Questions tagged [exploit]
The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
1,286
questions
0
votes
0
answers
23
views
Inheriting Old Website Maintenance: Demonstrating Code Vulnerabilities [closed]
I've just inherited the maintenance of an old website. The code is awful and I'd like to demonstrate to my superiors that the code is bad and vulnerable.
<?php
if (!empty($_GET['page'])){
...
- 101
1
vote
1
answer
77
views
Is there a possible Attack on a mySQL Database using an input window [closed]
My App has a input field, that is used as a source for a HTML and PDF file.
I also store this input in my Database.
My question is: Is it possible to somehow write something in the text field which ...
- 11
0
votes
0
answers
30
views
What security issues could my system be exposed to via an unsecure memory card?
I'm working on an article that involves flash memory cards being put into machines that process and track sensitive information. The machines scan data from forms, then input the data into a database.
...
1
vote
0
answers
47
views
How could the contents of multiple LastPass vaults be compromised?
According to this newly published article:
Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies.
...
Nick Bax, director of analytics at ...
- 3,134
2
votes
1
answer
147
views
Does Routersploit install any malware or executables on my PC?
If I install Routersploit on my PC, would it install any malware or executable binaries as part of it to PC? Even though developers of Routersploit do not have any nefarious intention to add malware, ...
- 41
0
votes
1
answer
125
views
What to do if a bank doesn't admit it leaked millions of customer's data [closed]
I found a breach on a bank's website a few months ago which exposed customer data including: SSNs, account numbers, account balances, physical addresses, payment history, tax forms, temporary login ...
- 3
0
votes
0
answers
115
views
Is UAC an overestimated protection measure in Windows? Does Linux do it better?
Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
- 1,552
0
votes
1
answer
197
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
0
votes
2
answers
197
views
Is it possible to run a code only with an environment variable?
I'm researching the possibility that modifiable environment variables could have security implications.
I mounted all writable volumes with noexec.
LD_PRELOAD could be an attack surface, but I don't ...
1
vote
1
answer
98
views
"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open
I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot:
sudo ufw status
Status: active
To ...
- 13
0
votes
0
answers
205
views
Help creating an exploit for CVE-2019-11500
I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
- 1
3
votes
1
answer
192
views
NULL dereference - Why does it work?
I know that exploiting NULL dereferences is a thing of the past and that modern systems prohibit user processes from mapping NULL page, but I also know that back in the day, a NULL dereference in the ...
- 31
2
votes
1
answer
194
views
Is running rsync as root problematic?
Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?
Background:
I'm moving data from various systems ...
- 21
52
votes
1
answer
10k
views
What vulnerability is a math operation in an HTTP request trying to exploit?
I found the following string '<?=print(9347655345-4954366);?>' in a blocked request logged by our WAF this morning. This string was contained in the path as well as a number of headers.
GET /?'&...
- 645
1
vote
0
answers
71
views
How to switch user instead of using uid? [closed]
In some methods of privilege escalation, if you want to be the root user, you write like this:
setuid(0);
setgid(0);
And this is because the uid and gid of the root user is 0
id root
uid=0 (root) ...
- 241
1
vote
0
answers
164
views
XXE OOB File Content Extraction
Currently, I've discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk.
So my file.dtd is:
<!ENTITY % data SYSTEM &...
- 11
0
votes
0
answers
373
views
How easy or difficult it is to exploit older SSL/TLS protocols?
Detection of outdated TLS/SSL protocols are one of the most common findings I have seen in many vulnerability scans and penetration testing reports. It is reported as a serious vulnerability too. ...
- 1,307
0
votes
0
answers
75
views
Can WebASM provide JavaScript style interactivity without the same vulnerabilities?
JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript.
I was wondering if it ...
- 715
1
vote
1
answer
105
views
Security Implications of Automatic Updates?
I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security ...
2
votes
1
answer
290
views
Msfvenom reverse_tcp without LHOST
I have tested SMBGhost (CVE-2020-0796). I used the following msfvenom command to generate a reverse shell payload.
msfvenom - p windows/x64/meterpreter/reverse_tcp LPORT = 4444 - b '\x00' - i 1 - f ...
- 21
1
vote
0
answers
134
views
Why was CVE-2022-20411 (Bluetooth Remote Code Execution) not detected by Android's BoundSanitizer?
CVE-2022-20411 enabled remote code execution over Bluetooth on Android. It was fixed in December 2022. But why was it not detected by Android's BoundsSanitizer?
Its purpose is to detect and prevent ...
- 111
0
votes
1
answer
114
views
Info integer overflow vulnerability
I've found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
- 1
0
votes
0
answers
60
views
Examples how floating point arithmetic errors cause memory corruptions?
Getting floating point arithmetic right can be difficult. Floating point numbers are not assotiative, adding small and big numbers may have no effect, etc. Integer arithemtic problems frequently lead ...
- 155
1
vote
1
answer
348
views
Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?
https://lolbas-project.github.io/
Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user286246
0
votes
1
answer
442
views
Exploit failed: NoMethodError undefined method `smtp_send_recv' for #<Module:exploit/unix/smtp/exim4_string_format [closed]
I was trying to run an exploit using Metasploit's Exim tool. In the process I will have used the exim4_string_format module. I gave as information a RHOST, LHOSTS AND LPORT. To attack the reverse_perl ...
