Questions tagged [code-execution]
The process of executing code, either maliciously or not, on a system or device. The term is often used when talking about code injection vulnerabilities.
94
questions
11
votes
3
answers
4k
views
Filter arbitrary code for blacklisted keywords except on commented lines
I have a Rust-app executing Python-scripts using PyO3. The Python-scripts are uploaded by users, so I need to check for unsafe code before executing it. The scripts should only be able to do ...
0
votes
0
answers
71
views
Securing arbitrary code execution in Rust
I have a Rust application receiving a lot of data. The programmer can make different Python files to test different algorithms on that same data. He uploads the Python file and in Rust the Python-file ...
0
votes
2
answers
217
views
execute command in go without storing the command in a .exe file
I am trying to do a go program to execute a .exe file, but without be actually a .exe file. The idea is to read the executable from a .txt file and decode it (it is in base64). Once I hava that code ...
0
votes
1
answer
360
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
0
votes
1
answer
123
views
What are all ways to run code at Windows startup?
I'm the attacker. What are all the options to run code at the Windows startup:
If I have administrator rights?
If I have normal user rights?
Can someone put any program (or script) in this method or ...
0
votes
0
answers
335
views
Help creating an exploit for CVE-2019-11500
I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
1
vote
2
answers
880
views
Check if javascript in pdf is malicious
I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf:
How do I check if this is malicious code?
1
vote
3
answers
1k
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
-1
votes
1
answer
84
views
Recommended way to merge a security feature with the rest of the software? [closed]
I am searching for the best way to merge two parts of software together, so it would be as hard as possible to separate them again through reverse engineering.
At the moment are both parts python, but ...
0
votes
2
answers
313
views
How can code signing posibly be secure on Windows when signed executables act on unsigned input?
As a security measure, my Windows-based work computer has been configured to deny any application that hasn't been signed with a valid certificate; my system will run a signed executable from DropBox'...
1
vote
2
answers
2k
views
Security Implications from Base64 Image
I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
2
votes
1
answer
227
views
Remote code execution after a valid SMB (net use) password in Windows?
I am doing a capture-the-flag exercise in a Windows scenario.
It uses Windows 2016 server. I was able to find the password and I can access the files with a:
net use z: \\computer\C$ password /user:...
0
votes
1
answer
2k
views
What can I do with a Pdf upload vulnerability on a CTF server?
A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
0
votes
0
answers
119
views
What ways a website could hack a device? [duplicate]
Is it possible that clicking a link would hack a device?
For example:
injecting a malicious code into the device directly from the link's host website
connecting to the device remotely in a way ...
0
votes
0
answers
104
views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
0
votes
1
answer
162
views
Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?
When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
1
vote
2
answers
492
views
Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
1
vote
0
answers
152
views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
1
vote
1
answer
160
views
Why don't computers enforce immutable address spaces for execution?
A piece of malware detects signatures of the sandbox an AV solution tries to use to fingerprint malicious behavior and pretends to be innocent. Once in the real OS environment, it then downloads ...
3
votes
1
answer
933
views
Is it possible to embed a phar archive into a PNG image?
I know it's possible to embed phar archives into jpeg images but is it also possible to do so with PNG images? I am testing a php application that securely checks if an image is a valid PNG image ...
1
vote
1
answer
110
views
CLI application running user defined command periodically [closed]
For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications ...
1
vote
1
answer
280
views
Wayback machine downloading a file called default.exe?
When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe".
Since I was expecting ...
0
votes
1
answer
130
views
How can I find out what's in this NASA JPL "Spy" command line program for macOS and how safe it is?
Discussion under this answer in Space Exploration SE links to items in NAIF; NASA Planetary Data System Navigation Node links for MacIntel_OSX_64bit
I'm looking at these two.
spy: https://naif.jpl....
0
votes
2
answers
314
views
How to put executable code in files? [closed]
I have PDF, Word and MP4 files on my site and I want to protect them from illegal downloading even if my site hacked. I want to put executable code in the files, so if someone downloads and opens them,...
0
votes
1
answer
400
views
Allowing the execution of arbitrary code in python
Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter ...
1
vote
1
answer
173
views
Can uncompressing a ZIP/tar.gz/rar/etc file execute some custom code?
