Questions tagged [c]
The C programming language, commonly used for low-level programming
298
questions
3
votes
3
answers
2k
views
What assembly should I learn? [closed]
I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn?
I have prior experience in programming, and I did a degree in Computer Science but ...
- 66.7k
1
vote
2
answers
236
views
Buffer Overflow problem [closed]
I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't.
...
- 544
1
vote
1
answer
5k
views
Why isn't sophisticated malware written with .NET? [closed]
I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my more than seven years experience in .NET, I feel ...
- 66.7k
1
vote
2
answers
1k
views
Buffer Overflow Stack Attack Exercise Help
So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
- 468
0
votes
1
answer
572
views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
CommunityBot
- 1
3
votes
1
answer
8k
views
Buffer overflow: Why does the ESP Register change its value after access violation
Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
- 615
1
vote
1
answer
2k
views
Write zeros in memory through a buffer overflow
Trying to give a command line program an address to overwrite a return address saved in the stack. I could successfully overflow the input argument into the exact return address position but the ...
- 615
2
votes
2
answers
2k
views
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
General Background:
I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending ...
- 355
8
votes
3
answers
9k
views
Checking client hello for https classification
I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more .
Will it be enough to check client hello ...
CommunityBot
- 1
1
vote
1
answer
494
views
Is it possible to write a value larger than 64bit using a format string attack (%n)?
I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can ...
- 206
1
vote
2
answers
803
views
Why is this shellcode execution considered an exploit?
I found the following "exploit" on Twitter: https://www.exploit-db.com/exploits/43550/?rss
Blogpost about it: https://pentesterslife.blog/2018/01/13/polymorphic-and-smaller-versions-of-three-shell-...
- 16.1k
4
votes
1
answer
14k
views
Executing a msfvenom shellcode in C program
This is obviously for educational purposes. I've been interested in learning more about malware and how it works.
I'm trying to get a meterpreter reverse tcp shell working on windows 10 but more ...
- 16.1k
0
votes
1
answer
6k
views
PEM encoded rsa keys have different sizes
I saved an rsa private key in a binary file (in PEM format), among other data. I knew its offset, but not its size. When I needed to load, I generated a temporary key, and used its size to load the ...
CommunityBot
- 1
-1
votes
1
answer
782
views
Is this integer overflow exploitable?
char buffer[100];
char buffer_size[40];
int i;
fgets(buffer_size,32,stdin);
i = atoi(buffer_size);
if(i+1 < 100)
if(i>=0)
fgets(buffer,i,stdin);
- 65.6k
4
votes
1
answer
5k
views
How does using unsigned integers protect against integer overflow attacks?
In order to avoid problems with integer overflow in C or C++, some people have suggested to use unsigned integers. How can this protect against possible overflow attacks? Doesn't an unsigned integer ...
- 65.6k
0
votes
1
answer
331
views
Integer overflow check not detecting some cases
Something very weird happens when I control my code execution to fish out integer overflows. The control program checks the value of the overflow flag using inline assembly.
Code:
#include <stdio....
- 65.6k
5
votes
1
answer
4k
views
Can anyone explain what Ret2plt means and how it works?
I'm reading about stack overflow protection mechanism like DEP, and it's written that Ret2plt and system() can be used to bypass it.
What is Ret2plt and how does it work? I cannot find a single ...
CommunityBot
- 1
5
votes
1
answer
2k
views
ASLR Randomization BSS
Here is some code:
#include <stdio.h>
#include <string.h>
char globalbuf[256];
void function(char *argv) {
char localbuf[256];
strcpy(localbuf, argv);
strcpy(globalbuf, ...
- 129k
7
votes
2
answers
7k
views
How to exploit variable's value
I'm trying to exploit a binary file which I have access to the source code.
int flag = 0;
int main() {
char buf[0x50];
puts("Who are you? ");
printf("> ");
fgets(buf, 0x50, stdin);...
- 1,289
0
votes
1
answer
361
views
Best way for a beginner to become involved in cybersecurity? [closed]
So I understand cyber security is a very broad topic but all sections I presume require some base skill.
I have a moderate understanding of Python and HTML but all are still very basic. For my Gold D ...
- 2,778
5
votes
3
answers
4k
views
Is `arc4random` secure enough?
I need to generate many many initialization vectors and session keys in C++ code. I am wondering if arc4random is up to the task. Last I heard, there are many weaknesses in the RC4 cipher. Should I ...
- 206
7
votes
1
answer
3k
views
Identifying vulnerabilities in simple program with malloc
My class is without a textbook, or any structured learning material for that matter. I am doing all my learning through googling and while I am picking it up as I am doing it, it is slow going to be ...
- 10.9k
4
votes
0
answers
2k
views
Generating RSA keys per the FIPS 186-4 standard
my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
- 1
-1
votes
1
answer
4k
views
Dirty COW exploit by Bash
I've found many exploits for Dirty COW vulnerability with many methods that written in C programming language.
But I want to test this vulnerability on a target that doesn't have gcc as C compiler (...
- 1,523
8
votes
1
answer
845
views
Exploitation: EIP refuse to jump to the stack although it's executable
I wrote a program in C that is exploitable to BOF.
TL;DR - My payload (NOP-sled + shellcode + return address) overrides EIP but I can't set EIP to point to the
address of my payload, although I ...
8
votes
2
answers
7k
views
Is there any decompiled source code for the "Flame"/"Skywiper" malware?
When searching for the source for Stuxnet, its relatively easy to come by in one form or another. Although I'm actually curious if anyone has done any work to comment the source and perhaps clean up ...
