Questions tagged [c]
The C programming language, commonly used for low-level programming
236
questions
0
votes
0answers
27 views
how to get this into a stack oveflow performed into integer overflow?
I'm trying to understand stack buffer overflow performed by an integer overflow , and am working with a simple piece of code, as below, but however I am not sure how can I add to this code an integer ...
-3
votes
1answer
162 views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE];
printf("%lld\n", (long long) ...
-1
votes
0answers
37 views
Libcap filter is not filtering the right packets
I am trying to do 'rst hijacking' by using a c script with libcap and libnet included.
I use libcap to sniff all packets coming from and going to a host given as input to the program via the ...
1
vote
0answers
83 views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
70 views
EIP pointing to shellcode but shellcode is not executing?
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
1
vote
0answers
75 views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
1
vote
0answers
162 views
Is overbuffered done on 10th byte past alocated space?
I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
1
vote
2answers
163 views
DLL injector in C doesn't inject the DLL
I am trying to write a DLL injector to perform a DLL injector on a calculator process.
I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
1
vote
1answer
163 views
Buffer Overflow in the C program
I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.
Here is the question. Sorry the original condition ...
2
votes
1answer
173 views
What are the security implications of invalid free()?
CVE-2009-5030
OpenJPEG: Heap memory corruption leading to invalid free
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
allows remote attackers to cause a denial of service (...
1
vote
2answers
83 views
How do I program a function to generate a secure Block Cipher Encryption-Key?
I am currently studying the most widely known encryption algorithms and methodologies. For practice purposes, I want to implement everything from ECB to RSA as some kind of a C crypto library. How ...
1
vote
0answers
365 views
C/C++ code injection
I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
0
votes
0answers
47 views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
-1
votes
2answers
93 views
Buffer Overflow
I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
0answers
82 views
Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?
I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
0
votes
0answers
60 views
Failure to execute shellcode
I'm trying to understand exploits that hijack the execution flow. Before exploiting a buffer overflow vulnerability, I'm just trying to set an environment variable to my shellcode and jump to it. So, ...
0
votes
3answers
259 views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
1
vote
0answers
52 views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
0
votes
1answer
132 views
Stack address is shown less than heap address in C program
I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
0
votes
0answers
70 views
Side channel resistant of Intel TinyCrypt library
Is the TinyCrypt library side channel resistant.
I found a mentioned in the "Genral Remarks" on github. But it is mentioned that it is not fully side channel resistant.
Does anyone know the extend ...
1
vote
0answers
66 views
Why is unistd's getpass unsafe?
While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass.
However, this function is being documented as ...
5
votes
2answers
584 views
Buffer overflow exploit with python3 : wrong return address written
I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
23
votes
1answer
4k views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
1
vote
2answers
214 views
In Return-Oriented Programming how can the machine execute unaligned instructions?
I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)".
The author claims that x86 code is like English written without punctuation or spaces, ...
0
votes
1answer
79 views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
0answers
205 views
Creating X509 certificate in C using post-quantum public key algorithm?
I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
1answer
203 views
Shellcode as part of format string buffer
I'm currently trying out a simple format string vuln exploit. The target program looks like this:
int main(int argc, char *argv[])
{
char buffer[1024];
strncpy(buffer, argv[1], sizeof(buffer)...
0
votes
0answers
41 views
How to find out what program called an API in windows?
Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from ...
1
vote
3answers
669 views
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? [closed]
I'm talking about the overflow flag that is used in some architectures like x86:
https://en.wikipedia.org/wiki/Overflow_flag
why aren't operating systems using this overflow flag to stop integer ...
0
votes
0answers
171 views
ettercap packet modification
I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
2
votes
1answer
346 views
Is zeroing out values on the stack and arguments overkill?
I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance.
...
0
votes
1answer
344 views
Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?
Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
0answers
270 views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
2
votes
1answer
1k views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
2answers
145 views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
0answers
49 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
117 views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
1
vote
0answers
334 views
Buffer overflow shellcode placement
Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
2answers
1k views
Example of a double-free vulnerability in C
I hope this is the correct forum to ask for the question that I have:
We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
1
vote
0answers
66 views
Limited ESP Length in Buffer Overflow Sample C Program
May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
990 views
How does this simple buffer overflow work?
I've got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf("%s", buffer);
...
1
vote
2answers
137 views
If C uses shared libraries, is it possible to write a program that will modify the code that opens a file
If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
0
votes
2answers
1k views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
0answers
520 views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
2
votes
1answer
899 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
2
votes
1answer
64 views
Buffer Overflow protections in custom library
Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
1
vote
1answer
2k views
How to find address of system() in an executable - ROP exploit
I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
1
vote
0answers
555 views
How to find the return address when performing an overflow
for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
0
votes
1answer
145 views
CWE-234 - Snprintf Missing Parameter issues
We are scanning a third party library using a well know static analysis tool here.
We keep getting:
"Failure to Handle Missing Parameter CWE ID 234"
I'm not a C developer but I can't see what is ...
0
votes
1answer
340 views
“Hacking The Art of Exploitation” - format string exploit memory truncation
I am attempting the printf() format parameter exploit where providing the user controlled data directly as the sole argument of the printf("user input") allows for the user to provide format ...