0
votes
1
answer
86
views
pvefindaddr p2 in mona?
Is there a "!pvefindaddr p2" (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in ...
1
vote
1
answer
390
views
How can I test the BlueKeep exploit?
I want to do the BlueKeep exploit, but I want to do it legally. I know how to do the exploit, I am just trying to figure out how to set up something that is vulnerable to BlueKeep. How can I ...
- 135
1
vote
1
answer
113
views
Get in depth information about vulnerability from a CVE
I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to ...
- 13
1
vote
0
answers
211
views
Help with a pentesting lab [closed]
I am a graduate student working on a pen testing lab that I am having the hardest time understanding. I am given a link to a Kali VM and told the following as a preamble to the lab.
You were recently ...
- 11
1
vote
0
answers
590
views
Changing referer value in burp request has no impact on the response
I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response.
The Referer contains the URL along with the unique ID of ...
- 23
1
vote
1
answer
282
views
Why do you need to wrap bash command inside another when opening a reverse shell?
In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used:
---js
((require[&...
- 121
-1
votes
1
answer
1k
views
I found a way to remove controls on a school Chromebook. How should I tell the school? [duplicate]
Our school uses LanSchool Air and content keeper. I found a way to disable both.
I have already gotten my Chromebook taken away for "abusing Chromebook privileges" I think this is a major ...
0
votes
0
answers
488
views
CVE 2022-21661 - WP Injection replication
I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan.
I'm trying to submit a POST request ...
- 1
1
vote
2
answers
756
views
Finding offset using Buffer overflow pattern generator
I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator
#include <stdio.h>
#include <string.h>
int main (int argc, ...
- 11
0
votes
2
answers
393
views
Where to find detailed info of how to exploit known vulnerabilities?
With most vulnerabilities, I see just summaries and not much detail about what is happening.
Is there a good location where you can find demos of CVEs?
For example, a CVE would say that the router ...
- 140
1
vote
3
answers
277
views
Can you exploit an SQLi authentication bypass for anything else?
I have manually confirmed an SQLi authentication bypass in a user login portal. The payload itself is quite simple. Can this vulnerability be used to do anything else such as enumerate users or inject ...
- 13
0
votes
0
answers
71
views
Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?
I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration.
However, what about reading a ...
1
vote
2
answers
652
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 191
2
votes
2
answers
1k
views
Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?
I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
- 25
0
votes
1
answer
715
views
How to interpret the output of nmap "vulners"
I am trying to judge the security of a web app and I have the sample output below from nmap. But I'm not really sure how to properly interpret it.
Is it merely a printout of all the CVEs for this ...
- 87
0
votes
0
answers
146
views
Buffer Overflow with ROP Chain Output Problem
I have the following problem: I have this C program and I have done buffer overflow using ROP gadgets. I have a problem with the output.
I want to stop the printf() call in the vuln function to get ...
2
votes
1
answer
165
views
Does only having Microsoft Office installed make you vulnerable to the CVE-2022-30190 RCE or having Windows as your OS is enough?
I was wondering whether you need to have Microsoft Office installed to be vulnerable to CVE-2022-30190 RCE.
As far as I understand, MSDT is the issue here (the attack vector so to say) and as shown ...
- 1,552
0
votes
2
answers
2k
views
How can you exploit a website that resolves to localhost?
Let's say you're on a pentest (or bug bounty hunting) and you meet a domain that resolves to 127.0.0.1, How can you exploit that? is that even considered a misconfiguration ? sometimes i see domains ...
1
vote
1
answer
134
views
Is a buffer overflow / command injection attack possible with magnetic strip?
I am relatively new to security and I would call myself an amateur researcher as I do not even work in IT.
However, I remember having a MS605 card reader / writer / encoder and I loved playing around ...
- 13
0
votes
1
answer
527
views
Import a exploit into msfconsole on ubuntu
I'm attending a offensive security courses and one of the subject is import a exploit from exploitdb into msfconsole. Commonly advice that it's required to create a exploit folder inside .msf4 and ...
0
votes
0
answers
142
views
CVE-2021-4034 : __environ is init before the GCONV_PATH injection
I am a bit late to the party but I decided to look into the polkit vulnerability (CVE-2021-4034).
I get that the code injection comes from iconv loading an arbitrary library file through the ...
1
vote
1
answer
163
views
Is there a way to check if vulnerability introduced by npm package is reachable/exploitable
I have a problem where I have too many vulnerabilities on a few hundred repositories introduced with outdated npm packages. The issue is that I need to find a way to prioritize this. The biggest pain ...
- 11
7
votes
2
answers
1k
views
/opt and sudo unzip to /opt, is it safe?
Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
- 415
-2
votes
2
answers
463
views
Vulnerabilities due to improper use of cipher's mode of operation? [closed]
I want to know if there was any vulnerability discovered - whether known to be exploited or not - in cryptographic systems due to improper use of the underlying block-based encryption algorithm's mode ...
- 1
0
votes
0
answers
415
views
Metasploit module for NULL LDAP credentials
This article covers the solution for the LDAP challenges on a capture the flag.
I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP ...
- 191