Questions tagged [c]

The C programming language, commonly used for low-level programming

Filter by
Sorted by
Tagged with
1
vote
1answer
41 views

Format string exploit length

I'm new to Software security and I'm studying it now at the university. I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
1
vote
0answers
31 views

Process hollowing and the Import Address Table

I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions. Why aren't we building the IAT when we load our injected PE? All we do is ...
1
vote
1answer
55 views

Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]

Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
2
votes
1answer
45 views

Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?

Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
1
vote
1answer
92 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
43 views

ASLR doesn't work?

I have following code: #include <stdio.h> #include <stdlib.h> int main() { int *ptr1 = malloc(16); int val1 = 0x12345678; printf("stack: %p\nheap: %p\n", &...
0
votes
1answer
64 views

Understanding why this buffer overflow attack isn't working

I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
0
votes
0answers
84 views

Writing to .fini_array

I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
0
votes
0answers
33 views

Encforce W^X on a specific program

TL;DR: I want to enforce security rules like W^X in user mode. So, I am writing a program that will parse input that can be easily be compromised by an adversary (It reads data from a socket that is ...
2
votes
1answer
121 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
2answers
103 views

C Security Code Review

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
142 views

How to find buffer offset for Return to Libc Attack

I am trying to find the buffer for where the implement my buffer overflow attack The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf How I find X Y Z in a ...
0
votes
0answers
119 views

How to exploit this C program to call a certain function?

The goal is to call the function foo in the following program: struct object { unsigned char buf[36]; void (*fp)(); }; void baz(struct object * obj, unsigned int num) { for (int i = 0; i ...
0
votes
0answers
33 views

how to get this into a stack oveflow performed into integer overflow?

I'm trying to understand stack buffer overflow performed by an integer overflow , and am working with a simple piece of code, as below, but however I am not sure how can I add to this code an integer ...
-3
votes
1answer
429 views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]; printf("%lld\n", (long long) ...
1
vote
0answers
186 views

Buffer bomb level 3 - Prevent stack corruption

I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
103 views

EIP pointing to shellcode but shellcode is not executing?

I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
1
vote
0answers
115 views

How to disabel relro to overwrite fini_array or .got.plt element?

I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors with the address of a shellcode environment ...
1
vote
0answers
164 views

Is overbuffered done on 10th byte past alocated space?

I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
1
vote
2answers
281 views

DLL injector in C doesn't inject the DLL

I am trying to write a DLL injector to perform a DLL injector on a calculator process. I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
2
votes
1answer
197 views

Buffer Overflow in the C program

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. Here is the question. Sorry the original condition ...
2
votes
1answer
179 views

What are the security implications of invalid free()?

CVE-2009-5030 OpenJPEG: Heap memory corruption leading to invalid free The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (...
1
vote
2answers
86 views

How do I program a function to generate a secure Block Cipher Encryption-Key?

I am currently studying the most widely known encryption algorithms and methodologies. For practice purposes, I want to implement everything from ECB to RSA as some kind of a C crypto library. How ...
1
vote
0answers
524 views

C/C++ code injection

I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
0
votes
0answers
116 views

Windows shellcode not working in C

I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works... I know the shellcode below is all right because it does work in the context ...
-1
votes
2answers
97 views

Buffer Overflow

I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
0answers
114 views

Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?

I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
0
votes
0answers
68 views

Failure to execute shellcode

I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
3answers
356 views

Prevent finding key in C++ application binary

I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
0answers
53 views

Confusing with the exact location of a shellcode in memory?

When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But most of the time, it crashes saying 'segmentation fault'. I got the same ...
0
votes
1answer
195 views

Stack address is shown less than heap address in C program

I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
1
vote
0answers
81 views

Why is unistd's getpass unsafe?

While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass. However, this function is being documented as ...
5
votes
2answers
843 views

Buffer overflow exploit with python3 : wrong return address written

I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
23
votes
1answer
4k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
1
vote
2answers
227 views

In Return-Oriented Programming how can the machine execute unaligned instructions?

I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)". The author claims that x86 code is like English written without punctuation or spaces, ...
0
votes
1answer
90 views

How and why is executable stack dangerous?

I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
0answers
221 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
1answer
330 views

Shellcode as part of format string buffer

I'm currently trying out a simple format string vuln exploit. The target program looks like this: int main(int argc, char *argv[]) { char buffer[1024]; strncpy(buffer, argv[1], sizeof(buffer)...
1
vote
3answers
854 views

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? [closed]

I'm talking about the overflow flag that is used in some architectures like x86: https://en.wikipedia.org/wiki/Overflow_flag why aren't operating systems using this overflow flag to stop integer ...
2
votes
1answer
444 views

Is zeroing out values on the stack and arguments overkill?

I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance. ...
0
votes
1answer
497 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
0answers
311 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
2
votes
1answer
2k views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
1
vote
2answers
163 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
0answers
49 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
126 views

Exploiting a Heap Overrun Vulnerability

I am really trying to understand the concept of the attack made possible by the code given below. I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
1
vote
0answers
399 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
2answers
2k views

Example of a double-free vulnerability in C

I hope this is the correct forum to ask for the question that I have: We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
1
vote
0answers
78 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
1k views

How does this simple buffer overflow work?

I've got this simple code vuln.c #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buffer[500]; strcpy(buffer, argv[1]); printf("%s", buffer); ...

1
2 3 4 5