Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [c]

The C programming language, commonly used for low-level programming

0
votes
0answers
23 views

ettercap packet modification

I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
0
votes
1answer
39 views

How to make a buffer overflow run shell? [on hold]

I have a simple C program that asks for two inputs I'm trying to overflow them so that I can access a shell, but I'm not sure what I need to do to access the shell. I can overflow them to just print ...
-1
votes
0answers
68 views

Buffer overflow attack, getting password from locked text file

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a password behind a locked .txt contains the password. I shouldn't need to use GDB for this. vuln.c //no ...
2
votes
1answer
166 views

Is zeroing out values on the stack and arguments overkill?

I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance. ...
0
votes
1answer
44 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
0answers
63 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
1
vote
1answer
134 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
1
vote
2answers
72 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
0answers
43 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
38 views

Exploiting a Heap Overrun Vulnerability

I am really trying to understand the concept of the attack made possible by the code given below. I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
1
vote
0answers
162 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
2answers
406 views

Example of a double-free vulnerability in C

I hope this is the correct forum to ask for the question that I have: We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
1
vote
0answers
40 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
252 views

How does this simple buffer overflow work?

I've got this simple code vuln.c #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buffer[500]; strcpy(buffer, argv[1]); printf("%s", buffer); ...
1
vote
2answers
124 views

If C uses shared libraries, is it possible to write a program that will modify the code that opens a file

If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
0
votes
2answers
324 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
0answers
240 views

Segmentation fault in exercise program

I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end. The idea ...
2
votes
1answer
421 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
2
votes
1answer
52 views

Buffer Overflow protections in custom library

Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
1
vote
1answer
217 views

How to find address of system() in an executable - ROP exploit

I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
1
vote
0answers
262 views

How to find the return address when performing an overflow

for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
0
votes
1answer
108 views

CWE-234 - Snprintf Missing Parameter issues

We are scanning a third party library using a well know static analysis tool here. We keep getting: "Failure to Handle Missing Parameter CWE ID 234" I'm not a C developer but I can't see what is ...
0
votes
1answer
141 views

“Hacking The Art of Exploitation” - format string exploit memory truncation

I am attempting the printf() format parameter exploit where providing the user controlled data directly as the sole argument of the printf("user input") allows for the user to provide format ...
2
votes
0answers
237 views

Not able to run the injected shellcode

#include <stdio.h> void secret() { printf("Congratulations!\n"); } void echo() { char array[60]; scanf("%s", array); printf("You entered: %s\n", array); } int main() { ...
0
votes
1answer
423 views

Buffer overflow exploit is leading to Segmentation Fault

#include<stdio.h> void secret(){ printf("entered secret function"); } void return_input() { char array[60]; scanf("%s", array); printf("%s\n",array); } int main() { return_input(); ...
0
votes
1answer
102 views

SAT (Satisfiability) it is security risk?

If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
7
votes
1answer
2k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
0
votes
2answers
256 views

Buffer Overflow : segmentation error at 0x90909090

why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ? 0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff040: ...
0
votes
0answers
240 views

Openssl SSL_CTX_set_cipher_list() in cross-platform C application

Situation I am developing a cross-platform C application which uses OpenSSL. I would like to release it for at least the following operating systems: Windows 7+ MacOS High Sierra Debian 8+ Ubuntu ...
29
votes
4answers
8k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
452 views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
3
votes
1answer
121 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
4
votes
3answers
893 views

What assembly should I learn? [closed]

I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn? I have prior experience in programming, and I did a degree in Computer Science but ...
3
votes
1answer
543 views

Python - ctypes.cast function call outputs Segmentation Fault error message

Background: Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
2
votes
2answers
539 views

Unable to understand $EIP changes with Buffer Overflow

I am learning Buffer Overflow, so the question might seem silly but here it is. I started with this very simple buggy program int main(int argc, char *argv[]) { char buf[128]; printf("You entered ...
1
vote
2answers
108 views

Buffer Overflow problem [closed]

I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't. ...
3
votes
1answer
837 views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
1
vote
2answers
323 views

Buffer Overflow Stack Attack Exercise Help

So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
-3
votes
1answer
2k views

How to correctly use dev/urandom for random generation [closed]

Runs before main: d -c 30 /dev/urandom > random.bytes Access the randomly generated numbers int main() { FILE *fp; int fd = open("random.bytes",O_RDONLY); fp = fopen("file.txt" , ...
1
vote
1answer
250 views

Securing .so file access permissions

I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps. The issue is that there is only two exported functions in the .so ...
1
vote
1answer
2k views

Buffer overflow: Why does the ESP Register change its value after access violation

Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
1
vote
1answer
377 views

How do I bypass a return address overwrite not doing anything?

This is main: (gdb) disass main Dump of assembler code for function main: 0x000000000040057c <+0>: push rbp 0x000000000040057d <+1>: mov rbp,rsp 0x0000000000400580 <+4&...
1
vote
1answer
362 views

Write zeros in memory through a buffer overflow

Trying to give a command line program an address to overwrite a return address saved in the stack. I could successfully overflow the input argument into the exact return address position but the ...
2
votes
2answers
447 views

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

General Background: I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such: // .... including the corresponding libraries depending ...
2
votes
1answer
1k views

Shellcode doesn't execute and EIP is overwritten

I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
2
votes
1answer
136 views

Security implications of setting the broadcast flag on a UDP socket

Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
0
votes
1answer
219 views

Stack Protection off but still cant overwrite EIP

When Compiling with: gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32 I am able to overwrite the return address with just about any value except a valid return address. ...
1
vote
1answer
160 views

Is it possible to write a value larger than 64bit using a format string attack (%n)?

I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can ...
1
vote
2answers
246 views

Why is this shellcode execution considered an exploit?

I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
2
votes
1answer
4k views

Executing a msfvenom shellcode in C program

This is obviously for educational purposes. I've been interested in learning more about malware and how it works. I'm trying to get a meterpreter reverse tcp shell working on windows 10 but more ...