Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
0
votes
1answer
155 views

exploiting CVE-2020-0668 problem

I've been trying to get mentioned security error working on my machine so I could fully understand how it works. I've been following those instructions: https://itm4n.github.io/cve-2020-0668-windows-...
1
vote
4answers
118 views

Can I gain access by nmap?

I have a Debian machine with nginx 1.14.0 (Ubuntu), and I found an exploit, https://www.rapid7.com/db/modules/exploit/linux/http/nginx_chunked_size But, is it possible to gain access by only nmap?
2
votes
1answer
68 views

What is the risk of having an old, Internet capable phone not used for Interned compromised? (not smartphone)

I'm talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the ...
1
vote
0answers
38 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
3
votes
1answer
157 views

Png/JPG exploit

So I recently stumbled on multiple cases suggesting there's a JPG/PNG exploit which is able to silently execute malicious code when simply viewing the image? Just looking for some insight as to ...
-1
votes
1answer
45 views

Run Phone Apps in VM Anonymously and Security Risks of Virtualbox

Would it be possible to run phone apps that connect to the internet (eg. youtube, instagram, etc.) on an Android VM (or any sort of phone VM, doesn't need to be android) in VirtualBox within a host OS ...
0
votes
0answers
30 views

What are the main differences between a covert timing channel and a covert storage channel?

I am trying to find the differences between a covert timing channel and a covert storage channel in terms of detectability, performance, features, and any other advantages and disadvantages. Is ...
0
votes
2answers
108 views

Is it safe to browse the internet with unpatched iPhone with iOS 13.1.3?

I am using unpatched iPhone that has IOS 13.1.3 installed. Apple released IOS 13.1.3 15 Oct 2019. Are there any vulnerabilities for IOS 13.1.3's safari that are currently being exploited in the wild?...
75
votes
6answers
19k views

Can malicious code fit in 14 bytes?

I was reading this The New York Times (NYT) article about the hack of Jeff Bezos's phone. The article states: The May 2018 message that contained the innocuous-seeming video file, with a tiny 14-...
14
votes
2answers
3k views

Is a crash always exploitable for RCE?

Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
0
votes
1answer
104 views

How .bashrc can be used to attack a system?

I read about this malicious Sudo function on Nullbyte where by inserting this bash function into a victims .bashrc/.bash_profile an attacker could exfiltrate sudo passwords fairly easily. This got ...
5
votes
4answers
339 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
3
votes
2answers
2k views

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

I'm getting conflicting reports. Search in Google: "windows 7" fix CVE-2020-0601 The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7". Scrolling down ...
1
vote
0answers
41 views

Kernel exploit fails after executing first command

While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand. TLTR After escalating process privileges my exploit ...
1
vote
1answer
63 views

64bit buffer overflow fails with SIGILL, cannot understand the reason

I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z ...
0
votes
0answers
11 views

How Could a Buffer Overflow be Used to Execute Code? [duplicate]

I've heard a lot about buffer overflows, and I understand the basic concept, but I would like to know exactly how buffer overflow vulnerabilities are used to execute code? Because, if an attacker were ...
1
vote
0answers
59 views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested ...
1
vote
2answers
85 views

Would a user editable URL be subjected to client vilnerability?

I am working on an android application and the company request is to be able to potentially have a user edit the API URL the app uses to be able to work with different test environments. This ...
5
votes
1answer
202 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
0
votes
3answers
197 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
1
vote
1answer
83 views

A Replay Attack was Detected (4649) on DC and File Server - How should I investigate this?

Just as the title states. We've had an alert for a replay attack being detected, how would I investigate this? It's the first alert of this type I've seen, so I'm unsure how to proceed.
0
votes
1answer
74 views

Base64 decode possible payload? [closed]

I was innocently looking at the source code of a page, minding my own business when I stumbled upon this: (this is only part since it exceeds the 30,000 character limit) data:image/jpeg;base64,/9j/...
2
votes
1answer
171 views

What are the security implications of invalid free()?

CVE-2009-5030 OpenJPEG: Heap memory corruption leading to invalid free The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (...
3
votes
1answer
160 views

Can simply opening an email lead to a hack? [duplicate]

It is common to be wary of links and attachments in emails but I have heard some people say that opening the emails themselves can be risky. Are vulnerabilities that can be exploited simply by opening ...
102
votes
19answers
15k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
2
votes
2answers
141 views

What should I think about users with huge numbers of successful login attempts in a short period?

What to think about a user making thousands of successful login attempts over a short period? What are the dangers of such a behavior and how to protect against them? A couple of examples of dangers ...
1
vote
2answers
526 views

How to open a shell using LFI or RFI exploits?

I am completing some online labs to do with cybersecurity and I have been given the task of dealing with a virtual machine of kali linux, to access a basic ip for a website called "yellow". we access ...
1
vote
0answers
104 views

Are some Free VPN services secure or not? [closed]

After deciding to be security engineer, everything that I do, for example visiting pages, downloading any content or apps, etc. seems suspicious. So today I encountered something strange in my new VPN....
1
vote
1answer
140 views

Can not setting password for root when installing linux be exploited?

Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
1
vote
1answer
82 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
1
vote
0answers
52 views

heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?

I'm currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy(): https://exploit.education/...
2
votes
0answers
57 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
1
vote
0answers
304 views

C/C++ code injection

I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
0
votes
2answers
430 views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
0
votes
1answer
954 views

Recon-ng v5 - How to add domains?

I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4. I was able to update myself with simple additions like ...
1
vote
1answer
145 views

Is the “2038 bug” considered as a vulnerability? is it possible to exploit this? [closed]

Is it possible to use the "2038 bug" on all kinds of systems / sites that use a calendar and similar features, in order to exploit a certain system in some way?
1
vote
1answer
175 views

Remotely exploit Linux kernel with CVE-2017-18017? [closed]

I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
0
votes
2answers
285 views

How do I sell critical vulnerability info to private company? [closed]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
2
votes
2answers
333 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
0
votes
0answers
16 views

Why isn't the checksum length increased on macOS to mitigate generic heap exploitation?

I've been studying heap exploitation on Linux/macOS for learning purposes. Many of the generic exploits on macOS rely on brute-forcing the 4-bit checksum derived from the rack's cookie value. This ...
1
vote
1answer
79 views

How likely are Evince, XReader or Adobe Reader with scripts disabled, to be exploited by a malicious file?

PDFs are very commonly found on the web, and I carefully either view them on the browsers, or use readers without the capability to run the scripts that may come with them (shitty design choice) like ...
0
votes
1answer
184 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
6
votes
2answers
190 views

Can A chain of exploits count as a CVE?

If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits), but when used together in an exploit chain can achieve a meaningful ...
0
votes
1answer
52 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
3
votes
1answer
169 views

How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
2
votes
0answers
66 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
0
votes
0answers
72 views

Is it possible to run jailbroken iPhone simulator to research iOS security?

I've read the Google ProjectZero's series of iOS exploits: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html I wish to try and replicate some of their work. ...
8
votes
3answers
347 views

Ring -3 exploits and existence of other rings

Concept of Rings Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
1
vote
1answer
203 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
2answers
296 views

Is it technically possible to clear WhatsApp chat also on receiver's phone?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...

1 2 3 4 5 23