Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
-1
votes
1answer
75 views

Can modern radios/ham sets/digital walkie talkies be exploited?

Given the fact that modern radios/walkie talkies/ham sets have CPUs on them...would it be possible to exploit them? I am thinking in the following scenario: -There is a vulnerability in the function ...
0
votes
3answers
110 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
0
votes
0answers
40 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
0
votes
0answers
56 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
59
votes
2answers
6k views

Why does this attack check the location of the server?

Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script: IP=$(curl -k ...
0
votes
1answer
61 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
1
vote
0answers
66 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
0
votes
0answers
45 views

What are the latest techniques/advances in binary exploitation? Conversely, latest advances in defending against them?

I know the wording might be off so bear with me a minute to explain what I'm trying to find: If you never touched the topic, you start off with stack buffer overflows, then you learn about ret2libc, ...
0
votes
0answers
41 views

Using msfvenom shellcodes on basic bof demonstration on syswow64 (win10 latest) leads to access violations and StackHash_2beb

I'm currently preparing a course on buffer overflows. The course takes place on the latest version of Windows 10 due to other constraints. Here is my experiment setup: I simulate a basic stack ...
2
votes
1answer
109 views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
0
votes
2answers
253 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
0
votes
0answers
66 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
1
vote
3answers
156 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
4
votes
2answers
249 views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
1
vote
0answers
94 views

Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?

If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the ...
0
votes
0answers
64 views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
0
votes
0answers
46 views

How to see what functions can be hijacked when abusing LD_PRELOAD?

Given a binary and looking to abuse LD_PRELOAD (privilege escalation or persistence), what's a good way to list what functions can be hijacked when running the binary? Are there functions that should (...
0
votes
1answer
145 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
0
votes
2answers
124 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
0
votes
0answers
99 views

Sudo -l systemctl bypass

I am trying to privilege escalate a vulnerable box and I've stuck with this output: sudo -l Matching Defaults entries for charlie on sewers: env_reset, mail_badpass, secure_path=/usr/local/...
1
vote
1answer
94 views

How to exploit with Control over return address and knowing the address of printf

I have this program that uses ASLR and it leaks information when i overflow a buffer, namely the address of printf. Furthermore i can overwrite the return address. How can i use this to spawn a shell? ...
1
vote
1answer
106 views

Are there any existing JTAG (hardware debugging) based malware detection systems, and if not, why?

JTAG System software debug support is for many software developers the main reason to be interested in JTAG. Many silicon architectures such as PowerPC, MIPS, ARM, x86 built an entire software debug, ...
1
vote
2answers
121 views

Has exploitation been demonstrated against the fundamental constructs of the debugging process?

I'm curious to know if an attacker can fundamentally exploit the debugging process. I'm not asking if specific debugging tools have been exploitable, surely some have, but rather whether the process ...
0
votes
1answer
152 views

HDMI with Ethernet: Network Security Risk?

I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing: Say I have a PC/laptop connected to the internet, and a monitor (...
0
votes
1answer
109 views

Is it possible for a compressed file to contain malicious code?

I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
1
vote
0answers
65 views

Methodology to find exploit for Windows Servers

I am following the following walk-through for a box called Sheild on Hack the Box (HTB). https://www.aldeid.com/wiki/HackTheBox-StartingPoint-Shield For privilege escalation, the walkthrough says &...
0
votes
2answers
333 views

Is it possible to exploit preg_match similar to preg_replace PHP? [closed]

I'm currently working on a website and want to prevent characters being inputted, i am using following code if (!preg_match("/^[a-zA-Z0-9_!,()& -\/]*$/" is it possible to exploit this ...
0
votes
0answers
372 views

How does PUA:Win32/InstallCore get on my PC?

I run a full (not quick) scan of Windows Defender every night. Somehow, between two nights ago and last night an instance of PUA:Win32/InstallCore got placed on my PC. Windows Defender removed it, ...
1
vote
1answer
102 views

Is there a term for one specific step before/during reconnaisance?

