Questions tagged [c]
The C programming language, commonly used for low-level programming
277
questions
0
votes
0answers
23 views
Segmentation error while buffer overflow but EIP is not overwritten
I have a C program that has a function that is not included in main(). When i try to buffer overflow the program with the adress of the uncalled function, I get a segmentation error but the targeted ...
0
votes
0answers
18 views
Retrieve identifiers in Clang Cindex (Python) [closed]
I'm building a python script that analyzes a given C source code and performs vulnerability assessment (at least that's my intention). I would like to perform the checks base on Clang's AST. In order ...
0
votes
0answers
35 views
Jumping a function inside the code with buffer over flow
My goal is the jump a local function without calling it. Here is my code
#include <stdio.h>
void bufferoverflow()
{
printf("bufferoverlow!\n");
}
void doSomething()
{
int ...
0
votes
1answer
83 views
Private IPC between two processes
I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
1
vote
1answer
135 views
Is there any security flaw in this C program to generate a tabula recta?
In order to generate and store my passwords, I decided to use a tabula recta as described in this article.
So I coded a simple C program to create such a table, I wanted to know if it contained a ...
-1
votes
1answer
114 views
code and memory safety issues
I'm preparing for a computer security exam, and I found this question in previous exams
To create an authentication program, we write a check_auth function as
follows:
int check_auth(char *password) {...
0
votes
1answer
81 views
Buffer overread
I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
0
votes
2answers
68 views
Stack Smashing Short Problem
I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
0
votes
1answer
94 views
Exploting a Stack Buffer Overflow vulnerability to get privilege access to system
I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment.
I understand that writing more than 100 ...
0
votes
0answers
92 views
Trouble understanding buffer overflow to print a string
I have the following program:
#include<stdio.h>
int main() {
int i=0;
foo();
printf("Hello there!");
func();
}
int foo(void) {
char str[14];
strncpy(str,&...
0
votes
0answers
48 views
How to see what functions can be hijacked when abusing LD_PRELOAD?
Given a binary and looking to abuse LD_PRELOAD (privilege escalation or persistence), what's a good way to list what functions can be hijacked when running the binary? Are there functions that should (...
0
votes
1answer
72 views
Segfault after reaching system
I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle.
I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
0
votes
1answer
80 views
Bufferoverflow for small return address
I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload
(...
0
votes
0answers
87 views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
2
votes
1answer
140 views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
2
votes
1answer
179 views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
3
votes
1answer
1k views
How to do string buffter overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
0
votes
0answers
76 views
Exploiting buffer overflow in 64-bit macOS executable
I'm following this tutorial to create a buffer overflow demo. The article illustrates a 32-bit executable, but I'm feeling adventurous and decided to do a 64-bit one. Below is the deliberately ...
1
vote
0answers
74 views
Question on stack overflow
I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
1
vote
1answer
166 views
Why does Kaspersky anti-virus not consider this executable as malicious?
I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code:
#include <stdio.h>
#include <stdlib.h>
int main(...
1
vote
1answer
144 views
The hidden meaning of the source code of the malware?
I'm studying the source code of malware developed in c++ and I have two questions in the source code below
This is probably code that loads malicious dlls into memory.
typedef BOOL (WINAPI *...
0
votes
1answer
147 views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
-1
votes
1answer
72 views
is it possible to call libc function with rop
let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
23
votes
6answers
9k views
Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]
I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
0
votes
1answer
476 views
Can you perform a buffer overflow and a format string attack at the same time?
So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h&...
1
vote
1answer
298 views
Why does my compiler warn me about gets but not about scanf?
If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used:
<source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations]
...
0
votes
0answers
141 views
How to avoid segmentation fault in a buffer overflow exploit
I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
0
votes
0answers
266 views
Exploit stdin to call local function in C
Note: this is extra credit for a homework assignment
I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
3
votes
1answer
118 views
Having trouble with learning Buffer Overflows
So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
0
votes
1answer
321 views
Is following code vulnerable?
Consider following C code snippet:
void barfoo (int authstatus) {
char packet[1024];
fgets (packet, 1023, stdin);
if (authstatus != 0)
system (packet);
else
syslog (&...
1
vote
1answer
134 views
CRL date formats and conversion from GMT to epoch
I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists).
I am using the following command openssl asn1parse -inform DER ...
1
vote
1answer
74 views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
-1
votes
1answer
95 views
How a can be decoded as 61 and b as 62...? [closed]
I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms.
I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
0
votes
0answers
171 views
Problem with return 2 libc in 64 bit arch
I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143):
cbcd8: 00 00
cbcda: 4c 89 ea ...
0
votes
1answer
132 views
Send hex code into standard input after getting some output
I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.
I'm trying to input hex code into my ...
2
votes
1answer
420 views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
1
vote
0answers
124 views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
1
vote
1answer
94 views
Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]
Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
2
votes
1answer
84 views
Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?
Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
1
vote
1answer
124 views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
152 views
ASLR doesn't work?
I have following code:
#include <stdio.h>
#include <stdlib.h>
int main()
{
int *ptr1 = malloc(16);
int val1 = 0x12345678;
printf("stack: %p\nheap: %p\n", &...
0
votes
1answer
172 views
Understanding why this buffer overflow attack isn't working
I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
1
vote
1answer
585 views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
2
votes
1answer
559 views
Buffer Overflow Works Locally But Not Remotely
So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
3answers
245 views
C Security Code Review
I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
2
votes
1answer
936 views
How to find buffer offset for Return to Libc Attack
I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a ...
0
votes
0answers
250 views
How to exploit this C program to call a certain function?
The goal is to call the function foo in the following program:
struct object {
unsigned char buf[36];
void (*fp)();
};
void baz(struct object * obj, unsigned int num) {
for (int i = 0; i ...
-3
votes
1answer
3k views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE];
printf("%lld\n", (long long) ...
1
vote
0answers
519 views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
0
votes
1answer
346 views
EIP pointing to shellcode but shellcode is not executing?
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
