Information Security

Questions tagged [exploit-development]

Ask Question

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

163 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Why isn't the checksum length increased on macOS to mitigate generic heap exploitation?

I've been studying heap exploitation on Linux/macOS for learning purposes. Many of the generic exploits on macOS rely on brute-forcing the 4-bit checksum derived from the rack's cookie value. This ...
1
vote
0answers
39 views

Leak multiple lines from file

I am researching this bug here, where the first line of an arbitrary file can be leaked by triggering a SyntaxError using the compile() function. Is there a method of leaking the rest of the file, ...
2
votes
0answers
58 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
1
vote
1answer
78 views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0
votes
1answer
83 views

How to get gain the knowledge to be a beginner penetration tester on my own? [closed]

I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer. I started to work with Burpsuite, ZAP, ...
1
vote
1answer
88 views

Remote Buffer Overflow w/out Memory Leak

I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
2
votes
1answer
168 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
0
votes
0answers
83 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
1
vote
1answer
148 views

What is the purpose of using hex escape sequences when writing buffer overflow exploits?

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian) #include <stdlib.h> #include <...
1
vote
1answer
66 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
0
votes
1answer
140 views

What does this opcode in my exploit code mean?

I'm trying to develop an already existing exploit for Windows XP. All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes. So far, I followed ...
1
vote
1answer
204 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
1
vote
0answers
85 views

Sending payload and additional commands via Python

I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer. My goal for payload is to overwrite EIP with address ...
0
votes
0answers
37 views

exploit dev issue with nops

I am doing corelan course , but I am stuck at tutorial #2 push ret I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
2
votes
0answers
72 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
1
vote
2answers
84 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
0answers
74 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
2
votes
1answer
361 views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
0
votes
1answer
113 views

Exploit Development on windows environments

I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
1
vote
0answers
45 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
2
votes
1answer
140 views

Why are there no free resources on exploit development on macOS? [closed]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
1
vote
1answer
536 views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
1
vote
0answers
128 views

How to start with javascript engine exploitation [closed]

I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation. 1.What are five papers, books, ...
1
vote
0answers
184 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
112 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
2
votes
0answers
76 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
302 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
1
vote
1answer
113 views

Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?

If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website. You trick the victim into visiting your URL; Through the client_id and the matching ...
1
vote
1answer
257 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
3
votes
0answers
141 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
4
votes
1answer
523 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
113 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
199 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
630 views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
276 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
149 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
180 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
0
votes
1answer
179 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
2
votes
1answer
897 views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
295 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
7
votes
1answer
3k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
131 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
272 views

Developing MIPS exploit in python memory address getting parse as a value [closed]

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem. below is the HTTP request which occurs the crash POST /...
1
vote
1answer
303 views

Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)

I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
3
votes
0answers
410 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
1k views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
0
votes
2answers
224 views

How do malware developers avoid wrecking their own computers?

Given that there's quite a lot of malware running around targeting home computers; that for there to be malware, someone has to have built it; and most malware developers probably don't have the ...
1
vote
1answer
311 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
68 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
131 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...

1 2 3 4