Questions tagged [c]
The C programming language, commonly used for low-level programming
50
questions with no upvoted or accepted answers
4
votes
0
answers
2k
views
Generating RSA keys per the FIPS 186-4 standard
my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
- 41
4
votes
0
answers
733
views
C program - exploit program (after seg fault)
The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary
As part of learning security - I am trying to buffer overflow this program. I ...
- 49
2
votes
0
answers
349
views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
- 21
2
votes
0
answers
577
views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
- 21
2
votes
1
answer
1k
views
How do I bypass a return address overwrite not doing anything?
This is main:
(gdb) disass main
Dump of assembler code for function main:
0x000000000040057c <+0>: push rbp
0x000000000040057d <+1>: mov rbp,rsp
0x0000000000400580 <+4&...
2
votes
0
answers
951
views
Snort Portscan Preprocessor Analysis
Remarks
I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
- 191
2
votes
0
answers
9k
views
verifying digest signed with private key using a C program
I'll explain all the steps I've done so far and conclude with my question.
using OpenSSL 1.0.1e-fips 11 Feb 2013
Generating a private and public key
openssl genrsa -des3 -out private.pem 2048
...
- 121
2
votes
1
answer
2k
views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
- 19
2
votes
1
answer
397
views
What are the security implications of invalid free()?
CVE-2009-5030
OpenJPEG: Heap memory corruption leading to invalid free
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
allows remote attackers to cause a denial of service (...
- 1,739
1
vote
0
answers
117
views
What is missing to reproduce CVE-2022-32250?
I want to reproduce CVE-2022-32250. I found this this git repo as a repository for the exploit and a code proof of concept provided here.
So I installed Ubuntu 22.04 on VM, and installed kernel ...
- 21
1
vote
0
answers
79
views
Unable to take control of RIP register
I am currently following "Hacking: The Art of Exploitation", and I am stuck.
I am trying to fully understand the stack overflow vulnerability.
In the book, the process of overflowing is ...
1
vote
0
answers
133
views
C - Remote string format attack exploit - %n Does not seem to write anything on the stack
[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
- 111
1
vote
0
answers
110
views
Question on stack overflow
I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
- 23
1
vote
0
answers
221
views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
- 33
1
vote
0
answers
755
views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
- 111
1
vote
0
answers
207
views
Is overbuffered done on 10th byte past alocated space?
I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
- 69
1
vote
0
answers
1k
views
C/C++ code injection
I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
- 3,492
1
vote
0
answers
297
views
Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?
I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
- 11
1
vote
0
answers
125
views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
1
vote
0
answers
367
views
Creating X509 certificate in C using post-quantum public key algorithm?
I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
0
answers
91
views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
- 6,514
1
vote
0
answers
219
views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
- 277
1
vote
0
answers
852
views
Buffer overflow shellcode placement
Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
- 11
1
vote
0
answers
207
views
Limited ESP Length in Buffer Overflow Sample C Program
May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
0
answers
1k
views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
- 149
1
vote
0
answers
863
views
How to find the return address when performing an overflow
for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
- 11
1
vote
0
answers
1k
views
Actual example of strcpy exploit?
IIUC the C function strcpy copies the character string x to the character string y .
void strcpy(char x[], char y[]) {
int i = 0;
while (x[i] != 0) {
y[i] = x[i];
i = i + 1;
...
1
vote
0
answers
204
views
Trying to understand stack layout
I'm trying to do this simple string format vulnerability exercise (it's not for homework, university semester ended 1 month ago in Australia).
There's a password checking function that holds the ...
- 23
1
vote
1
answer
4k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
- 11
0
votes
0
answers
42
views
Program segfaults when ran with GDB
this is my first time posting a question here, so forgive me if I don't give enough details. I will provide any extra details that are requested.
Basically, I'm practicing a buffer overflow, and I'm ...
0
votes
1
answer
109
views
64-bit ROP-based Buffer Overflow Attack
I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below:
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/...
0
votes
0
answers
37
views
Making time(0) produce an error
I'm currently reviewing/reversing a software (coded in C) and it has a line like this :
time_t var = time(0);
My goal it to get this time(0) call to return -1.
(I cannot modify the parameter.)
...
- 1
0
votes
0
answers
58
views
_libc_csu_init address is getting corrupted in x86_64
I am trying to bypass the ASLR using the returntoplt attack for this I have to use a gadget pop rdi; ret I was able to find this gadget in __libc_csu_inint but for some reason whenever I use this ...
0
votes
0
answers
52
views
which methods are used beside ASLR for Stack-Randomization?
I've been working with Buffer Overflow attacks, and I would like to know if there is another method for Stack-Randomization beside the ASLR method.
0
votes
0
answers
122
views
Buffer Overflow with ROP Chain Output Problem
I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output.
I want to stop the printf() call in the vuln function to get ...
0
votes
0
answers
277
views
Jumping a function inside the code with buffer over flow
My goal is the jump a local function without calling it. Here is my code
#include <stdio.h>
void bufferoverflow()
{
printf("bufferoverlow!\n");
}
void doSomething()
{
int ...
- 1
0
votes
0
answers
343
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
0
votes
1
answer
316
views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
- 11
0
votes
1
answer
1k
views
Can you perform a buffer overflow and a format string attack at the same time?
So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h&...
- 21
0
votes
0
answers
268
views
How to avoid segmentation fault in a buffer overflow exploit
I have an excersise of making a buffer flow exploit for directing a function insinde another function without calling it. First I need to print "now inside entrance()" then print "now ...
0
votes
0
answers
742
views
Exploit stdin to call local function in C
Note: this is extra credit for a homework assignment
I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
- 1
0
votes
0
answers
290
views
Problem with return 2 libc in 64 bit arch
I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143):
cbcd8: 00 00
cbcda: 4c 89 ea ...
0
votes
0
answers
325
views
How to exploit this C program to call a certain function?
The goal is to call the function foo in the following program:
struct object {
unsigned char buf[36];
void (*fp)();
};
void baz(struct object * obj, unsigned int num) {
for (int i = 0; i ...
- 1
0
votes
0
answers
258
views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
- 1
0
votes
0
answers
254
views
How to adapt my exploit strategy when "00" is part of the targeted return address and the victim uses strcpy
I intend to exploit the following program on an x86 Linux machine with NX enabled (ASLR and stack canary disabled). The goal is to get a shell.
//vuln.c
#include <stdio.h>
#include <string....
- 569
0
votes
0
answers
346
views
Problem in understanding Blakley's Secret Sharing Scheme
I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it.
1. Safeguarding cryptographic keys
2. Two ...
- 907
0
votes
0
answers
529
views
Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?
I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
1
answer
1k
views
Shellcode to buffer overflow not working linux m32
What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it.
I have compiled the program
cc -o real real.c -g -...
- 1
-1
votes
1
answer
182
views
is it possible to call libc function with rop
let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
- 34
-1
votes
2
answers
159
views
Buffer Overflow
I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
