Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [code-execution]

The tag has no usage guidance.

1
vote
2answers
62 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
0answers
41 views

Use BlueBorne to get arbitrary code execution on locked-down Android system from 2016

So here's the story. I have this smart watch, the Olio Model One. I would like to install Asteroid OS onto this watch, and in order to do that I have to get root code execution (the objective of this ...
0
votes
0answers
30 views

Execute Injected Shellcode

The environment is Windows XP SP3 32 bit and the programs was compiled with Visual C++ 2008 Express Edition without DEP, ASLR, SafeSEH and SEHOP. I tried to exploit the SEH. I see in WinDBG that the ...
1
vote
1answer
77 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
1
vote
1answer
44 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
1
vote
1answer
68 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
0
votes
3answers
99 views

Executable files in email attachments on UNIX

.EXE files are a danger in email attachments, and are usually blocked by Windows email clients. How is this on UNIX/macOS, where executables don't have an extension? Based on the file data, how do ...
0
votes
1answer
54 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
3
votes
2answers
517 views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
2
votes
2answers
70 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
3
votes
2answers
164 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
0
votes
1answer
70 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
0
votes
1answer
156 views

Electron Framework vulnerability - Explaining remote code execution

Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now ...
11
votes
1answer
375 views

PHP eval code sandbox break

I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php function eval_syntax($code) { $braces = 0; $inString = 0; // We need to know if ...
-1
votes
1answer
84 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
-3
votes
1answer
352 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
6
votes
2answers
1k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
2
votes
2answers
2k views

Adding network drive to trusted intranet sites security hole?

We have a shared network drive that is mapped, and when we open certain files we get a dialog like I found this site which explains that adding the network path to Local Intranet trusted sites for ...
1
vote
0answers
292 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
8
votes
4answers
2k views

Execute a PHP function that returns an array from an XSL file

There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document. So I found a way to make the server interpret my ...
1
vote
1answer
159 views

SERVER-IIS multiple extension code execution attempt

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
0
votes
2answers
152 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...
3
votes
2answers
2k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
6
votes
2answers
2k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
1
vote
0answers
45 views

What was the root cause for the recent (March 2017) Struts2 file upload vulnerability (S2-045)?

The recent Struts2 vulnerability allowed remote code execution by providing a bogus Content-Type header, as explained here: https://threatprotect.qualys.com/2017/03/08/apache-struts-jakarta-multipart-...
1
vote
1answer
303 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
2
votes
2answers
289 views

Can a zipped malware execute?

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute ...
4
votes
1answer
449 views

Special characters in filename leads to starting virus executable [duplicate]

So I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in ...
0
votes
1answer
72 views

Malicious Twilio XML response object [closed]

So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio....
1
vote
1answer
136 views

Large header/footer of shellcode bytes when going from x86 asm to exe?

I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...
2
votes
2answers
494 views

Understanding preg_replace Filtering & Exploitation

Here is the proof of concept of the code: <?php $input=$_GET['input']; print preg_replace('/[A-DH-M0-9._%+-]+@(.+)\.[A-Z]{2,4}/mADsex', 'strtoupper("\\1")', $input); ?> I don't quite ...
1
vote
2answers
708 views

Changing file extensions in PHP file upload to prevent code execution?

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
2
votes
2answers
92 views

With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server?

Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of ...
2
votes
2answers
511 views

Verify “blind” code execution works

Suppose the following situation: You're doing a black-box pentest. You found that the customer runs software X and X has a remote code execution vulnerability, but the nature of this code execution is ...
3
votes
1answer
347 views

Dynamic forking of a process in win32 vs modern antiviruses

Most tutorials about crypters assume that popular antiviruses don't scan programs executed directly from memory. However from what I've seen, some of them (e.g. Nod32) are able to scan RAM in search ...
2
votes
3answers
3k views

Removing execute permissions on `/tmp` or mounting it with `noexec` flag?

The CIS security benchmark recommends mounting /tmp and all other world writable directories on a separate partition so it could be mounted with the noexec flag. Since I already have my /tmp mounted ...
6
votes
1answer
568 views

How to restrict dlopen() from or to certain paths?

If I want to disable execution of programs on a filesystem, I can use the noexec mount option. However, this doesn’t works with dynamic libraries loaded throughdlopen(). So what is the way to do it ...
2
votes
2answers
298 views

Trusted (sealed) execution environment in Linux

Is there any trusted (or sealed) execution environment for Linux that can guarantee the integrity of executable applications? My use-case is like this: I have an executable that reads a file and ...
2
votes
2answers
243 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
1
vote
1answer
83 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
12
votes
1answer
2k views

Will resize of an image execute the file?

Our server was exploited by a ransomware. We allow admins to upload PDF, docx, excel etc. But also images and SVG. And we use dragonfly to generate thumbnails on those files that are supported. Let'...