Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

0
votes
0answers
26 views

Migrate into different process each time a shell spawns

I'm trying to migrate into a new process whenever I get a session. I did this by using set autorunscript migrate -f and also set prependmigrate true but the problem is whenever I get 2+ shells on the ...
0
votes
1answer
62 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
2answers
129 views

What kind of vulnerability is this considered?

I am reverse engineering a binary that is supposed to run as root and performs simple checks on users passwords by reading /etc/shadow. I am able to leak some shadow file entries due to public r/w ...
0
votes
1answer
33 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
0
votes
0answers
31 views

Gain access to files with higher privileges [on hold]

I have this vulnerable linux distribution. There are some files that only users within a specific group can access, which is not my group. And I want to access these files. I tried to use symlinks, ...
2
votes
1answer
65 views

Why are there no free resources on exploit development on macOS? [on hold]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
1
vote
1answer
86 views

How do I protect from a PNG vulnerability on Android?

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached. What's interesting it's asking to interact with the image and "copy-...
1
vote
0answers
55 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
0
votes
0answers
22 views

How to access platform-specific commands in this code, without exposing arbitrary command execution?

I'm writing a DNS-01 extension to the widely used Let's Encrypt acme.sh, that uses a locally running DNS server such as Bind, Unbound, Knot DNS, etc, rather than an API to an external service provider,...
1
vote
0answers
38 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
80
votes
13answers
24k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
0
votes
0answers
15 views

Are there any Nuget pkg upload vulnerabilities

I'm pentesting a website and there is feature of uploading Nuget pkg, and it doesn't upload any other file then nuget and when we upload a nuget file then website will try to fetch url from the file, ...
1
vote
2answers
121 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
1answer
135 views

website hacked by someone proxying over a tor router

I'm curious to get an opinion on following: If someone decides to exploit some sort of vulnerability in a web application of mine or performs something of malicious intent, would this individual be ...
1
vote
0answers
42 views

How to exploit this buffer overflow. Where is the return address?

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code: Code that I need help with:: #include <stdio.h> int ...
1
vote
2answers
40 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
0
votes
1answer
44 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
1
vote
1answer
129 views

What is a spinner (empty while loop) doing, and why?

I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why? Apparently it's "blocking the thread execution", but why does the exploit need ...
3
votes
1answer
97 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
0
votes
1answer
39 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
1
vote
0answers
42 views

What is the role of LLMNR, NBSS and NBNS protocols in WannaCry?

I know that LLMNR is the "new version" of NetBIOS and both of them are basically for resolving names to IP addresses I also know some exploits based on them, like a MiTM attack that the attacker ...
0
votes
2answers
119 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
0
votes
0answers
79 views

Eternalblue What is Dane

So I am working through some lab stuff and finally deployed Fuzzbunch which I hadn't really played with yet (late to the game I know). And when I use SMBTouch I see this against my vuln machine: [+]...
0
votes
0answers
89 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
0
votes
0answers
35 views

Exploit web applet uploading jar through jnlp file

I have a web application which at its start asks the users to download and execute a jnlp file. The jnlp file has the following structure: <?xml version="1.0" encoding="UTF-8"?> <jnlp spec=...
2
votes
0answers
90 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
0
votes
0answers
90 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
1
vote
1answer
99 views

Exploit database for NVD vulnerabilities [closed]

I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
-1
votes
2answers
110 views

Buffer Overflow not working?

Basically I am trying to exploit a buffer overflow, but unfortunately I am not able to get shell. Script buf.c: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]){ ...
0
votes
3answers
184 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
0
votes
2answers
139 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
4
votes
1answer
97 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
1
vote
0answers
112 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
1answer
81 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
0
votes
1answer
44 views

Any way to auto execute a file in windows

MS-Word gives the functionality of OLE In which we embed any link in document and on any event it would go to that link and download the file. The file is stored in the TEMP directory of the WORD. ...
3
votes
0answers
125 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
0
votes
1answer
68 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
2
votes
1answer
212 views

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to ...
1
vote
1answer
191 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
2
votes
1answer
695 views

Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

I ran Nessus on a local network, it found a critical vulnerability for the router: MikroTik RouterOS < 6.41.3 SMB Buffer Overflow (Vulnerability description : Exploit-db) But I can't find any ...
3
votes
1answer
252 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
4
votes
1answer
703 views

Metasploit is not detecting newly imported python exploit

I have added OpenSSH 7.2p2 - Username Enumeration exploit to Metasploit, which is a python exploit. But after so, it does not detect that exploit every way I tried. I have placed it under the ...
1
vote
0answers
30 views

What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?

According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/ ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
0
votes
1answer
242 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
-1
votes
2answers
89 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
2
votes
1answer
154 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
-1
votes
1answer
194 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
0
votes
0answers
90 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
137 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
0
votes
1answer
79 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...