Questions tagged [c]

The C programming language, commonly used for low-level programming

Filter by
Sorted by
Tagged with
0 votes
0 answers
38 views

Buffer Overflow with ROP Chain Output Problem

I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output. I want to stop the printf() call in the vuln function to get ...
user avatar
0 votes
1 answer
103 views

Why do I get a broken pipe when using pwntool with this C code

I am learning about Buffer Overflows (BOF) and came up with this piece of C code: #include <stdio.h> #include <stdlib.h> void win() { system("/bin/bash"); } int main() {...
user avatar
-3 votes
1 answer
56 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
user avatar
19 votes
6 answers
5k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
user avatar
  • 225
2 votes
2 answers
202 views

Is an open TCP port that doesn’t take input secure?

I have written a simple C program (~30 lines) that opens an internet socket and sends data to the client on every connection. The program never read()s from the socket; it just parses the /proc ...
user avatar
  • 123
2 votes
1 answer
116 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
user avatar
  • 131
1 vote
0 answers
52 views

C - Remote string format attack exploit - %n Does not seem to write anything on the stack

[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
user avatar
0 votes
2 answers
170 views

I invoked undefined behaviour. Do I need a new computer?

Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
user avatar
  • 101
0 votes
0 answers
101 views

Jumping a function inside the code with buffer over flow

My goal is the jump a local function without calling it. Here is my code #include <stdio.h> void bufferoverflow() { printf("bufferoverlow!\n"); } void doSomething() { int ...
user avatar
1 vote
1 answer
224 views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
user avatar
1 vote
1 answer
164 views

Is there any security flaw in this C program to generate a tabula recta?

In order to generate and store my passwords, I decided to use a tabula recta as described in this article. So I coded a simple C program to create such a table, I wanted to know if it contained a ...
user avatar
-1 votes
1 answer
156 views

code and memory safety issues

I'm preparing for a computer security exam, and I found this question in previous exams To create an authentication program, we write a check_auth function as follows: int check_auth(char *password) {...
user avatar
  • 3
0 votes
1 answer
149 views

Buffer overread

I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
user avatar
0 votes
2 answers
98 views

Stack Smashing Short Problem

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
user avatar
0 votes
1 answer
172 views

Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment. I understand that writing more than 100 ...
user avatar
0 votes
0 answers
167 views

Trouble understanding buffer overflow to print a string

I have the following program: #include<stdio.h> int main() { int i=0; foo(); printf("Hello there!"); func(); } int foo(void) { char str[14]; strncpy(str,&...
user avatar
  • 21
0 votes
0 answers
99 views

How to see what functions can be hijacked when abusing LD_PRELOAD?

Given a binary and looking to abuse LD_PRELOAD (privilege escalation or persistence), what's a good way to list what functions can be hijacked when running the binary? Are there functions that should (...
user avatar
0 votes
1 answer
136 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
user avatar
  • 101
0 votes
1 answer
124 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
user avatar
0 votes
0 answers
165 views

Shell does not execute after buffer overflow

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
user avatar
  • 1
2 votes
1 answer
193 views

How do I compare the safety of a compiled program with optimization flag?

I would like to know how I can know which is the safest compilation line, that is: Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
user avatar
  • 21
2 votes
1 answer
289 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
user avatar
3 votes
1 answer
4k views

How to do string buffter overflow with scanf function?

I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
user avatar
1 vote
0 answers
101 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
user avatar
  • 23
2 votes
1 answer
206 views

Why does Kaspersky anti-virus not consider this executable as malicious?

I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code: #include <stdio.h> #include <stdlib.h> int main(...
user avatar
  • 123
1 vote
1 answer
166 views

The hidden meaning of the source code of the malware?

I'm studying the source code of malware developed in c++ and I have two questions in the source code below This is probably code that loads malicious dlls into memory. typedef BOOL (WINAPI *...
user avatar
0 votes
1 answer
205 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
user avatar
-1 votes
1 answer
131 views

is it possible to call libc function with rop

let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
user avatar
  • 34
23 votes
6 answers
9k views

Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]

I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
user avatar
  • 233
0 votes
1 answer
740 views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
user avatar
1 vote
1 answer
588 views

Why does my compiler warn me about gets but not about scanf?

If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used: <source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations] ...
user avatar
  • 34
0 votes
0 answers
199 views

How to avoid segmentation fault in a buffer overflow exploit

I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
user avatar
0 votes
0 answers
412 views

Exploit stdin to call local function in C

Note: this is extra credit for a homework assignment I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
user avatar
  • 1
2 votes
1 answer
161 views

Having trouble with learning Buffer Overflows

So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
user avatar
0 votes
1 answer
389 views

Is following code vulnerable?

Consider following C code snippet: void barfoo (int authstatus) { char packet[1024]; fgets (packet, 1023, stdin); if (authstatus != 0) system (packet); else syslog (&...
user avatar
1 vote
1 answer
248 views

CRL date formats and conversion from GMT to epoch

I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists). I am using the following command openssl asn1parse -inform DER ...
user avatar
  • 113
1 vote
1 answer
114 views

Generate C File Stream Object on remote machine without fopen()

Let's say we have an elf a and a textfile a.txt in the same directory. The a elf is a program, that is remotely accessible/executable. In addition a contains the instruction fgets(buf,len,stdin); and ...
user avatar
-1 votes
1 answer
119 views

How a can be decoded as 61 and b as 62...? [closed]

I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms. I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
user avatar
0 votes
0 answers
225 views

Problem with return 2 libc in 64 bit arch

I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143): cbcd8: 00 00 cbcda: 4c 89 ea ...
user avatar
0 votes
1 answer
190 views

Send hex code into standard input after getting some output

I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here. I'm trying to input hex code into my ...
user avatar
2 votes
1 answer
528 views

Format string exploit length

I'm new to Software security and I'm studying it now at the university. I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
user avatar
1 vote
0 answers
181 views

Process hollowing and the Import Address Table

I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions. Why aren't we building the IAT when we load our injected PE? All we do is ...
user avatar
1 vote
1 answer
131 views

Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]

Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
user avatar
  • 261
2 votes
1 answer
124 views

Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?

Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
user avatar
  • 23
1 vote
1 answer
160 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
user avatar
  • 33
1 vote
1 answer
277 views

ASLR doesn't work?

I have following code: #include <stdio.h> #include <stdlib.h> int main() { int *ptr1 = malloc(16); int val1 = 0x12345678; printf("stack: %p\nheap: %p\n", &...
user avatar
0 votes
1 answer
274 views

Understanding why this buffer overflow attack isn't working

I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
user avatar
1 vote
1 answer
837 views

Writing to .fini_array

I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
user avatar
2 votes
1 answer
765 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
user avatar
0 votes
3 answers
322 views

C Security Code Review

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
user avatar
  • 179

1
2 3 4 5 6