Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

0
votes
0answers
23 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
0
votes
0answers
127 views

Is it safe to download pictures from websites like booru or imgur? [closed]

Let's say someone has uploaded an Jpeg file with an exploit inside. Will booru (or imgur) re-encode it or not? And if not, will the user, who has downloaded this file and opened it be safe?
0
votes
0answers
62 views

Buffer overflow exploit with python3 : wrong return address written

I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
0
votes
0answers
32 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
1
vote
1answer
46 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
1
vote
0answers
37 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
1
vote
0answers
34 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
0
votes
1answer
86 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
43 views

Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?

Title. Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?: Allows remote, unauthenticated installation of malware on the device. ...
-1
votes
0answers
20 views

What we can do after importing xml file of openvas scan in metasploit

I want to know what things I can do after importing openvas xml report in metasploit. Can I run automatically exploits on the target after importing the xml reports?
0
votes
0answers
29 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
1
vote
0answers
75 views

Instance metadata on IBM Cloud

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
0answers
54 views

XXE Exploitation

I just want a little help, i'm not able to exploit an XXE. <?xml version="1.0" encoding="UTF-8"?> <response> <list> <listname><![CDATA[h]]><!ELEMENT r ANY ><!...
3
votes
0answers
86 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
0
votes
0answers
62 views

Double free into stack exploit, problem with SIGABRT

I did the challenge from this site -> http://folk.uio.no/laszloe/ctf/fastbin.pdf but the exploit from the page didn't work for me. The target is to take control over the return address on the stack ...
1
vote
3answers
285 views

Exactly how is a pseudorandom number generator a security risk?

I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly ...
1
vote
1answer
71 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
0
votes
1answer
71 views

XSS: Character showing in DOM [closed]

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
0
votes
0answers
48 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
1
vote
1answer
58 views

Possible to control desktop data activity LED on Windows or Linux for data extraction? [closed]

I am trying to extract data from an air-gapped computer as a project. I already have a working prototype using high frequency sound and a key-logger. I would like to find another way to do it without ...
1
vote
1answer
144 views

Could my boyfriend be hiding his encrypted emails inside of my inbox? [closed]

is it possible that my boyfriend could be hiding his encrypted emails inside of my email inbox with my email address and I can't read them? And if it if that is possible is there way that I can ...
0
votes
0answers
37 views

Threat Model of -fstack-protector

In -fstack-protector the compiler skip instrumenting certain functions which are not deemed to be unsafe (using heurisitics such as filtering out functions not allocating stack buffers etc). What ...
0
votes
0answers
28 views

exploit dev issue with nops

I am doing corelan course , but I am stuck at tutorial #2 push ret I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
49
votes
5answers
11k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
0answers
89 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
2
votes
0answers
65 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
2
votes
1answer
155 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
0answers
60 views

How do i pivot over WAN

How would i be able to pivot into a internal network over the internet (WAN)? For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
1
vote
2answers
66 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
0answers
49 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
0
votes
1answer
1k views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
0
votes
0answers
43 views

Migrate into different process each time a shell spawns

I'm trying to migrate into a new process whenever I get a session. I did this by using set autorunscript migrate -f and also set prependmigrate true but the problem is whenever I get 2+ shells on the ...
0
votes
1answer
71 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
2answers
153 views

What kind of vulnerability is this considered?

I am reverse engineering a binary that is supposed to run as root and performs simple checks on users passwords by reading /etc/shadow. I am able to leak some shadow file entries due to public r/w ...
0
votes
1answer
85 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
1answer
87 views

Why are there no free resources on exploit development on macOS? [closed]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
2
votes
3answers
323 views

How do I protect from a PNG vulnerability on Android?

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached. What's interesting it's asking to interact with the image and "copy-...
1
vote
1answer
254 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
0
votes
0answers
25 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
1
vote
0answers
42 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
80
votes
13answers
25k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
0
votes
0answers
58 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
1
vote
2answers
225 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
1answer
145 views

website hacked by someone proxying over a tor router

I'm curious to get an opinion on following: If someone decides to exploit some sort of vulnerability in a web application of mine or performs something of malicious intent, would this individual be ...
1
vote
1answer
105 views

How to exploit this buffer overflow. Where is the return address?

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code: Code that I need help with:: #include <stdio.h> int ...
1
vote
2answers
266 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
0
votes
1answer
102 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
1
vote
1answer
136 views

What is a spinner (empty while loop) doing, and why?

I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why? Apparently it's "blocking the thread execution", but why does the exploit need ...
3
votes
1answer
131 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
0
votes
1answer
48 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...