Questions tagged [c]
The C programming language, commonly used for low-level programming
22
votes
1answer
3k views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
1
vote
2answers
83 views
In Return-Oriented Programming how can the machine execute unaligned instructions?
I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)".
The author claims that x86 code is like English written without punctuation or spaces, ...
0
votes
1answer
57 views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
0answers
55 views
Creating X509 certificate in C using post-quantum public key algorithm?
I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
1answer
66 views
Shellcode as part of format string buffer
I'm currently trying out a simple format string vuln exploit. The target program looks like this:
int main(int argc, char *argv[])
{
char buffer[1024];
strncpy(buffer, argv[1], sizeof(buffer)...
0
votes
0answers
38 views
How to find out what program called an API in windows?
Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from ...
1
vote
3answers
241 views
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? [closed]
I'm talking about the overflow flag that is used in some architectures like x86:
https://en.wikipedia.org/wiki/Overflow_flag
why aren't operating systems using this overflow flag to stop integer ...
0
votes
0answers
52 views
ettercap packet modification
I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
2
votes
1answer
179 views
Is zeroing out values on the stack and arguments overkill?
I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance.
...
0
votes
1answer
79 views
Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?
Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
0answers
116 views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
1
vote
1answer
242 views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
2answers
84 views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
0answers
43 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
50 views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
1
vote
0answers
222 views
Buffer overflow shellcode placement
Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
2answers
581 views
Example of a double-free vulnerability in C
I hope this is the correct forum to ask for the question that I have:
We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
1
vote
0answers
45 views
Limited ESP Length in Buffer Overflow Sample C Program
May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
393 views
How does this simple buffer overflow work?
I've got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf("%s", buffer);
...
1
vote
2answers
126 views
If C uses shared libraries, is it possible to write a program that will modify the code that opens a file
If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
0
votes
2answers
509 views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
0answers
308 views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
2
votes
1answer
501 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
2
votes
1answer
55 views
Buffer Overflow protections in custom library
Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
1
vote
1answer
364 views
How to find address of system() in an executable - ROP exploit
I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
1
vote
0answers
308 views
How to find the return address when performing an overflow
for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
0
votes
1answer
117 views
CWE-234 - Snprintf Missing Parameter issues
We are scanning a third party library using a well know static analysis tool here.
We keep getting:
"Failure to Handle Missing Parameter CWE ID 234"
I'm not a C developer but I can't see what is ...
0
votes
1answer
176 views
“Hacking The Art of Exploitation” - format string exploit memory truncation
I am attempting the printf() format parameter exploit where providing the user controlled data directly as the sole argument of the printf("user input") allows for the user to provide format ...
2
votes
0answers
252 views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
0
votes
1answer
543 views
Buffer overflow exploit is leading to Segmentation Fault
#include<stdio.h>
void secret(){
printf("entered secret function");
}
void return_input()
{
char array[60];
scanf("%s", array);
printf("%s\n",array);
}
int main()
{
return_input();
...
0
votes
1answer
104 views
SAT (Satisfiability) it is security risk?
If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
7
votes
1answer
2k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
0
votes
2answers
286 views
Buffer Overflow : segmentation error at 0x90909090
why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?
0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff040: ...
0
votes
0answers
266 views
Openssl SSL_CTX_set_cipher_list() in cross-platform C application
Situation
I am developing a cross-platform C application which uses OpenSSL. I would like to release it for at least the following operating systems:
Windows 7+
MacOS High Sierra
Debian 8+
Ubuntu ...
29
votes
4answers
9k views
I feel like it's impossible to learn reverse engineering [closed]
I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie.
I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
581 views
Overflowing the buffer yet not jumping to address
I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here)
I think understand the basic concept i write more than 64 bytes characters ...
3
votes
1answer
124 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
4
votes
3answers
939 views
What assembly should I learn? [closed]
I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn?
I have prior experience in programming, and I did a degree in Computer Science but ...
3
votes
1answer
578 views
Python - ctypes.cast function call outputs Segmentation Fault error message
Background:
Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
2
votes
2answers
665 views
Unable to understand $EIP changes with Buffer Overflow
I am learning Buffer Overflow, so the question might seem silly but here it is.
I started with this very simple buggy program
int main(int argc, char *argv[])
{
char buf[128];
printf("You entered ...
1
vote
2answers
112 views
Buffer Overflow problem [closed]
I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't.
...
3
votes
1answer
1k views
Compiling with GCC retpoline flags
As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
1
vote
2answers
370 views
Buffer Overflow Stack Attack Exercise Help
So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
-3
votes
1answer
2k views
How to correctly use dev/urandom for random generation [closed]
Runs before main:
d -c 30 /dev/urandom > random.bytes
Access the randomly generated numbers
int main() {
FILE *fp;
int fd = open("random.bytes",O_RDONLY);
fp = fopen("file.txt" , ...
1
vote
1answer
317 views
Securing .so file access permissions
I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps.
The issue is that there is only two exported functions in the .so ...
1
vote
1answer
2k views
Buffer overflow: Why does the ESP Register change its value after access violation
Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
1
vote
1answer
401 views
How do I bypass a return address overwrite not doing anything?
This is main:
(gdb) disass main
Dump of assembler code for function main:
0x000000000040057c <+0>: push rbp
0x000000000040057d <+1>: mov rbp,rsp
0x0000000000400580 <+4&...
1
vote
1answer
408 views
Write zeros in memory through a buffer overflow
Trying to give a command line program an address to overwrite a return address saved in the stack. I could successfully overflow the input argument into the exact return address position but the ...
2
votes
2answers
486 views
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
General Background:
I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending ...
2
votes
1answer
1k views
Shellcode doesn't execute and EIP is overwritten
I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
