Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

1
vote
0answers
65 views
+50

Instance metadata on IBM Cloud

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
0answers
44 views

Can I exploit Windows SP2 [closed]

Can I exploit Windows SP2 if the port is filtered? I am stuck on my first step. I ran nmap and got this. Now trying Nessus on the site. Maybe I can get something out of there. I'm getting a few ports ...
0
votes
0answers
52 views

XXE Exploitation

I just want a little help, i'm not able to exploit an XXE. <?xml version="1.0" encoding="UTF-8"?> <response> <list> <listname><![CDATA[h]]><!ELEMENT r ANY ><!...
3
votes
0answers
54 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
0
votes
0answers
47 views

Double free into stack exploit, problem with SIGABRT

I did the challenge from this site -> http://folk.uio.no/laszloe/ctf/fastbin.pdf but the exploit from the page didn't work for me. The target is to take control over the return address on the stack ...
1
vote
3answers
263 views

Exactly how is a pseudorandom number generator a security risk?

I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly ...
1
vote
1answer
53 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
0
votes
1answer
71 views

XSS: Character showing in DOM [closed]

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
0
votes
0answers
44 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
1
vote
1answer
55 views

Possible to control desktop data activity LED on Windows or Linux for data extraction? [closed]

I am trying to extract data from an air-gapped computer as a project. I already have a working prototype using high frequency sound and a key-logger. I would like to find another way to do it without ...
1
vote
1answer
140 views

Could my boyfriend be hiding his encrypted emails inside of my inbox? [closed]

is it possible that my boyfriend could be hiding his encrypted emails inside of my email inbox with my email address and I can't read them? And if it if that is possible is there way that I can ...
0
votes
0answers
35 views

Threat Model of -fstack-protector

In -fstack-protector the compiler skip instrumenting certain functions which are not deemed to be unsafe (using heurisitics such as filtering out functions not allocating stack buffers etc). What ...
0
votes
0answers
26 views

exploit dev issue with nops

I am doing corelan course , but I am stuck at tutorial #2 push ret I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
49
votes
5answers
11k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
0answers
83 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
2
votes
0answers
64 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
2
votes
1answer
106 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
0answers
49 views

How do i pivot over WAN

How would i be able to pivot into a internal network over the internet (WAN)? For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
1
vote
2answers
59 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
0answers
42 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
0
votes
1answer
661 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
0
votes
0answers
41 views

Migrate into different process each time a shell spawns

I'm trying to migrate into a new process whenever I get a session. I did this by using set autorunscript migrate -f and also set prependmigrate true but the problem is whenever I get 2+ shells on the ...
0
votes
1answer
70 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
2answers
153 views

What kind of vulnerability is this considered?

I am reverse engineering a binary that is supposed to run as root and performs simple checks on users passwords by reading /etc/shadow. I am able to leak some shadow file entries due to public r/w ...
0
votes
1answer
58 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
2
votes
1answer
78 views

Why are there no free resources on exploit development on macOS? [closed]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
2
votes
3answers
268 views

How do I protect from a PNG vulnerability on Android?

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached. What's interesting it's asking to interact with the image and "copy-...
1
vote
1answer
205 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
0
votes
0answers
25 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
1
vote
0answers
39 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
80
votes
13answers
24k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
0
votes
0answers
45 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
1
vote
2answers
212 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
1answer
141 views

website hacked by someone proxying over a tor router

I'm curious to get an opinion on following: If someone decides to exploit some sort of vulnerability in a web application of mine or performs something of malicious intent, would this individual be ...
1
vote
0answers
66 views

How to exploit this buffer overflow. Where is the return address?

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code: Code that I need help with:: #include <stdio.h> int ...
1
vote
2answers
192 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
0
votes
1answer
80 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
1
vote
1answer
135 views

What is a spinner (empty while loop) doing, and why?

I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why? Apparently it's "blocking the thread execution", but why does the exploit need ...
3
votes
1answer
120 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
0
votes
1answer
44 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
1
vote
0answers
73 views

What is the role of LLMNR, NBSS and NBNS protocols in WannaCry?

I know that LLMNR is the "new version" of NetBIOS and both of them are basically for resolving names to IP addresses I also know some exploits based on them, like a MiTM attack that the attacker ...
0
votes
2answers
131 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
0
votes
0answers
101 views

Eternalblue What is Dane

So I am working through some lab stuff and finally deployed Fuzzbunch which I hadn't really played with yet (late to the game I know). And when I use SMBTouch I see this against my vuln machine: [+]...
0
votes
0answers
108 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
2
votes
0answers
105 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
0
votes
0answers
141 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
1
vote
1answer
107 views

Exploit database for NVD vulnerabilities [closed]

I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
-1
votes
2answers
168 views

Buffer Overflow not working?

Basically I am trying to exploit a buffer overflow, but unfortunately I am not able to get shell. Script buf.c: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]){ ...
0
votes
3answers
253 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
0
votes
2answers
152 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...