Questions tagged [c]
The C programming language, commonly used for low-level programming
291
questions
2
votes
1
answer
685
views
Format string exploit length
I'm new to Software security and I'm studying it now at the university.
I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
1
vote
0
answers
221
views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
- 33
1
vote
1
answer
152
views
Independent C library or function (on Linux) to programmatically generate a self-signed certificate [closed]
Is there a simple C library or function to programmatically generate a self-signed certificate in C on Ubuntu? Of course, one can execute a simple system("....") call to execute a CLI. I am ...
- 261
2
votes
1
answer
175
views
Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?
Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
- 23
1
vote
1
answer
185
views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
- 33
2
votes
1
answer
554
views
ASLR doesn't work?
I have following code:
#include <stdio.h>
#include <stdlib.h>
int main()
{
int *ptr1 = malloc(16);
int val1 = 0x12345678;
printf("stack: %p\nheap: %p\n", &...
0
votes
1
answer
360
views
Understanding why this buffer overflow attack isn't working
I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
- 101
1
vote
1
answer
1k
views
Writing to .fini_array
I'm learning about format string exploits, and am attempting to use one on an example program to overwrite the .fini_array section in virtual memory with a stack address containing shellcode (and ...
2
votes
1
answer
1k
views
Buffer Overflow Works Locally But Not Remotely
So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
3
answers
399
views
C Security Code Review
I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
- 189
2
votes
1
answer
2k
views
How to find buffer offset for Return to Libc Attack
I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a ...
- 121
0
votes
0
answers
325
views
How to exploit this C program to call a certain function?
The goal is to call the function foo in the following program:
struct object {
unsigned char buf[36];
void (*fp)();
};
void baz(struct object * obj, unsigned int num) {
for (int i = 0; i ...
- 1
-3
votes
1
answer
5k
views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE]...
1
vote
0
answers
755
views
Buffer bomb level 3 - Prevent stack corruption
I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
- 111
0
votes
1
answer
709
views
EIP pointing to shellcode but shellcode is not executing?
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
- 3
2
votes
0
answers
349
views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
- 21
1
vote
0
answers
207
views
Is overbuffered done on 10th byte past alocated space?
I am reading The Shellcoder's Handbook, and having trouble with an exercise. I am trying to jump to an address after I exceed the buffer space. After 36 bytes I write a 4 byte payload with an address ...
- 69
1
vote
2
answers
1k
views
DLL injector in C doesn't inject the DLL
I am trying to write a DLL injector to perform a DLL injector on a calculator process.
I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
- 115
2
votes
1
answer
673
views
Buffer Overflow in the C program
I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming.
Here is the question. Sorry the original condition ...
2
votes
1
answer
397
views
What are the security implications of invalid free()?
CVE-2009-5030
OpenJPEG: Heap memory corruption leading to invalid free
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
allows remote attackers to cause a denial of service (...
- 1,739
1
vote
2
answers
150
views
How do I program a function to generate a secure Block Cipher Encryption-Key?
I am currently studying the most widely known encryption algorithms and methodologies. For practice purposes, I want to implement everything from ECB to RSA as some kind of a C crypto library. How ...
- 165
1
vote
0
answers
1k
views
C/C++ code injection
I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
- 3,492
0
votes
0
answers
258
views
Windows shellcode not working in C
I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works...
I know the shellcode below is all right because it does work in the context ...
- 1
-1
votes
2
answers
159
views
Buffer Overflow
I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the ...
1
vote
0
answers
297
views
Is a Buffer Overflow / NOP Slide possible for memory addresses that contain null bytes?
I have been reading up on Buffer Overflows and NOP Sleds. I tried to use the exploit on an example target and I got stuck because I needed to inject a null byte in the return address for my BP so that ...
- 11
0
votes
3
answers
2k
views
Prevent finding key in C++ application binary
I need to store a key (symmetric-key cryptography) within my C++ application binary (based on OpenCV) so that the key as unidentifiable as possible. Can someone help me choose the key so that is ...
- 209
1
vote
0
answers
125
views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
0
votes
1
answer
589
views
Stack address is shown less than heap address in C program
I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
- 111
6
votes
2
answers
3k
views
Buffer overflow exploit with python3 : wrong return address written
I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
- 61
24
votes
1
answer
6k
views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
- 243
1
vote
2
answers
443
views
In Return-Oriented Programming how can the machine execute unaligned instructions?
I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)".
The author claims that x86 code is like English written without punctuation or spaces, ...
- 130
0
votes
1
answer
2k
views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
- 385
1
vote
0
answers
367
views
Creating X509 certificate in C using post-quantum public key algorithm?
I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
0
votes
1
answer
1k
views
Shellcode as part of format string buffer
I'm currently trying out a simple format string vuln exploit. The target program looks like this:
int main(int argc, char *argv[])
{
char buffer[1024];
strncpy(buffer, argv[1], sizeof(buffer)...
- 105
1
vote
3
answers
3k
views
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? [closed]
I'm talking about the overflow flag that is used in some architectures like x86:
https://en.wikipedia.org/wiki/Overflow_flag
why aren't operating systems using this overflow flag to stop integer ...
- 388
3
votes
1
answer
1k
views
Is zeroing out values on the stack and arguments overkill?
I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance.
...
user189258
0
votes
1
answer
1k
views
Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?
Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
- 567
2
votes
0
answers
577
views
Format String Vulnerability - Can't read an address from stdin with read() in C
I wanted to exploit this code using format string vulnerability:
int jackpot;
void fmt_str(void)
{
char buf[128];
puts("Give me a string to print");
read(0, buf, 128);
printf(buf);
...
- 21
4
votes
1
answer
14k
views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
- 141
1
vote
2
answers
302
views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
- 715
1
vote
0
answers
91
views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
- 6,514
1
vote
0
answers
219
views
Exploiting a Heap Overrun Vulnerability
I am really trying to understand the concept of the attack made possible by the code given below.
I notice that strcpy is being used, which does not perform any boundary checks and therefore enables ...
- 277
1
vote
0
answers
852
views
Buffer overflow shellcode placement
Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
- 11
0
votes
2
answers
3k
views
Example of a double-free vulnerability in C
I hope this is the correct forum to ask for the question that I have:
We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below ...
- 277
1
vote
0
answers
207
views
Limited ESP Length in Buffer Overflow Sample C Program
May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
3
votes
1
answer
3k
views
How does this simple buffer overflow work?
I've got this simple code
vuln.c
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]);
printf("%s", buffer);
...
- 863
1
vote
2
answers
267
views
If C uses shared libraries, is it possible to write a program that will modify the code that opens a file
If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?
- 545
0
votes
2
answers
5k
views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
- 437
1
vote
0
answers
1k
views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
- 149
2
votes
1
answer
2k
views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
- 19