Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

0
votes
0answers
12 views

Shellcode segmentation fault.

I'm trying to execute simple execve(/bin/sh) shellcode from exploit-db on testing program, and I'm getting SIGSEGV. I've compiled it with gcc -z execstack -fno-stack-protector shell.c -o shell The ...
2
votes
0answers
29 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
0
votes
0answers
19 views

Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?

If you get an Oauth2 client_id along a matching secret, you can in theory impersonate the target website in such way : You attract user on ᴜʀʟ. Through the client_id and the matching Oauth2 secret ...
1
vote
1answer
52 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
3
votes
0answers
39 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
0
votes
0answers
31 views

Problem with buffer overflow exploitation - cannot find free buffer for usage

This is not duplicate post, I saw the other post and its not the same problem: Buffer Overflow doesn't have enough space for exploit after being crashed I have exercise of Buffer Overflow. ...
3
votes
1answer
147 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
33 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
137 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
149 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
43 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
42 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
49 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
1
vote
0answers
64 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
0
votes
1answer
132 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
0
votes
0answers
23 views

Understanding and executing Format String Exploit(Protostar Format1)

I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line ./format1 "`\python -c "print 'AAAA' + '\x38\...
2
votes
0answers
217 views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
93 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
7
votes
1answer
1k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
111 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
146 views

Developing MIPS exploit in python memory address getting parse as a value [closed]

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem. below is the HTTP request which occurs the crash POST /...
1
vote
1answer
133 views

Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)

I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
2
votes
0answers
207 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
435 views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
0
votes
2answers
162 views

How do malware developers avoid wrecking their own computers?

Given that there's quite a lot of malware running around targeting home computers; that for there to be malware, someone has to have built it; and most malware developers probably don't have the ...
1
vote
1answer
135 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
59 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
107 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
538 views

Leak a GOT entry using return-to-printf@plt

I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
171 views

Stack Protection off but still cant overwrite EIP

When Compiling with: gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32 I am able to overwrite the return address with just about any value except a valid return address. ...
0
votes
0answers
66 views

Trouble Comprising the structure of BufferOverflow Payload

I have been working on a buffer overflow problem for about a day, I've decided to seek help from the professionals! This buffer overflow uses "scanf" function to accept user input and passes it to ...
2
votes
0answers
93 views

Meltdown - Reading processes info from leaked memory [closed]

Found this video: https://www.youtube.com/watch?v=De4rBaAdKNA In the video Meltdown is used to read process memory based by PID/name. How it is done? The program looks for task_struct in leaked ...
0
votes
1answer
151 views

Spectre - Code Optimization/Branch Training concept [closed]

Trying to load "a" (lowecase a) speculatively using Spectre. Was hinted here: Spectre PoC - Paper based - opposite results that the problem why it does not load speculatively, could be not ...
0
votes
1answer
106 views

Spectre PoC - Paper based - opposite results

After long discussion with this Question (Thanks for help!) Spectre Proof of Concept (PoC) Speculative Execution - Checking for value Came up with simple PoC based on Spectre paper. Seems to be ...
3
votes
1answer
483 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
73 views

Running exploit inside textbox

I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow. So I'm able to trigger ...
3
votes
1answer
124 views

How does brainstorming look like for a team like Google's “Project Zero” [duplicate]

The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process. Since the news of Meltdown/Spectre I was wondering: How do teams like ...
2
votes
1answer
186 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
2
votes
1answer
56 views

Understanding a crash

Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash. My normal steps are: load application into a debugger ...
1
vote
1answer
277 views

Meltdown - Reading Process Memory Data

Tried this PoC: https://github.com/mniip/spectre-meltdown-poc Which works for the sys_call_table. I was able to read the syscall sys_read address. Wanted to test it with a sample program to read ...
2
votes
1answer
2k views

KPTI - Meltdown - PoC Analysis

Based on this PoC: https://twitter.com/brainsmoke/status/948561799875502080 I see there are four rows outputed, the second one are two bytes of address of sys_read. What is the first one? Would ...
1
vote
0answers
50 views

Exploiting A Buffer Overflow Issue [duplicate]

I found a buffer overflow in a program. However it is a buffer overflow on x64 bit machine with strcpy. I know that on a x86 bit machine the solution would be to just use strcpy on a GOT entry and ...
0
votes
0answers
337 views

Huge Dirty COW - Privileged access to files like with Dirty COW possible?

Has anybody read the Huge Dirty COW writeup? https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0 Am I correct that we can also shmem files using THP and achieve the same result ...
0
votes
0answers
63 views

Is a filler needed in a buffer overflow exploit?

Why do I see a filler being used in some exploits? Take as an example the code below: exploit = junk + eip + nops + shellcode fill = "\x43"*(BUF_SIZE-len(exploit)) buf = exploit + fill I guess the ...
1
vote
0answers
307 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
0
votes
0answers
219 views

Heap Spray on linux-3.18

I am trying to write POC for one use-after-free vulnerability. I have been able to control freed memory in 4.4 kernel but same code is not working on 3.18. As per my understanding, if allocated ...
4
votes
1answer
433 views

KRACK: will there be an exploit soon?

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.): Is it likely that there will be an exploit available soon? I think of ...
1
vote
0answers
200 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
306 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
2
votes
1answer
482 views

Stackpivoting techniques

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that. The question is, during the writing ...