If the hacker decides to attack the system, the first step is reconnaissance. But if the system the hacker attacks is exotic, sometimes they'd need to develop the tools or "drivers", or ...
0
votes
0answers
10 views

How can I generate several exploits in metasploit in a script like manner? [duplicate]

I need to generate several files in metasploit for testing some signatures and normally in metasploit I am required to msfconfole to start the engine and select an exploit using use /path/to/exploit/ ...
0
votes
1answer
90 views

Is every plain flow into a dangerous sink exploitable?

Given a flow of information (for example from the URL) into a sink on a certain site, and given that this information is plain, i.e. is not sanitized, does this mean that if an attacker could control ...
0
votes
1answer
77 views

Bufferoverflow for small return address

I am using buffer overflow to overwrite the return address and calls another function. The name of function I call by overwriting the return address is not_called. Here is how I create the payload (...
1
vote
0answers
80 views

VirtualBox: Making a Keylogger file from Kali VM after exploiting Metasploitable (Bridged Adapter) [closed]

I am fairly new to Kali Linux and Metasploitable and I am trying to set a keylogger for when I gain root access to Metasploitable. I have gained root access by using the use exploit/unix/irc/...
1
vote
0answers
100 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
1
vote
1answer
81 views

KikChat LFI/RFI exploit code?

I've been reading about PWK-Example-Report-v1.pdf on pages 7-14 and found that KikChat apps were used in the example. https://www.exploit-db.com/exploits/30235 Copy of the vulnerable app is available ...
1
vote
1answer
286 views

How to read memory from format string exploit correctly

I'm trying to solve a problem on format string exploitation in which I have to overwrite anything in a specific address. Since the target address has a null byte at the begining, I need to write it at ...
0
votes
0answers
137 views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
1
vote
1answer
356 views

Received a strange text message. What is it? [closed]

This morning I received the following text message from a Gmail account: v3s5f3rs4f3gs3.nf5j4k8j4k3o.solar?G$1?V&?KL?O=$HO?&S?K0?$1T A couple of my friends got it too. I have an iPhone and it ...
3
votes
1answer
138 views

Instruction Overwrites with Garbage?

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
2
votes
1answer
330 views

Is GPON uniquely vulnerable to eavesdropping exploits from neighbors on same network? If so, why?

Background A fellow in my social circle is involved with a cybersecurity company that secured a patent. I want to learn more. Simple Explanation US Patent Office Listing Patent analysis is a very ...
1
vote
3answers
161 views

Process.Start() Command Injection

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...
1
vote
1answer
127 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
0answers
49 views

Exploitation of Resource Packages in Java

I understand this might be a usual question but I thought it'd be interesting to get people's feedback regardless as this relates to security. In games, in particular I am thinking about Minecraft, ...
1
vote
1answer
97 views

How to exploit open redirect vulnerability which must contain the original url

Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com I found out that I can put anything I want before sub.domain.com in the continue parameter as long as ...
-1
votes
1answer
110 views

Do you have to be on the same WIFI for a Buffer Overflow attack to work?

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...
3
votes
2answers
1k views

How to protect from dependency confusion attacks?

I recently came across following article https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/ it describe about an exploit which exploit ...
2
votes
1answer
165 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
0
votes
0answers
54 views

When parsing a string to a BigDecimal or BigInteger in Java, or BigInt in JavaScript, are there any known security issues around this?

When parsing a string to a BigDecimal or BigInteger in Java, or BigInt in JavaScript, are there any known security issues around this? Like if you take in the string without validating it's just ...
0
votes
1answer
78 views

What are some tips to defend against router exploits like the ones used from routersploit?

I know there are ways to defend yourself against wireless attacks targeting routers such as changing default creds and implementing a firewall but are there any other techniques that'll increase your ...

1
2 3 4 5
25