Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
-1
votes
1answer
54 views

Is the “2038 bug” considered as a vulnerability? is it possible to exploit this?

Is it possible to use the "2038 bug" on all kinds of systems / sites that use a calendar and similar features, in order to exploit a certain system in some way?
2
votes
1answer
96 views

Remotely exploit Linux kernel with CVE-2017-18017? [on hold]

I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually ...
-1
votes
2answers
220 views

How do I sell critical vulnerability info to private company? [on hold]

Here is the story. There is a private company, that has some software product that is used by thousands of its customers. After spending few sleepless nights on reverse engineering that product, I ...
2
votes
2answers
171 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
0
votes
0answers
15 views

Why isn't the checksum length increased on macOS to mitigate generic heap exploitation?

I've been studying heap exploitation on Linux/macOS for learning purposes. Many of the generic exploits on macOS rely on brute-forcing the 4-bit checksum derived from the rack's cookie value. This ...
1
vote
1answer
43 views

How likely are Evince, XReader or Adobe Reader with scripts disabled, to be exploited by a malicious file?

PDFs are very commonly found on the web, and I carefully either view them on the browsers, or use readers without the capability to run the scripts that may come with them (shitty design choice) like ...
0
votes
0answers
52 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
6
votes
2answers
158 views

Can A chain of exploits count as a CVE?

If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits), but when used together in an exploit chain can achieve a meaningful ...
0
votes
1answer
51 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
3
votes
1answer
75 views

How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
2
votes
0answers
58 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
0
votes
0answers
62 views

Is it possible to run jailbroken iPhone simulator to research iOS security?

I've read the Google ProjectZero's series of iOS exploits: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html I wish to try and replicate some of their work. ...
7
votes
2answers
166 views

Ring -3 exploits and existence of other rings

Concept of Rings Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
2
votes
1answer
100 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
1answer
231 views

Is it technically possible to clear WhatsApp chat also on receiver's phone?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...
1
vote
0answers
106 views

laravel-poc-CVE-2018-15133 [closed]

I want to test laravel exploit POC based on https://github.com/kozmic/laravel-poc-CVE-2018-15133/ I did docker steps to reach laravel home page on localhost:8000 then I got API key and simply I put ...
1
vote
0answers
130 views

How can I check if my Bluetooth devices are vulnerable to a KNOB attack?

On Linux and/or macOS, how can I check if a device is vulnerable to a Key Negotiation of Bluetooth (KNOB) Attack? And if a device is vulnerable, is there something I can do to mitigate the danger?
1
vote
0answers
48 views

apache struts 2 s2-057 does not return shell? [closed]

I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution ...
0
votes
1answer
65 views

What are things we look to find Access Control Database?

Currently Working on HP Fortify Access Control Database category. Source: userId = request.getParameter(Constants.USERID).trim(); Sink: pstm1.setString(3,userId.trim()); I saw the definition ...
4
votes
0answers
43 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
2
votes
2answers
83 views

XSS Mitigation using regex

I am allowing following character in regex that is dash, tilde, attherate, a-z, A-z, 0-9 [A-za-z_0-9.,\t\r()\\[\\]@ ~/[-]+$] Is there any possibility to bypass these regex? Actually, whenever ...
1
vote
1answer
223 views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
1
vote
1answer
166 views

A new exploit in town: SWAPGS. How and why did it happen?

Apparently, there's a new speculative execution exploit in town on Intel CPUs: SWAPGS. It takes research on Meltdown and Spectre to the next level and targets the root of the CPU. This is not the ...
5
votes
1answer
91 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
3
votes
1answer
129 views

Is buffer overflow the only way to take control of stack pointer?

I understand how buffer overflow works (in minimal knowledge), which create buffer overflow and take control of stack pointer, to make it execute whatever attacker wants. However, with my current ...
3
votes
2answers
171 views

Mysql injection with a single `USE` statement

I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries. But I couldn't come ...
42
votes
8answers
18k views

Exploiting the delay when a festival ticket is scanned

How a ticket system works A ticket system - one you see at festivals - works like this: when a user pays for their ticket, a row is added to the database with a column named is_scanned, whose default ...
1
vote
1answer
90 views

Exploit for a CSRF to a POST server with specific “Accept” header?

Say the attacker owns a domain, attacker.com. Attacker wants to create a webpage on it to make a CSRF attack toward the victim.com server. The targeted page is victim.com/target.php which only accepts ...
0
votes
1answer
81 views

Stack address is shown less than heap address in C program

I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
0
votes
1answer
140 views

Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?

I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft ...
2
votes
2answers
196 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
0
votes
1answer
58 views

Is exploit different from the kernel level or root?

i'm searching privilage escalation. there is some way if you looking at. i trying exploit in my lab machine like vulnhub. there is a diagram for understanding differents. anyway I told you a little. ...
3
votes
2answers
225 views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
2
votes
0answers
90 views

Binary exploitation

I am trying to upsolve a challenge from a CTF I played but I just can't get it right. I think you have to somehow manage to use buffer overflow, but I can't see what I'm doing wrong since this works ...
1
vote
0answers
126 views

.NET Remoting Pentest [closed]

I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
1
vote
1answer
438 views

caught email exploit attempt — info requested — mail to root+${…}@host [duplicate]

I received an email to the address below that is an apparent exploit attempt. Does anyone have details about the specific exploit so I can make sure I am patched/not exposed: root+${run{...
0
votes
0answers
83 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
0
votes
0answers
206 views

Buffer overflow exploit with python3 : wrong return address written

I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
0
votes
0answers
59 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
1
vote
1answer
66 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
1
vote
0answers
43 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
1
vote
0answers
38 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
0
votes
1answer
114 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
50 views

Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?

Title. Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?: Allows remote, unauthenticated installation of malware on the device. ...
0
votes
0answers
37 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
1
vote
0answers
91 views

Instance metadata on IBM Cloud [closed]

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
0answers
64 views

XXE Exploitation

I just want a little help, i'm not able to exploit an XXE. <?xml version="1.0" encoding="UTF-8"?> <response> <list> <listname><![CDATA[h]]><!ELEMENT r ANY ><!...
3
votes
0answers
221 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
0
votes
0answers
111 views

Double free into stack exploit, problem with SIGABRT

I did the challenge from this site -> http://folk.uio.no/laszloe/ctf/fastbin.pdf but the exploit from the page didn't work for me. The target is to take control over the return address on the stack ...
1
vote
3answers
300 views

Exactly how is a pseudorandom number generator a security risk?

I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly ...