Questions tagged [c]
The C programming language, commonly used for low-level programming
0
votes
0answers
23 views
ettercap packet modification
I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
0
votes
1answer
39 views
How to make a buffer overflow run shell? [on hold]
I have a simple C program that asks for two inputs
I'm trying to overflow them so that I can access a shell, but I'm not sure what I need to do to access the shell.
I can overflow them to just print ...
-1
votes
0answers
68 views
Buffer overflow attack, getting password from locked text file
So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a password behind a locked .txt contains the password. I shouldn't need to use GDB for this.
vuln.c //no ...
2
votes
1answer
166 views
Is zeroing out values on the stack and arguments overkill?
I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance.
...
0
votes
1answer
44 views
Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?
Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
0answers
63 views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
1
vote
1answer
134 views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
2answers
72 views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
0answers
43 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
38 views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
1
vote
0answers
162 views
Buffer overflow shellcode placement
Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
2answers
406 views
Example of a double-free vulnerability in C
I hope this is the correct forum to ask for the question that I have:
We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
1
vote
0answers
40 views
Limited ESP Length in Buffer Overflow Sample C Program
May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1answer
252 views
How does this simple buffer overflow work?
I've got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf("%s", buffer);
...
1
vote
2answers
124 views
If C uses shared libraries, is it possible to write a program that will modify the code that opens a file
If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
0
votes
2answers
324 views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
0answers
240 views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
2
votes
1answer
421 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
2
votes
1answer
52 views
Buffer Overflow protections in custom library
Does a custom library affected by a buffer overflow need to be compiled with protections even if it is linked against an executable which already has protections?
1
vote
1answer
217 views
How to find address of system() in an executable - ROP exploit
I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
1
vote
0answers
262 views
How to find the return address when performing an overflow
for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
0
votes
1answer
108 views
CWE-234 - Snprintf Missing Parameter issues
We are scanning a third party library using a well know static analysis tool here.
We keep getting:
"Failure to Handle Missing Parameter CWE ID 234"
I'm not a C developer but I can't see what is ...
0
votes
1answer
141 views
“Hacking The Art of Exploitation” - format string exploit memory truncation
I am attempting the printf() format parameter exploit where providing the user controlled data directly as the sole argument of the printf("user input") allows for the user to provide format ...
2
votes
0answers
237 views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
0
votes
1answer
423 views
Buffer overflow exploit is leading to Segmentation Fault
#include<stdio.h>
void secret(){
printf("entered secret function");
}
void return_input()
{
char array[60];
scanf("%s", array);
printf("%s\n",array);
}
int main()
{
return_input();
...
0
votes
1answer
102 views
SAT (Satisfiability) it is security risk?
If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
7
votes
1answer
2k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
0
votes
2answers
256 views
Buffer Overflow : segmentation error at 0x90909090
why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?
0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff040: ...
0
votes
0answers
240 views
Openssl SSL_CTX_set_cipher_list() in cross-platform C application
Situation
I am developing a cross-platform C application which uses OpenSSL. I would like to release it for at least the following operating systems:
Windows 7+
MacOS High Sierra
Debian 8+
Ubuntu ...
29
votes
4answers
8k views
I feel like it's impossible to learn reverse engineering [closed]
I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie.
I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
452 views
Overflowing the buffer yet not jumping to address
I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here)
I think understand the basic concept i write more than 64 bytes characters ...
3
votes
1answer
121 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
4
votes
3answers
893 views
What assembly should I learn? [closed]
I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn?
I have prior experience in programming, and I did a degree in Computer Science but ...
3
votes
1answer
543 views
Python - ctypes.cast function call outputs Segmentation Fault error message
Background:
Writing a proof of concept of a twitter C&C inspired by Prof Viviek of SPSE similiar to twittor and the project includes a functionality of injecting shellcode and executing it ...
2
votes
2answers
539 views
Unable to understand $EIP changes with Buffer Overflow
I am learning Buffer Overflow, so the question might seem silly but here it is.
I started with this very simple buggy program
int main(int argc, char *argv[])
{
char buf[128];
printf("You entered ...
1
vote
2answers
108 views
Buffer Overflow problem [closed]
I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't.
...
3
votes
1answer
837 views
Compiling with GCC retpoline flags
As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
1
vote
2answers
323 views
Buffer Overflow Stack Attack Exercise Help
So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
-3
votes
1answer
2k views
How to correctly use dev/urandom for random generation [closed]
Runs before main:
d -c 30 /dev/urandom > random.bytes
Access the randomly generated numbers
int main() {
FILE *fp;
int fd = open("random.bytes",O_RDONLY);
fp = fopen("file.txt" , ...
1
vote
1answer
250 views
Securing .so file access permissions
I work for a place that offers an encryption suite for Android apps in the form of a .so C library to be integrated in Android apps.
The issue is that there is only two exported functions in the .so ...
1
vote
1answer
2k views
Buffer overflow: Why does the ESP Register change its value after access violation
Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
1
vote
1answer
377 views
How do I bypass a return address overwrite not doing anything?
This is main:
(gdb) disass main
Dump of assembler code for function main:
0x000000000040057c <+0>: push rbp
0x000000000040057d <+1>: mov rbp,rsp
0x0000000000400580 <+4&...
1
vote
1answer
362 views
Write zeros in memory through a buffer overflow
Trying to give a command line program an address to overwrite a return address saved in the stack. I could successfully overflow the input argument into the exact return address position but the ...
2
votes
2answers
447 views
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
General Background:
I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending ...
2
votes
1answer
1k views
Shellcode doesn't execute and EIP is overwritten
I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z ...
2
votes
1answer
136 views
Security implications of setting the broadcast flag on a UDP socket
Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
0
votes
1answer
219 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
1
vote
1answer
160 views
Is it possible to write a value larger than 64bit using a format string attack (%n)?
I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can ...
1
vote
2answers
246 views
Why is this shellcode execution considered an exploit?
I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss
Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
2
votes
1answer
4k views
Executing a msfvenom shellcode in C program
This is obviously for educational purposes. I've been interested in learning more about malware and how it works.
I'm trying to get a meterpreter reverse tcp shell working on windows 10 but more ...
