Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [code-execution]

The tag has no usage guidance.

0
votes
0answers
25 views

lightweight techniques to protecting the integrity and confidentiality of mobile code

I have a code that I want to execute on probably more than one machine. To provide confidentiality, we can use cryptographic algorithms to encrypt the code during "migration". For code integrity, I ...
1
vote
3answers
91 views

Binary to ASCII encoding for making files non executable

Isn't it a good idea to transfer eg an .wav file, which can carry malware inside (header, data etc.), to ASCII text file via hexdump? I would have achieved a non-executable format. It is still ...
3
votes
1answer
50 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
1
vote
0answers
29 views

Web application secrets protection following code execution

I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
2answers
98 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
0answers
49 views

Use BlueBorne to get arbitrary code execution on locked-down Android system from 2016

So here's the story. I have this smart watch, the Olio Model One. I would like to install Asteroid OS onto this watch, and in order to do that I have to get root code execution (the objective of this ...
0
votes
0answers
45 views

Execute Injected Shellcode

The environment is Windows XP SP3 32 bit and the programs was compiled with Visual C++ 2008 Express Edition without DEP, ASLR, SafeSEH and SEHOP. I tried to exploit the SEH. I see in WinDBG that the ...
2
votes
1answer
131 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
1
vote
1answer
45 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
1
vote
1answer
74 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
0
votes
3answers
107 views

Executable files in email attachments on UNIX

.EXE files are a danger in email attachments, and are usually blocked by Windows email clients. How is this on UNIX/macOS, where executables don't have an extension? Based on the file data, how do ...
0
votes
1answer
55 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
3
votes
2answers
736 views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
2
votes
2answers
70 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
3
votes
2answers
166 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
0
votes
1answer
72 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
0
votes
1answer
162 views

Electron Framework vulnerability - Explaining remote code execution

Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now ...
11
votes
1answer
433 views

PHP eval code sandbox break

I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php function eval_syntax($code) { $braces = 0; $inString = 0; // We need to know if ...
-1
votes
1answer
86 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
-3
votes
1answer
372 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
6
votes
2answers
2k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
2
votes
2answers
3k views

Adding network drive to trusted intranet sites security hole?

We have a shared network drive that is mapped, and when we open certain files we get a dialog like I found this site which explains that adding the network path to Local Intranet trusted sites for ...
1
vote
0answers
307 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
8
votes
4answers
2k views

Execute a PHP function that returns an array from an XSL file

There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document. So I found a way to make the server interpret my ...
1
vote
1answer
197 views

SERVER-IIS multiple extension code execution attempt

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
0
votes
2answers
166 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...
3
votes
2answers
3k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
6
votes
2answers
3k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
1
vote
0answers
49 views

What was the root cause for the recent (March 2017) Struts2 file upload vulnerability (S2-045)?

The recent Struts2 vulnerability allowed remote code execution by providing a bogus Content-Type header, as explained here: https://threatprotect.qualys.com/2017/03/08/apache-struts-jakarta-multipart-...
1
vote
1answer
340 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
2
votes
2answers
321 views

Can a zipped malware execute?

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute ...
4
votes
1answer
476 views

Special characters in filename leads to starting virus executable [duplicate]

So I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in ...
0
votes
1answer
78 views

Malicious Twilio XML response object [closed]

So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio....
1
vote
1answer
146 views

Large header/footer of shellcode bytes when going from x86 asm to exe?

I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...
2
votes
2answers
539 views

Understanding preg_replace Filtering & Exploitation

Here is the proof of concept of the code: <?php $input=$_GET['input']; print preg_replace('/[A-DH-M0-9._%+-]+@(.+)\.[A-Z]{2,4}/mADsex', 'strtoupper("\\1")', $input); ?> I don't quite ...
1
vote
2answers
760 views

Changing file extensions in PHP file upload to prevent code execution?

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
2
votes
2answers
104 views

With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server?

Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of ...
2
votes
2answers
597 views

Verify “blind” code execution works

Suppose the following situation: You're doing a black-box pentest. You found that the customer runs software X and X has a remote code execution vulnerability, but the nature of this code execution is ...
3
votes
1answer
354 views

Dynamic forking of a process in win32 vs modern antiviruses

Most tutorials about crypters assume that popular antiviruses don't scan programs executed directly from memory. However from what I've seen, some of them (e.g. Nod32) are able to scan RAM in search ...
2
votes
3answers
4k views

Removing execute permissions on `/tmp` or mounting it with `noexec` flag?

The CIS security benchmark recommends mounting /tmp and all other world writable directories on a separate partition so it could be mounted with the noexec flag. Since I already have my /tmp mounted ...
6
votes
1answer
596 views

How to restrict dlopen() from or to certain paths?

If I want to disable execution of programs on a filesystem, I can use the noexec mount option. However, this doesn’t works with dynamic libraries loaded throughdlopen(). So what is the way to do it ...
2
votes
2answers
334 views

Trusted (sealed) execution environment in Linux

Is there any trusted (or sealed) execution environment for Linux that can guarantee the integrity of executable applications? My use-case is like this: I have an executable that reads a file and ...
2
votes
2answers
262 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
1
vote
1answer
83 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
12
votes
1answer
2k views

Will resize of an image execute the file?

Our server was exploited by a ransomware. We allow admins to upload PDF, docx, excel etc. But also images and SVG. And we use dragonfly to generate thumbnails on those files that are supported. Let'...