Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
1
vote
1answer
88 views
What is the purpose of using hex escape sequences when writing buffer overflow exploits?
I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian)
#include <stdlib.h>
#include <...
1
vote
1answer
45 views
How to exploit buffer overflow without space after return address?
I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
0
votes
1answer
112 views
What does this opcode in my exploit code mean?
I'm trying to develop an already existing exploit for Windows XP.
All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes.
So far, I followed ...
1
vote
1answer
118 views
linux kernel exploit shellcode causes segfault
I'm learning how to write kernel exploits and my shellcode keeps seg faulting.
I'm getting the memory address for commit_creds(prepare_kernel_cred(0));
#grep commit_creds /proc/kallsyms
c907eea0 T ...
1
vote
0answers
57 views
Sending payload and additional commands via Python
I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer.
My goal for payload is to overwrite EIP with address ...
0
votes
0answers
28 views
exploit dev issue with nops
I am doing corelan course , but I am stuck at tutorial #2 push ret
I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
2
votes
0answers
65 views
Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?
I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc.
However, I don't see how to exploit an executable ...
1
vote
2answers
76 views
When to perform secure code review?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
0answers
47 views
How to disable .got.plt protection using GCC on Ubuntu 18.10?
I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.
Usually, the function's .plt entry should (lazy) resolve the ...
2
votes
1answer
206 views
Bypassing ASLR using information leaks
Most of my questions were answered in this post ASLR bypass with info leak
However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
0
votes
1answer
79 views
Exploit Development on windows environments
I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
1
vote
0answers
36 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
2
votes
1answer
86 views
Why are there no free resources on exploit development on macOS? [closed]
There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.
Why are there no write-ups on macOS exploitation ...
1
vote
1answer
243 views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
0answers
74 views
How to start with javascript engine exploitation [closed]
I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation.
1.What are five papers, books, ...
1
vote
0answers
77 views
Android Exploit Development Lab [closed]
Looking to setup an exploit development environment to do the following:
Fuzz Android libraries to find new vulnerabilities
Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
67 views
Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can't execute my ...
2
votes
0answers
53 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
2
votes
0answers
212 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
1
vote
1answer
101 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
202 views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
3
votes
0answers
92 views
Exploit “Blind” buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
3
votes
1answer
402 views
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
89 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
171 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
501 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
206 views
Understanding execve() exploit instructions
There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
121 views
How to response to Meterpreter HTTP Request sent from client
First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
145 views
Vulnserver windows 10 only a few exploits
I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones.
As I found this weird I cheated a ...
1
vote
0answers
124 views
Empire Powershell DDE Office Exploit Help
So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete.
I have to use Empire (https://github.com/...
0
votes
1answer
172 views
SegmentSmack exploit
I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
2
votes
1answer
567 views
Why ret2libc is not working in the below code on x86_64?
I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
251 views
Exploitation With Java
I was wondering if it is possible to write exploits in java.
The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java?
I don't see any suitable ...
7
votes
1answer
2k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
124 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
241 views
Developing MIPS exploit in python memory address getting parse as a value [closed]
I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.
below is the HTTP request which occurs the crash
POST /...
1
vote
1answer
236 views
Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)
I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
3
votes
0answers
354 views
Full ASLR and ROP
How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
819 views
stdin does not wait for next input after ROP chain
I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented.
I recreated ...
0
votes
2answers
210 views
How do malware developers avoid wrecking their own computers?
Given
that there's quite a lot of malware running around targeting home computers;
that for there to be malware, someone has to have built it; and
most malware developers probably don't have the ...
1
vote
1answer
228 views
What is the point of escaping an interpreter's sandbox?
Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
63 views
Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?
Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
127 views
Is the difference between a loaded elf and libc a constant value?
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
1k views
Leak a GOT entry using return-to-printf@plt
I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
259 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
2
votes
0answers
120 views
Meltdown - Reading processes info from leaked memory [closed]
Found this video:
https://www.youtube.com/watch?v=De4rBaAdKNA
In the video Meltdown is used to read process memory based by PID/name.
How it is done?
The program looks for task_struct in leaked ...
0
votes
1answer
173 views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
0
votes
1answer
114 views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
3
votes
1answer
577 views
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Inspired by this question and based on this:
Why does me unpatched sytsem *appear* to be not vulenrable by Spectre?
Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
88 views
Running exploit inside textbox
I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow.
So I'm able to trigger ...
