Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
1
vote
0answers
27 views
Android Exploit Development Lab [on hold]
Looking to setup an exploit development environment to do the following:
Fuzz Android libraries to find new vulnerabilities
Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
34 views
Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can't execute my ...
2
votes
0answers
41 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
2
votes
0answers
66 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
1
vote
1answer
94 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
93 views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
3
votes
0answers
56 views
Exploit “Blind” buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
3
votes
1answer
206 views
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
54 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
151 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
215 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
74 views
Understanding execve() exploit instructions
There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
65 views
How to response to Meterpreter HTTP Request sent from client
First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
68 views
Vulnserver windows 10 only a few exploits
I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones.
As I found this weird I cheated a ...
1
vote
0answers
88 views
Empire Powershell DDE Office Exploit Help
So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete.
I have to use Empire (https://github.com/...
0
votes
1answer
154 views
SegmentSmack exploit
I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
0
votes
0answers
32 views
Understanding and executing Format String Exploit(Protostar Format1)
I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line
./format1 "`\python -c "print 'AAAA' + '\x38\...
2
votes
1answer
326 views
Why ret2libc is not working in the below code on x86_64?
I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
135 views
Exploitation With Java
I was wondering if it is possible to write exploits in java.
The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java?
I don't see any suitable ...
7
votes
1answer
1k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
117 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
195 views
Developing MIPS exploit in python memory address getting parse as a value [closed]
I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.
below is the HTTP request which occurs the crash
POST /...
1
vote
1answer
177 views
Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)
I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
2
votes
0answers
220 views
Full ASLR and ROP
How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
551 views
stdin does not wait for next input after ROP chain
I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented.
I recreated ...
0
votes
2answers
193 views
How do malware developers avoid wrecking their own computers?
Given
that there's quite a lot of malware running around targeting home computers;
that for there to be malware, someone has to have built it; and
most malware developers probably don't have the ...
1
vote
1answer
157 views
What is the point of escaping an interpreter's sandbox?
Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
62 views
Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?
Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
109 views
Is the difference between a loaded elf and libc a constant value?
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
655 views
Leak a GOT entry using return-to-printf@plt
I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
189 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
2
votes
0answers
96 views
Meltdown - Reading processes info from leaked memory [closed]
Found this video:
https://www.youtube.com/watch?v=De4rBaAdKNA
In the video Meltdown is used to read process memory based by PID/name.
How it is done?
The program looks for task_struct in leaked ...
0
votes
1answer
155 views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
0
votes
1answer
107 views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
3
votes
1answer
507 views
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Inspired by this question and based on this:
Why does me unpatched sytsem *appear* to be not vulenrable by Spectre?
Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
78 views
Running exploit inside textbox
I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow.
So I'm able to trigger ...
3
votes
1answer
127 views
How does brainstorming look like for a team like Google's “Project Zero” [duplicate]
The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process.
Since the news of Meltdown/Spectre I was wondering: How do teams like ...
2
votes
1answer
195 views
Spectre: Problem with Understanding POC - Reading data from cache
I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
2
votes
1answer
62 views
Understanding a crash
Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash.
My normal steps are:
load application into a debugger
...
1
vote
1answer
298 views
Meltdown - Reading Process Memory Data
Tried this PoC:
https://github.com/mniip/spectre-meltdown-poc
Which works for the sys_call_table.
I was able to read the syscall sys_read address.
Wanted to test it with a sample program to read ...
2
votes
1answer
2k views
KPTI - Meltdown - PoC Analysis
Based on this PoC:
https://twitter.com/brainsmoke/status/948561799875502080
I see there are four rows outputed, the second one are two bytes of address of sys_read. What is the first one? Would ...
1
vote
0answers
50 views
Exploiting A Buffer Overflow Issue [duplicate]
I found a buffer overflow in a program. However it is a buffer overflow on x64 bit machine with strcpy. I know that on a x86 bit machine the solution would be to just use strcpy on a GOT entry and ...
0
votes
0answers
362 views
Huge Dirty COW - Privileged access to files like with Dirty COW possible?
Has anybody read the Huge Dirty COW writeup?
https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0
Am I correct that we can also shmem files using THP and achieve the same result ...
0
votes
0answers
69 views
Is a filler needed in a buffer overflow exploit?
Why do I see a filler being used in some exploits?
Take as an example the code below:
exploit = junk + eip + nops + shellcode
fill = "\x43"*(BUF_SIZE-len(exploit))
buf = exploit + fill
I guess the ...
1
vote
0answers
328 views
Bufferoverflow attack shell code address calculation
I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by:
./binary $(python -c 'print overflow +shellcode + adressofshellcode')
Above exploit is working ...
0
votes
0answers
233 views
Heap Spray on linux-3.18
I am trying to write POC for one use-after-free vulnerability. I have been able to control freed memory in 4.4 kernel but same code is not working on 3.18.
As per my understanding, if allocated ...
4
votes
1answer
445 views
KRACK: will there be an exploit soon?
Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.):
Is it likely that there will be an exploit available soon? I think of ...
1
vote
0answers
212 views
Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]
What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted.
I am overwriting with, setting frame like this:
/*
* Setup the fake frame
*...
1
vote
1answer
340 views
Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]
Why it segfaults in __kernel_vsyscall+9?
Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c
(gdb) x/10x 0xb7fd9ce5
0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
2
votes
1answer
552 views
Stackpivoting techniques
I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that.
The question is, during the writing ...
