Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
-1
votes
0answers
35 views

Android exploited - elevated privileges - SE Policy exploit - system as root - dual boot - living in my ramdisk. What now? [on hold]

Ive been chipping away at this for days and going in circles so I need to put this out there - somewhere. My Samsung s9+ hasnt been acting properly for a long time - but in the past few weeks this ...
0
votes
0answers
42 views

Unknown app. Left after getting rid of about 5 others! [on hold]

I did a fresh install, after that i went to Logitech in order to the get the firmware for my commercial product(a mouse). Particularly easy to find but one it seems loaded from common files to my ...
-1
votes
0answers
65 views

Currently, can attackers exploit Nvidia GPU drivers through web browser? [on hold]

Are attackers able to break out of Google Chrome's sandbox using Nvidia GPU driver exploit and then execute code on a victim's PC using publicly available tools like metasploit or equivalent?
3
votes
1answer
57 views

How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
2
votes
0answers
49 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
0
votes
0answers
61 views

Is it possible to run jailbroken iPhone simulator to research iOS security?

I've read the Google ProjectZero's series of iOS exploits: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html I wish to try and replicate some of their work. ...
7
votes
2answers
154 views

Ring -3 exploits and existence of other rings

Concept of Rings Rings were introduced in the forerunner of UNIX, Multics, and had 8 rings for reading, writing, executing and calling (I don't quite understand why it needed 8 rings to do this, if ...
2
votes
1answer
96 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
1answer
209 views

Is it technically possible to clear WhatsApp chat also on receiver's phone?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...
1
vote
0answers
76 views

laravel-poc-CVE-2018-15133 [closed]

I want to test laravel exploit POC based on https://github.com/kozmic/laravel-poc-CVE-2018-15133/ I did docker steps to reach laravel home page on localhost:8000 then I got API key and simply I put ...
1
vote
0answers
113 views

How can I check if my Bluetooth devices are vulnerable to a KNOB attack?

On Linux and/or macOS, how can I check if a device is vulnerable to a Key Negotiation of Bluetooth (KNOB) Attack? And if a device is vulnerable, is there something I can do to mitigate the danger?
1
vote
0answers
39 views

apache struts 2 s2-057 does not return shell?

i do a pentest for a private server protected by cloudflare .. i already bypass WAF and got the real ip for the server then i scan it by acunetix and i found a : Apache Struts2 Remote Command ...
0
votes
1answer
52 views

What are things we look to find Access Control Database?

Currently Working on HP Fortify Access Control Database category. Source: userId = request.getParameter(Constants.USERID).trim(); Sink: pstm1.setString(3,userId.trim()); I saw the definition ...
4
votes
0answers
39 views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
2
votes
2answers
78 views

XSS Mitigation using regex

I am allowing following character in regex that is dash, tilde, attherate, a-z, A-z, 0-9 [A-za-z_0-9.,\t\r()\\[\\]@ ~/[-]+$] Is there any possibility to bypass these regex? Actually, whenever ...
1
vote
1answer
163 views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
1
vote
1answer
165 views

A new exploit in town: SWAPGS. How and why did it happen?

Apparently, there's a new speculative execution exploit in town on Intel CPUs: SWAPGS. It takes research on Meltdown and Spectre to the next level and targets the root of the CPU. This is not the ...
5
votes
1answer
90 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
3
votes
1answer
128 views

Is buffer overflow the only way to take control of stack pointer?

I understand how buffer overflow works (in minimal knowledge), which create buffer overflow and take control of stack pointer, to make it execute whatever attacker wants. However, with my current ...
3
votes
2answers
164 views

Mysql injection with a single `USE` statement

I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries. But I couldn't come ...
42
votes
8answers
18k views

Exploiting the delay when a festival ticket is scanned

How a ticket system works A ticket system - one you see at festivals - works like this: when a user pays for their ticket, a row is added to the database with a column named is_scanned, whose default ...
1
vote
1answer
89 views

Exploit for a CSRF to a POST server with specific “Accept” header?