So I recently downloaded Tor Browser on my Linux machine and what immediately caught my eye is the fact that after uncompressing the file (I think it was .tar.gz, but the question applies to every ...
1
vote
0
answers
98
views
Android: what attack vectors are introduced by calling native code from the web (JS)?
I work on a large e-commerce project, the app in question is written in Kotlin (legacy code in Java). Recently we got the following question from the web team which instantly triggered my alarm bells: ...
0
votes
1
answer
666
views
How are games and software executables injected with custom code & without breaking offset?
Introduction – Context
Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life.
These applications inject their own code ...
1
vote
1
answer
181
views
Build and execute code on a sandboxed environment?
Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
0
votes
1
answer
526
views
Is it safe to automatically parse text as markdown?
I have a server, which receives text mails from students and I plan to automatically collect their message bodys and parse them as markdown so that I can generate a nicely formatted output as pdf. Is ...
0
votes
2
answers
2k
views
Can't execute shell i uploaded with cURL
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn't execute (confirmed with a packet ...
0
votes
1
answer
105
views
Protect password from apache user by making file executable-only
I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
1
vote
0
answers
273
views
Process hollowing and the Import Address Table
I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions.
Why aren't we building the IAT when we load our injected PE? All we do is ...
2
votes
0
answers
150
views
Can binary firmware packages be executed on the system?
Kernels like linux-libre (standard in Debian and other free Linux distributions) ship no binary firmware packages by default.
From my limited understanding of their functionality, a binary firmware ...
3
votes
1
answer
3k
views
Safe usage of Runtime.getRuntime.exec(String[])
I was reviewing code of an application that uses the following piece of Java code and wanted to know if the the use of exec() was susceptible to command injection.
public class FindFileInDir {
...
1
vote
4
answers
187
views
Is it possible to detect malicious software just by analyzing the code structure?
I'm a newbie to software security. I'm designing a network and I was wondering is it possible to detect if a program upgrade being downloaded on the network is malicious just by analyzing the ...
2
votes
1
answer
3k
views
Explanation of persistent full-chain kernel code execution
My question
Meaning of persistent full-chain -- ?
What is the difference between OS-level CE and Kernel level CE?
How do OS-level CE and Kernel level CE differentiate in impacting a system?
Rarity ...
3
votes
1
answer
4k
views
How can we embed an exe containing a payload into a pdf file [closed]
I have created an exe with a payload which gives me a meterpreter session. But I need to embed this exe into a pdf. Upon opening the pdf the exe ideally should get executed. Is there any way to do ...
1
vote
1
answer
179
views
Securing Code Secrets - What is the relevance if the host gets compromised?
I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
2
votes
3
answers
1k
views
How does buffer overread cause arbitrary code execution?
Referenced in the recent VLC vulnerability and other places, apparently buffer overreads can cause arbitrary code execution. How does it do that? Suppose in the following toy example
void badcpy(...
1
vote
1
answer
2k
views
How much protection does sandbox software provide against malicious .exe?
I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
0
votes
0
answers
740
views
What is the risk of allowing user input in Python's 're' module
Some context
I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0
answers
170
views
Is php code with such features vulnerable to RCE?
I'm participating in one bugbounty program.
This site runs on php (Apache) and uses amfphp library.
Here are the things I found I can make this library do for me:
Include (include_once call) any ...
0
votes
2
answers
634
views
Why Empire Launcher payload is not working in system() in PHP?
I created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string.
Now I pass this string to ...
0
votes
1
answer
209
views
PHP code execution attempts on an ASP website
I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
9
votes
1
answer
2k
views
Can I inject a shell command here in PHP?
During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec()
$arg = $_GET['arg'];
// sanitization, I suppose...
if(...
1
vote
0
answers
119
views
Why is digital signature enforcement on webservers not common practice?
Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
2
answers
590
views
What are some examples of known scenarios of network attacks?
For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
4
votes
1
answer
201
views
How do services prevent malicious behavior when executing user provided code?
Some services such as Github allows the execution of user supplied code using docker containers via Github Actions. Another example of a service provider that executes user provided code are ...
2
votes
1
answer
163
views
PHP Code execution in function parameters and logical operators [closed]
After wondering about this and trying to better understanding, I tried the folowing code:
is_string(3 and sleep(30));
Why PHP will execute code inside a parameter function (sleep in is_string) ?
...