Questions tagged [c]
The C programming language, commonly used for low-level programming
291
questions
0
votes
1
answer
316
views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
CommunityBot
- 1
0
votes
1
answer
1k
views
Can you perform a buffer overflow and a format string attack at the same time?
So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h&...
CommunityBot
- 1
0
votes
1
answer
109
views
64-bit ROP-based Buffer Overflow Attack
I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below:
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/...
CommunityBot
- 1
1
vote
1
answer
4k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
CommunityBot
- 1
2
votes
1
answer
1k
views
How do I bypass a return address overwrite not doing anything?
This is main:
(gdb) disass main
Dump of assembler code for function main:
0x000000000040057c <+0>: push rbp
0x000000000040057d <+1>: mov rbp,rsp
0x0000000000400580 <+4&...
CommunityBot
- 1
0
votes
0
answers
42
views
Program segfaults when ran with GDB
this is my first time posting a question here, so forgive me if I don't give enough details. I will provide any extra details that are requested.
Basically, I'm practicing a buffer overflow, and I'm ...
5
votes
4
answers
9k
views
Is this integer overflow vulnerability exploitable?
Is this integer overflow exploitable and if the answer is yes, how can i exploit it?
char buffer[20];
int len = atoi(argv[1]);
if(len < 20)
memcpy(buffer,argv[2],len);
If I set len to -1 the ...
- 2,105
4
votes
1
answer
8k
views
How to do string buffer overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
0
votes
1
answer
103
views
Vulnerability in the source code, but can't elevate do Privilege Escalation
Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
- 127k
0
votes
1
answer
308
views
Exploting a Stack Buffer Overflow vulnerability to get privilege access to system
I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment.
I understand that writing more than 100 ...
CommunityBot
- 1
2
votes
1
answer
96
views
Void pointer and their attribute constructor
I am supposed to find the vulnerability in the code (as a part of a ctf) and I feel it's hidden either in the __attribute__((constructor)) or the pointer.
Here I can make out that it's a void pointer ...
1
vote
1
answer
43
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 11
1
vote
1
answer
184
views
Is obtaining a shell from this buffer overflow possible?
I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address.
In these cases, you can hijack a ...
CommunityBot
- 1
4
votes
1
answer
1k
views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
CommunityBot
- 1
1
vote
0
answers
117
views
What is missing to reproduce CVE-2022-32250?
I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here.
So I installed Ubuntu 22.04 on VM, and installed kernel ...
- 127k
1
vote
0
answers
79
views
Unable to take control of RIP register
I am currently following "Hacking: The Art of Exploitation", and I am stuck.
I am trying to fully understand the stack overflow vulnerability.
In the book, the process of overflowing is ...
0
votes
0
answers
37
views
Making time(0) produce an error
I'm currently reviewing/reversing a software (coded in C) and it has a line like this :
time_t var = time(0);
My goal it to get this time(0) call to return -1.
(I cannot modify the parameter.)
...
- 1
1
vote
2
answers
476
views
Finding offset using Buffer overflow pattern generator
I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator
#include <stdio.h>
#include <string.h>
int main (int argc, ...
- 127k
-3
votes
1
answer
5k
views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE]...
- 776
0
votes
0
answers
58
views
_libc_csu_init address is getting corrupted in x86_64
I am trying to bypass the ASLR using the returntoplt attack for this I have to use a gadget pop rdi; ret I was able to find this gadget in __libc_csu_inint but for some reason whenever I use this ...
0
votes
0
answers
52
views
which methods are used beside ASLR for Stack-Randomization?
I've been working with Buffer Overflow attacks, and I would like to know if there is another method for Stack-Randomization beside the ASLR method.
- 1,552
0
votes
1
answer
284
views
Send hex code into standard input after getting some output
I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.
I'm trying to input hex code into my ...
CommunityBot
- 1
0
votes
0
answers
122
views
Buffer Overflow with ROP Chain Output Problem
I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output.
I want to stop the printf() call in the vuln function to get ...
