Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
0
votes
0answers
12 views
Shellcode segmentation fault.
I'm trying to execute simple execve(/bin/sh) shellcode from exploit-db on testing program, and I'm getting SIGSEGV. I've compiled it with
gcc -z execstack -fno-stack-protector shell.c -o shell
The ...
2
votes
0answers
29 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
0
votes
0answers
19 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an Oauth2 client_id along a matching secret, you can in theory impersonate the target website in such way :
You attract user on ᴜʀʟ.
Through the client_id and the matching Oauth2 secret ...
1
vote
1answer
52 views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
3
votes
0answers
39 views
Exploit “Blind” buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
0
votes
0answers
31 views
Problem with buffer overflow exploitation - cannot find free buffer for usage
This is not duplicate post, I saw the other post and its not the same problem:
Buffer Overflow doesn't have enough space for exploit after being crashed
I have exercise of Buffer Overflow. ...
3
votes
1answer
147 views
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
33 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
137 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
149 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
43 views
Understanding execve() exploit instructions
There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
42 views
How to response to Meterpreter HTTP Request sent from client
First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
49 views
Vulnserver windows 10 only a few exploits
I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones.
As I found this weird I cheated a ...
1
vote
0answers
64 views
Empire Powershell DDE Office Exploit Help
So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete.
I have to use Empire (https://github.com/...
0
votes
1answer
132 views
SegmentSmack exploit
I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
0
votes
0answers
23 views
Understanding and executing Format String Exploit(Protostar Format1)
I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line
./format1 "`\python -c "print 'AAAA' + '\x38\...
2
votes
0answers
217 views
Why ret2libc is not working in the below code on x86_64?
I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
93 views
Exploitation With Java
I was wondering if it is possible to write exploits in java.
The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java?
I don't see any suitable ...
7
votes
1answer
1k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
111 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
146 views
Developing MIPS exploit in python memory address getting parse as a value [closed]
I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.
below is the HTTP request which occurs the crash
POST /...
1
vote
1answer
133 views
Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)
I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
2
votes
0answers
207 views
Full ASLR and ROP
How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
435 views
stdin does not wait for next input after ROP chain
I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented.
I recreated ...
0
votes
2answers
162 views
How do malware developers avoid wrecking their own computers?
Given
that there's quite a lot of malware running around targeting home computers;
that for there to be malware, someone has to have built it; and
most malware developers probably don't have the ...
1
vote
1answer
135 views
What is the point of escaping an interpreter's sandbox?
Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
59 views
Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?
Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
107 views
Is the difference between a loaded elf and libc a constant value?
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
538 views
Leak a GOT entry using return-to-printf@plt
I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
171 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
0
votes
0answers
66 views
Trouble Comprising the structure of BufferOverflow Payload
I have been working on a buffer overflow problem for about a day, I've decided to seek help from the professionals!
This buffer overflow uses "scanf" function to accept user input and passes it to ...
2
votes
0answers
93 views
Meltdown - Reading processes info from leaked memory [closed]
Found this video:
https://www.youtube.com/watch?v=De4rBaAdKNA
In the video Meltdown is used to read process memory based by PID/name.
How it is done?
The program looks for task_struct in leaked ...
0
votes
1answer
151 views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
0
votes
1answer
106 views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
3
votes
1answer
483 views
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Inspired by this question and based on this:
Why does me unpatched sytsem *appear* to be not vulenrable by Spectre?
Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
73 views
Running exploit inside textbox
I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow.
So I'm able to trigger ...
3
votes
1answer
124 views
How does brainstorming look like for a team like Google's “Project Zero” [duplicate]
The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process.
Since the news of Meltdown/Spectre I was wondering: How do teams like ...
2
votes
1answer
186 views
Spectre: Problem with Understanding POC - Reading data from cache
I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
2
votes
1answer
56 views
Understanding a crash
Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash.
My normal steps are:
load application into a debugger
...
1
vote
1answer
277 views
Meltdown - Reading Process Memory Data
Tried this PoC:
https://github.com/mniip/spectre-meltdown-poc
Which works for the sys_call_table.
I was able to read the syscall sys_read address.
Wanted to test it with a sample program to read ...
2
votes
1answer
2k views
KPTI - Meltdown - PoC Analysis
Based on this PoC:
https://twitter.com/brainsmoke/status/948561799875502080
I see there are four rows outputed, the second one are two bytes of address of sys_read. What is the first one? Would ...
1
vote
0answers
50 views
Exploiting A Buffer Overflow Issue [duplicate]
I found a buffer overflow in a program. However it is a buffer overflow on x64 bit machine with strcpy. I know that on a x86 bit machine the solution would be to just use strcpy on a GOT entry and ...
0
votes
0answers
337 views
Huge Dirty COW - Privileged access to files like with Dirty COW possible?
Has anybody read the Huge Dirty COW writeup?
https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0
Am I correct that we can also shmem files using THP and achieve the same result ...
0
votes
0answers
63 views
Is a filler needed in a buffer overflow exploit?
Why do I see a filler being used in some exploits?
Take as an example the code below:
exploit = junk + eip + nops + shellcode
fill = "\x43"*(BUF_SIZE-len(exploit))
buf = exploit + fill
I guess the ...
1
vote
0answers
307 views
Bufferoverflow attack shell code address calculation
I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by:
./binary $(python -c 'print overflow +shellcode + adressofshellcode')
Above exploit is working ...
0
votes
0answers
219 views
Heap Spray on linux-3.18
I am trying to write POC for one use-after-free vulnerability. I have been able to control freed memory in 4.4 kernel but same code is not working on 3.18.
As per my understanding, if allocated ...
4
votes
1answer
433 views
KRACK: will there be an exploit soon?
Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.):
Is it likely that there will be an exploit available soon? I think of ...
1
vote
0answers
200 views
Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]
What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted.
I am overwriting with, setting frame like this:
/*
* Setup the fake frame
*...
1
vote
1answer
306 views
Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]
Why it segfaults in __kernel_vsyscall+9?
Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c
(gdb) x/10x 0xb7fd9ce5
0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
2
votes
1answer
482 views
Stackpivoting techniques
I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that.
The question is, during the writing ...