Say the attacker owns a domain, attacker.com. Attacker wants to create a webpage on it to make a CSRF attack toward the victim.com server. The targeted page is victim.com/target.php which only accepts ...
0
votes
1answer
76 views

Stack address is shown less than heap address in C program

I am learning binary exploitation from "Hacking: The Art of Exploitation". In theory the address of an element of stack should be higher than the address of an element on heap. But in this program I ...
0
votes
1answer
124 views

Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?

I found an interesting blog post A Deep Analysis of the Microsoft Outlook Vulnerability CVE-2018-8587 about Microsoft Outlook heap buffer overflow vulnerability where is described how Microsoft ...
2
votes
2answers
172 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
0
votes
1answer
55 views

Is exploit different from the kernel level or root?

i'm searching privilage escalation. there is some way if you looking at. i trying exploit in my lab machine like vulnhub. there is a diagram for understanding differents. anyway I told you a little. ...
3
votes
2answers
160 views

What are client-side exploits

I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and ...
2
votes
0answers
80 views

Binary exploitation

I am trying to upsolve a challenge from a CTF I played but I just can't get it right. I think you have to somehow manage to use buffer overflow, but I can't see what I'm doing wrong since this works ...
1
vote
0answers
123 views

.NET Remoting Pentest [closed]

I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
1
vote
1answer
431 views

caught email exploit attempt — info requested — mail to root+${…}@host [duplicate]

I received an email to the address below that is an apparent exploit attempt. Does anyone have details about the specific exploit so I can make sure I am patched/not exposed: root+${run{...
0
votes
0answers
76 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
0
votes
0answers
159 views

Buffer overflow exploit with python3 : wrong return address written

I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems ...
0
votes
0answers
49 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
1
vote
1answer
60 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
1
vote
0answers
41 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
1
vote
0answers
38 views

Report security vulnerability [duplicate]

I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs. Brief information on target: The website is built to ...
0
votes
1answer
102 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
50 views

Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?

Title. Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?: Allows remote, unauthenticated installation of malware on the device. ...
0
votes
0answers
35 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
1
vote
0answers
84 views

Instance metadata on IBM Cloud [closed]

Is there any way to get instance metadata on IMB Cloud (a.k.a Bluemix) K8s cluster, from a compromised pod? Something like doing curl to http://metadata.google.internal/computeMetadata/v1/instance/......
0
votes
0answers
63 views

XXE Exploitation

I just want a little help, i'm not able to exploit an XXE. <?xml version="1.0" encoding="UTF-8"?> <response> <list> <listname><![CDATA[h]]><!ELEMENT r ANY ><!...
3
votes
0answers
183 views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
0
votes
0answers
99 views

Double free into stack exploit, problem with SIGABRT

I did the challenge from this site -> http://folk.uio.no/laszloe/ctf/fastbin.pdf but the exploit from the page didn't work for me. The target is to take control over the return address on the stack ...
1
vote
3answers
298 views

Exactly how is a pseudorandom number generator a security risk?

I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly ...
1
vote
1answer
243 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
0
votes
1answer
75 views

XSS: Character showing in DOM [closed]

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
0
votes
0answers
69 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
1
vote
1answer
60 views

Possible to control desktop data activity LED on Windows or Linux for data extraction? [closed]

I am trying to extract data from an air-gapped computer as a project. I already have a working prototype using high frequency sound and a key-logger. I would like to find another way to do it without ...
1
vote
1answer
145 views

Could my boyfriend be hiding his encrypted emails inside of my inbox? [closed]

is it possible that my boyfriend could be hiding his encrypted emails inside of my email inbox with my email address and I can't read them? And if it if that is possible is there way that I can ...
0
votes
0answers
41 views

Threat Model of -fstack-protector

In -fstack-protector the compiler skip instrumenting certain functions which are not deemed to be unsafe (using heurisitics such as filtering out functions not allocating stack buffers etc). What ...