- 1,726
0
votes
1
answer
840
views
Why do I get a broken pipe when using pwntool with this C code
I am learning about Buffer Overflows (BOF) and came up with this piece of C code:
#include <stdio.h>
#include <stdlib.h>
void win()
{
system("/bin/bash");
}
int main()
{...
- 126
-3
votes
1
answer
126
views
Decode Encrypted Password help me [duplicate]
Help me to decode belove password
68H++v5FX/kUty5/itzflw== Above is password store in sql table
- 21.6k
20
votes
6
answers
6k
views
Do high level languages allow for buffer / heap overflow?
I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
CommunityBot
- 1
2
votes
1
answer
685
views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
CommunityBot
- 1
2
votes
2
answers
207
views
Is an open TCP port that doesn’t take input secure?
I have written a simple C program (~30 lines) that opens an internet socket and sends data to the client on every connection. The program never read()s from the socket; it just parses the /proc ...
- 1,030
1
vote
1
answer
1k
views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
0
votes
2
answers
242
views
I invoked undefined behaviour. Do I need a new computer?
Suppose I'm working on a computer and write a C program which invokes undefined behaviour. Since anything may have occurred, a (perhaps paranoid view) would be that anything the computer does ...
CommunityBot
- 1
2
votes
1
answer
144
views
Avoid stack addresses containing zeros
I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).
...
- 131
1
vote
0
answers
133
views
C - Remote string format attack exploit - %n Does not seem to write anything on the stack
[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
- 111
3
votes
2
answers
4k
views
Base64 encode differences in BCrypt implemenations
I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of the salt.
What is the effect, if any, of the ...
- 103
1
vote
3
answers
2k
views
Linux Script SUID Wrapper
Is using a wrapper to execute a script a good practice ?
In such case can the following set of wrapper / script be considered as safe:
wrapper.c
#include <stdio.h>
#include <stdlib.h>
#...
- 101
15
votes
8
answers
17k
views
Secure memcpy for pure C
Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...
Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
- 2,084
0
votes
0
answers
277
views
Jumping a function inside the code with buffer over flow
My goal is the jump a local function without calling it. Here is my code
#include <stdio.h>
void bufferoverflow()
{
printf("bufferoverlow!\n");
}
void doSomething()
{
int ...
- 1
0
votes
2
answers
140
views
Stack Smashing Short Problem
I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using ...
- 4,940
1
vote
0
answers
755
views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
- 1
0
votes
1
answer
269
views
Segfault after reaching system
I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle.
I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
- 101
2
votes
1
answer
649
views
Private IPC between two processes
I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
- 44k
1
vote
1
answer
170
views
Is there any security flaw in this C program to generate a tabula recta?
In order to generate and store my passwords, I decided to use a tabula recta as described in this article.
So I coded a simple C program to create such a table, I wanted to know if it contained a ...
- 127k
-1
votes
1
answer
179
views
code and memory safety issues
I'm preparing for a computer security exam, and I found this question in previous exams
To create an authentication program, we write a check_auth function as
follows:
int check_auth(char *password) {...
- 11.4k
0
votes
1
answer
276
views
Buffer overread
I am trying to understand buffer overread in my course in school. This code is an example from one of the lectures where buffer overread can be a problem. However, I do not understand how buffer ...
0
votes
1
answer
238
views
Bufferoverflow for small return address
I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload
(...
- 12.6k
0
votes
0
answers
343
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
1
vote
1
answer
146
views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
CommunityBot
- 1
3
votes
1
answer
1k
views
Is zeroing out values on the stack and arguments overkill?
I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance.
...
- 196
2
votes
1
answer
219
views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
- 127k
5
votes
1
answer
271
views
Will Intel's MPX extension make C/C++ completely safe to use?
This is apparently an extension that will eliminate buffer overflow and format string vulnerabilities in C/C++ programs, I would guess by providing hardware support for, e.g. converting scanf to fgets ...
- 127k
11
votes
2
answers
7k
views
Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?
Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone.
I have a simple HTTP server that I want to ...
CommunityBot
- 1