Questions tagged [code-execution]

The process of executing code, either maliciously or not, on a system or device. The term is often used when talking about code injection vulnerabilities.

Filter by
Sorted by
Tagged with
-2
votes
0answers
46 views

Can someone tell me what is wrong with this file? [closed]

So today i downloaded a game but when i open it i get an error. A friend gave me the game. The error: The program can't start because api-ms-win-crt-runtime-l1-1-0.dll is missing It it my computer or ...
1
vote
4answers
115 views

Is it possible to detect malicious software just by analyzing the code structure?

I'm a newbie to software security. I'm designing a network and I was wondering is it possible to detect if a program upgrade being downloaded on the network is malicious just by analyzing the ...
0
votes
0answers
54 views

Questions about process hollowing

When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
0
votes
1answer
305 views

Explanation of persistent full-chain kernel code execution

My question Meaning of persistent full-chain -- ? What is the difference between OS-level CE and Kernel level CE? How do OS-level CE and Kernel level CE differentiate in impacting a system? Rarity ...
3
votes
1answer
478 views

How can we embed an exe containing a payload into a pdf file [closed]

I have created an exe with a payload which gives me a meterpreter session. But I need to embed this exe into a pdf. Upon opening the pdf the exe ideally should get executed. Is there any way to do ...
1
vote
1answer
69 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
2
votes
3answers
397 views

How does buffer overread cause arbitrary code execution?

Referenced in the recent VLC vulnerability and other places, apparently buffer overreads can cause arbitrary code execution. How does it do that? Suppose in the following toy example void badcpy(...
1
vote
1answer
249 views

How much protection does sandbox software provide against malicious .exe?

I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
0
votes
0answers
261 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0answers
68 views

Is php code with such features vulnerable to RCE?

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library. Here are the things I found I can make this library do for me: Include (include_once call) any ...
0
votes
2answers
235 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
0
votes
1answer
83 views

PHP code execution attempts on an ASP website

I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
7
votes
1answer
371 views

Can I inject a shell command here in PHP?

During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec() $arg = $_GET['arg']; // sanitization, I suppose... if(...
1
vote
0answers
63 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
2answers
259 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
4
votes
1answer
135 views

How do services prevent malicious behavior when executing user provided code?

Some services such as Github allows the execution of user supplied code using docker containers via Github Actions. Another example of a service provider that executes user provided code are ...
2
votes
1answer
75 views

PHP Code execution in function parameters and logical operators [closed]

After wondering about this and trying to better understanding, I tried the folowing code: is_string(3 and sleep(30)); Why PHP will execute code inside a parameter function (sleep in is_string) ? ...
0
votes
1answer
175 views

How to fix WordPress CVE vulnerabilities or preventive measures?

I have a WordPress site running on version 4.9.8. In the recent security audit done by the organization following issues were reported. 1) Wordpress: CVE-2017-1000600: Input Validation vulnerability ...
1
vote
2answers
159 views

How can memory problems lead to code execution exploits? [closed]

In reports on security exploits/vulnerabilities on desktop applications, I often read that memory problems lead to the execution of malicious code. For example, the description of Internet Explorer ...
1
vote
3answers
134 views

Binary to ASCII encoding for making files non executable

Isn't it a good idea to transfer eg an .wav file, which can carry malware inside (header, data etc.), to ASCII text file via hexdump? I would have achieved a non-executable format. It is still ...
3
votes
1answer
63 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
1
vote
0answers
32 views

Web application secrets protection following code execution

I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
2answers
2k views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
2
votes
1answer
387 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
1
vote
1answer
54 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
1
vote
1answer
144 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
0
votes
3answers
184 views

Executable files in email attachments on UNIX

.EXE files are a danger in email attachments, and are usually blocked by Windows email clients. How is this on UNIX/macOS, where executables don't have an extension? Based on the file data, how do ...
0
votes
1answer
69 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
3
votes
2answers
3k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
2
votes
2answers
75 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
3
votes
2answers
204 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
0
votes
1answer
92 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
0
votes
1answer
208 views

Electron Framework vulnerability - Explaining remote code execution

Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now ...
11
votes
1answer
687 views

PHP eval code sandbox break

I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php function eval_syntax($code) { $braces = 0; $inString = 0; // We need to know if ...
-1
votes
1answer
104 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
-3
votes
1answer
751 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
7
votes
2answers
4k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
3
votes
2answers
9k views

Adding network drive to trusted intranet sites security hole?

We have a shared network drive that is mapped, and when we open certain files we get a dialog like I found this site which explains that adding the network path to Local Intranet trusted sites for ...
1
vote
0answers
555 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
10
votes
4answers
5k views

Execute a PHP function that returns an array from an XSL file

There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document. So I found a way to make the server interpret my ...
1
vote
1answer
340 views

SERVER-IIS multiple extension code execution attempt

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
0
votes
2answers
259 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...
5
votes
2answers
5k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
8
votes
2answers
7k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
1
vote
0answers
65 views

What was the root cause for the recent (March 2017) Struts2 file upload vulnerability (S2-045)?

The recent Struts2 vulnerability allowed remote code execution by providing a bogus Content-Type header, as explained here: https://threatprotect.qualys.com/2017/03/08/apache-struts-jakarta-multipart-...
1
vote
1answer
774 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
2
votes
2answers
676 views

Can a zipped malware execute?

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute ...
4
votes
1answer
712 views

Special characters in filename leads to starting virus executable [duplicate]

So I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in ...
0
votes
1answer
91 views

Malicious Twilio XML response object [closed]

So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio....
1
vote
1answer
199 views

Large header/footer of shellcode bytes when going from x86 asm to exe?

I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...