Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
178
questions
0
votes
1answer
42 views
Is it possible to use ROP to call legitimate functions even if the stack is not executable?
I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment.
For ...
1
vote
0answers
69 views
Exploit - Code execution without assembly call instruction, int etc on ia_64
Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory
The function has no call, int or other assembly instructions afterwards.
...
-1
votes
0answers
78 views
system doesn't invoke /bin/sh
I am learning libc shellcode attacks and trying to execute /bin/sh from system
I can execute other commands from system like whoami and ls -a but can not run /bin/sh
the following works
string = b&...
1
vote
1answer
63 views
Are there any projects/papers on approaching exploit development with AI/automation?
I'm looking for research on the topic if at all possible or readings about efforts into this.
Drilling down into binaries via fuzzing/fingerprinting for known vulnerable binary patterns and a little ...
0
votes
1answer
59 views
Exploiting a service on 32bit OS on a 64bit processor with ShellCode
Let's theoretically assume I have an overflow vulnerability on a certain service I want to exploit.
The service reside in 32bit Operating System on a 64bit Processor.
I'm attempting to wrap my head ...
1
vote
1answer
98 views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
0
votes
0answers
73 views
Secure code makes exploitation easier with CPU vulnerabilities?
I researched CPU vulnerabilities in the past, such as Specter and Meltdown.
I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
0
votes
0answers
43 views
how to check offset for a program on remote server
I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
2
votes
1answer
190 views
segmentation fault at strcpy while perforforming a buffer overflow
I have this code that I need to use to perform a ret2libc
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buf[256];
printf("buff is at:%p\n",buf);
...
0
votes
1answer
95 views
is there any way to exit meterpreter without exit the process?
I have a target process I'm injecting meterpreter shellcode (windows/meterpreter/reverse_tcp) into, I manage to get a shell but when I exit it, the process exits as well.
Is there any easy way to make ...
1
vote
1answer
97 views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
1
vote
4answers
209 views
What are the names of software vulnerabilities? [closed]
In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port.
...
0
votes
0answers
40 views
Unable to exploit SQL injection in the parameter
During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
2
votes
1answer
82 views
How to use “jmp” in ROP
I'm trying to put together a ROP chain. I'm looking for a gadget to do the following:
mov rdi, rdx ; mov rbp, rsp ; ret;
But instead, I have a gadget like this :
mov rdi, rdx ; mov rbp, rsp ; ...
0
votes
1answer
99 views
How many actions do you need to take to disable DEP
I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works.
The application is a C++ app written in visual studio and I am running into ...
0
votes
1answer
119 views
How do programmers write the initial exploits from the vulnerability details in a CVE? [closed]
I've noticed that lots of CVE at www.cvedetails.com do not have publicly available exploits. But they have high scores (ex: score higher than 9).
With such a high score, I'd thought exploits would be ...
2
votes
2answers
191 views
Cannot build a ROP chain
My ROP exploit crashes with segmentation fault for unknown reason.
This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2):
#include <stdio.h>
#include &...
1
vote
0answers
54 views
Kernel exploit fails after executing first command
While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand.
TLTR
After escalating process privileges my exploit ...
1
vote
1answer
190 views
64bit buffer overflow fails with SIGILL, cannot understand the reason
I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z ...
1
vote
0answers
123 views
heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?
I'm currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy():
https://exploit.education/...
2
votes
1answer
61 views
Leak multiple lines from file
I am researching this bug here, where the first line of an arbitrary file can be leaked by triggering a SyntaxError using the compile() function.
Is there a method of leaking the rest of the file, ...
2
votes
0answers
86 views
Why can't you jump from SEH straight to payload for SEH buffer overflow?
From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
1
vote
1answer
366 views
buffer overflow in MIPS - jump to address 0x0040xxxx
I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0
votes
1answer
111 views
How to get gain the knowledge to be a beginner penetration tester on my own? [closed]
I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer.
I started to work with Burpsuite, ZAP, ...
1
vote
1answer
259 views
Remote Buffer Overflow w/out Memory Leak
I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
2
votes
1answer
277 views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
1
vote
1answer
617 views
What is the purpose of using hex escape sequences when writing buffer overflow exploits?
I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian)
#include <stdlib.h>
#include <...
2
votes
1answer
113 views
How to exploit buffer overflow without space after return address?
I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
0
votes
1answer
308 views
What does this opcode in my exploit code mean?
I'm trying to develop an already existing exploit for Windows XP.
All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes.
So far, I followed ...
1
vote
1answer
444 views
linux kernel exploit shellcode causes segfault
I'm learning how to write kernel exploits and my shellcode keeps seg faulting.
I'm getting the memory address for commit_creds(prepare_kernel_cred(0));
#grep commit_creds /proc/kallsyms
c907eea0 T ...
1
vote
0answers
149 views
Sending payload and additional commands via Python
I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer.
My goal for payload is to overwrite EIP with address ...
2
votes
0answers
99 views
Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?
I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc.
However, I don't see how to exploit an executable ...
1
vote
1answer
118 views
When to perform secure code review?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
2
votes
1answer
1k views
Bypassing ASLR using information leaks
Most of my questions were answered in this post ASLR bypass with info leak
However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
0
votes
1answer
159 views
Exploit Development on windows environments
I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
1
vote
0answers
50 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
2
votes
1answer
227 views
Why are there no free resources on exploit development on macOS? [closed]
There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.
Why are there no write-ups on macOS exploitation ...
2
votes
1answer
3k views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
0answers
185 views
How to start with javascript engine exploitation [closed]
I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation.
1.What are five papers, books, ...
1
vote
0answers
365 views
Android Exploit Development Lab [closed]
Looking to setup an exploit development environment to do the following:
Fuzz Android libraries to find new vulnerabilities
Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
202 views
Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can't execute my ...
2
votes
0answers
107 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
2
votes
1answer
662 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
1
vote
1answer
131 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
364 views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
4
votes
1answer
298 views
Exploit “Blind” buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
4
votes
1answer
862 views
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
178 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
258 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
1k views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
