vote
1 answer
222 views

The hidden meaning of the source code of the malware?

I'm studying the source code of malware developed in c++ and I have two questions in the source code below This is probably code that loads malicious dlls into memory. typedef BOOL (WINAPI *...
useeffect's user avatar
0 votes
1 answer
519 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
asd40732's user avatar
-1 votes
1 answer
244 views

is it possible to call libc function with rop

let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
daniel's user avatar
  • 34
23 votes
6 answers
10k views

Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]

I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
Cronos's user avatar
  • 233
0 votes
1 answer
2k views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
Fiach ONeill's user avatar
1 vote
1 answer
1k views

Why does my compiler warn me about gets but not about scanf?

If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used: <source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations] ...
daniel's user avatar
  • 34
0 votes
0 answers
350 views

How to avoid segmentation fault in a buffer overflow exploit

I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
karpatylviv's user avatar
0 votes
0 answers
1k views

Exploit stdin to call local function in C

Note: this is extra credit for a homework assignment I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
Smiley's user avatar
  • 1

1
2 3 4 5 6