Questions tagged [c]
The C programming language, commonly used for low-level programming
263
questions
1
vote
0answers
51 views
Question on stack overflow
I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
1
vote
1answer
88 views
Why does Kaspersky anti-virus not consider this executable as malicious?
I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code:
#include <stdio.h>
#include <stdlib.h>
int main(...
1
vote
0answers
55 views
How to use Win32 in C for hacking? [closed]
I'm pretty new to cyber security. I have a bit of knowledge around Network Security, CEH topics etc.
I decided to learn Win32 in C for ethical hacking because I know C and Python. But after some ...
1
vote
1answer
107 views
The hidden meaning of the source code of the malware?
I'm studying the source code of malware developed in c++ and I have two questions in the source code below
This is probably code that loads malicious dlls into memory.
typedef BOOL (WINAPI *...
0
votes
1answer
49 views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
-1
votes
1answer
39 views
is it possible to call libc function with rop
let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
23
votes
6answers
8k views
Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]
I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
0
votes
1answer
74 views
Can you perform a buffer overflow and a format string attack at the same time?
So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h&...
1
vote
1answer
58 views
Why does my compiler warn me about gets but not about scanf?
If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used:
<source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations]
...
0
votes
0answers
50 views
How to avoid segmentation fault in a buffer overflow exploit
I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
0
votes
0answers
71 views
Exploit stdin to call local function in C
Note: this is extra credit for a homework assignment
I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
3
votes
1answer
99 views
Having trouble with learning Buffer Overflows
So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
0
votes
1answer
266 views
Is following code vulnerable?
Consider following C code snippet:
void barfoo (int authstatus) {
char packet[1024];
fgets (packet, 1023, stdin);
if (authstatus != 0)
system (packet);
else
syslog (&...
1
vote
1answer
62 views
CRL date formats and conversion from GMT to epoch
I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists).
I am using the following command openssl asn1parse -inform DER ...
1
vote
1answer
46 views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
-1
votes
1answer
81 views
How a can be decoded as 61 and b as 62…? [closed]
I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms.
I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
0
votes
0answers
62 views
Problem with return 2 libc in 64 bit arch
I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143):
cbcd8: 00 00
cbcda: 4c 89 ea ...
0
votes
0answers
58 views
Reflective DLL Injection using mingw compiles with no Errors, But doesn't work
I've been playing around with the Reflective DLL injection code, I can compile the Dll's in mingw easily and inject them using the original compiled binaries given here. I can also compile the ...
0
votes
1answer
97 views
Send hex code into standard input after getting some output
I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.
I'm trying to input hex code into my ...
2
votes
1answer
129 views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
1
vote
0answers
70 views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
1
vote
1answer
64 views
Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]
Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
2
votes
1answer
53 views
Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?
Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
1
vote
1answer
99 views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
48 views
ASLR doesn't work?
I have following code:
#include <stdio.h>
#include <stdlib.h>
int main()
{
int *ptr1 = malloc(16);
int val1 = 0x12345678;
printf("stack: %p\nheap: %p\n", &...
0
votes
1answer
85 views
Understanding why this buffer overflow attack isn't working
I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
1
vote
1answer
217 views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
0
votes
0answers
37 views
Encforce W^X on a specific program
TL;DR: I want to enforce security rules like W^X in user mode.
So, I am writing a program that will parse input that can be easily be compromised by an adversary (It reads data from a socket that is ...
2
votes
1answer
238 views
Buffer Overflow Works Locally But Not Remotely
So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
3answers
159 views
C Security Code Review
I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
354 views
How to find buffer offset for Return to Libc Attack
I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a ...
0
votes
0answers
167 views
How to exploit this C program to call a certain function?
The goal is to call the function foo in the following program:
struct object {
unsigned char buf[36];
void (*fp)();
};
void baz(struct object * obj, unsigned int num) {
for (int i = 0; i ...
0
votes
0answers
34 views
how to get this into a stack oveflow performed into integer overflow?
I'm trying to understand stack buffer overflow performed by an integer overflow , and am working with a simple piece of code, as below, but however I am not sure how can I add to this code an integer ...
-3
votes
1answer
1k views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE];
printf("%lld\n", (long long) ...
1
vote
0answers
269 views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
166 views
EIP pointing to shellcode but shellcode is not executing?
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
1
vote
0answers
146 views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
1
vote
0answers
166 views
Is overbuffered done on 10th byte past alocated space?
I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
1
vote
2answers
418 views
DLL injector in C doesn't inject the DLL
I am trying to write a DLL injector to perform a DLL injector on a calculator process.
I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
2
votes
1answer
249 views
Buffer Overflow in the C program
I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.
Here is the question. Sorry the original condition ...
2
votes
1answer
185 views
What are the security implications of invalid free()?
CVE-2009-5030
OpenJPEG: Heap memory corruption leading to invalid free
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
allows remote attackers to cause a denial of service (...
1
vote
2answers
87 views
How do I program a function to generate a secure Block Cipher Encryption-Key?
I am currently studying the most widely known encryption algorithms and methodologies. For practice purposes, I want to implement everything from ECB to RSA as some kind of a C crypto library. How ...
1
vote
0answers
703 views
C/C++ code injection
I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
0
votes
0answers
128 views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
-1
votes
2answers
102 views
Buffer Overflow
I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
0answers
127 views
Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?
I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
0
votes
3answers
538 views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
0answers
53 views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
0
votes
1answer
326 views
Stack address is shown less than heap address in C program
I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
1
vote
0answers
100 views
Why is unistd's getpass unsafe?
While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass.
However, this function is being documented as ...
