Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

1
vote
1answer
88 views

What is the purpose of using hex escape sequences when writing buffer overflow exploits?

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian) #include <stdlib.h> #include <...
1
vote
1answer
45 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
0
votes
1answer
112 views

What does this opcode in my exploit code mean?

I'm trying to develop an already existing exploit for Windows XP. All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes. So far, I followed ...
1
vote
1answer
118 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
1
vote
0answers
57 views

Sending payload and additional commands via Python

I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer. My goal for payload is to overwrite EIP with address ...
0
votes
0answers
28 views

exploit dev issue with nops

I am doing corelan course , but I am stuck at tutorial #2 push ret I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
2
votes
0answers
65 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
1
vote
2answers
76 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
0answers
47 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
2
votes
1answer
206 views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
0
votes
1answer
79 views

Exploit Development on windows environments

I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
1
vote
0answers
36 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
2
votes
1answer
86 views

Why are there no free resources on exploit development on macOS? [closed]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
1
vote
1answer
243 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
1
vote
0answers
74 views

How to start with javascript engine exploitation [closed]

I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation. 1.What are five papers, books, ...
1
vote
0answers
77 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
67 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
2
votes
0answers
53 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
212 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
1
vote
1answer
101 views

Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?

If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website. You trick the victim into visiting your URL; Through the client_id and the matching ...
1
vote
1answer
202 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
3
votes
0answers
92 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
3
votes
1answer
402 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
89 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
171 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
501 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
206 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
121 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
145 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
1
vote
0answers
124 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
0
votes
1answer
172 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
2
votes
1answer
567 views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
251 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
7
votes
1answer
2k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
124 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
241 views

Developing MIPS exploit in python memory address getting parse as a value [closed]

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem. below is the HTTP request which occurs the crash POST /...
1
vote
1answer
236 views

Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)

I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
3
votes
0answers
354 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
819 views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
0
votes
2answers
210 views

How do malware developers avoid wrecking their own computers?

Given that there's quite a lot of malware running around targeting home computers; that for there to be malware, someone has to have built it; and most malware developers probably don't have the ...
1
vote
1answer
228 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
63 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
127 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
1k views

Leak a GOT entry using return-to-printf@plt

I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
259 views

Stack Protection off but still cant overwrite EIP

When Compiling with: gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32 I am able to overwrite the return address with just about any value except a valid return address. ...
2
votes
0answers
120 views

Meltdown - Reading processes info from leaked memory [closed]

Found this video: https://www.youtube.com/watch?v=De4rBaAdKNA In the video Meltdown is used to read process memory based by PID/name. How it is done? The program looks for task_struct in leaked ...
0
votes
1answer
173 views

Spectre - Code Optimization/Branch Training concept [closed]

Trying to load "a" (lowecase a) speculatively using Spectre. Was hinted here: Spectre PoC - Paper based - opposite results that the problem why it does not load speculatively, could be not ...
0
votes
1answer
114 views

Spectre PoC - Paper based - opposite results

After long discussion with this Question (Thanks for help!) Spectre Proof of Concept (PoC) Speculative Execution - Checking for value Came up with simple PoC based on Spectre paper. Seems to be ...
3
votes
1answer
577 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
88 views

Running exploit inside textbox

I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow. So I'm able to trigger ...