- 1
2
votes
2
answers
266
views
Software overflow exploitation lab
Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
- 1,673
1
vote
2
answers
1k
views
Getting root with setuid and the s flag
Ok, so I'm trying to wrap my head around what the s flag does in linux.
I've got the following code:
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/...
3
votes
1
answer
135
views
Which encryption method should I use when connecting multiple clients to a local server?
Im am currently writing a project in C using OpenSSL/TLS and I am not very experienced in encryption. I have successfully established unencrypted OpenSSL connections and I am relatively experienced in ...
- 201k
0
votes
1
answer
3k
views
How likely is that my ECDHE-RSA-AES256-GCM-SHA384 application will be cracked? [closed]
I am using the following chain in my cipher: ECDHE-RSA-AES256-GCM-SHA384
I am wondering if there's a weak chain in this cipher that might allow my application's communications to be cracked?
I'm new ...
- 7,809
0
votes
1
answer
2k
views
Setting a return address in a simple C exploit
I have an vulnerable program exploitable through the cmdline:
./vuln $(perl -e 'print "\x90"x22'; cat shell; perl -e 'print "\x90"x22';perl -e 'print "\xf4\xdd\xff\xff\xff\x7f"')
���������������������...
CommunityBot
- 1
2
votes
1
answer
2k
views
Problem exploiting Buffer Overflow in a simple C program
I am new to Buffer Overflow exploits and I started with a simple C program.
My program is as follows :
#include <stdio.h>
#include <strings.h>
void execs(void){
printf("yay!!");
}
...
- 123
10
votes
1
answer
17k
views
Exploiting Dirty Cow using Metasploit
I'm testing on some of my Linux Virtual Machines trying to exploit the Dirty Cow Vulnerability and I'm not able to success using Metasploit. First of all... for interested users, a couple of links to "...
- 310
3
votes
0
answers
2k
views
system("/bin/sh") exits without waiting for user input [OverTheWire narnia0 challenge] [closed]
Problem :
Why does system("/bin/sh") process exits immediately instead of waiting for user input?
Code :
int main(){
long val=0x41414141;
char buf[20];
printf("Correct val's value from ...
- 113
2
votes
2
answers
498
views
Which software scans software for potential vulnerabilities?
Is there any kind of parser software analysis tool that will analyze C code and outputs possible vulnerabilities like buffer overflows?
1
vote
1
answer
541
views
Most secure way to read an int32 in C
I was discussing about the subtle issue that you can face when you write in C, so (for fun) I started to create bulletproof code that can read an 32bit integer from stdin.
I wrote this code:
#...
- 165
4
votes
1
answer
291
views
How safe are local variables?
I am writing a kind of dinky program in c which requires the user to enter a username and password. I know it's not really necessary, but I kind of like thinking about the security side of things. I ...
Justin Sanders
10
votes
2
answers
986
views
Are memcpy() based race conditions exploitable for causing remote code execution?
Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
- 1,472
1
vote
0
answers
1k
views
Actual example of strcpy exploit?
IIUC the C function strcpy copies the character string x to the character string y .
void strcpy(char x[], char y[]) {
int i = 0;
while (x[i] != 0) {
y[i] = x[i];
i = i + 1;
...
0
votes
1
answer
361
views
Not able to find "SSH-" string in payload [Port Independent Protocol Detection]?
I was reading the code from ndpi and found this line -
if (packet->payload_packet_len > 7 && packet->payload_packet_len < 100
&& memcmp(packet->payload, "SSH-", 4) ...
- 12.5k
3
votes
1
answer
204
views
Is it safe to call mount(2) and pass the password as a parameter?
I wanted to write a daemon that users can start, and that, every 2 hours, automatically mounts an authenticated network share. The daemon will prompt the user for the password only the first time, and ...
CommunityBot
- 1
13
votes
1
answer
8k
views
How to exactly create a CVE? [duplicate]
I found an heap overflow exploit for a vulnerability in git servers. This lead to lucrative operations on various bug bounty programs (GitHub already promised to put me in their top 10).
When it was ...
CommunityBot
- 1
1
vote
2
answers
513
views
Buffer overflow attack
I am learning about buffer overflow attacks and one thing that i am not able to understand is that in most operating systems an stack is may not necessarily be a contiguous block of memory in the ...
- 1,416
2
votes
1
answer
908
views
Is it possible to execute code in this program using heap overflow?
Program code (with Pseudo code part):
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv)
{
int controlled1=10;
int controlled2=20;
int controlled3=300;
//test.bin ...
- 65.6k
1
vote
1
answer
1k
views
Coding to detect DDOS [closed]
I need to code a program in order to detect a DDOS attack. I'm not sure what's better:
1) use TCPDUMP in order to listen to the interface
2) code my own way to listen to the interface (using C ...
- 119
2
votes
1
answer
727
views
Interactive shell not opening
I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell.
When I type ...
CommunityBot
- 1
1
vote
1
answer
391
views
CVE-2016-6254 - Understanding Heap Overflow
Trying to understand this piece of code:
It containts Heap Buffer Overflow Vulnerability:
static int parse_packet (sockent_t *se, /* {{{ */
void *buffer, size_t buffer_size, int flags,
...
- 997
4
votes
3
answers
917
views
Why strace isn't showing system call being made in shellcode?
I'm new to shellcoding.
I have written assembly code :
section .text
global _start
_start:
jmp end
start:
;open file
pop ebx ; get address of filename
xor eax,eax
mov [ebx+3], al
mov al,...
- 3,023
4
votes
2
answers
620
views
Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?
The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script :
static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
- 2,654
5
votes
2
answers
749
views
Privilege escalation fails outside gdb
I have an application with the following source code:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
char buffer[12];
strcpy(buffer, str);
...
CommunityBot
- 1