Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
0
votes
0answers
19 views
What's a good fuzzing framework for fuzzing a local standalone GUI / network application / Browser? [on hold]
I am not newbie at exploit development , but I would like to have a solid useful fuzzing framework instead of picking every fuzzing to see if it's work.. I Have a list of fuzzing framework which I ...
1
vote
1answer
66 views
linux kernel exploit shellcode causes segfault
I'm learning how to write kernel exploits and my shellcode keeps seg faulting.
I'm getting the memory address for commit_creds(prepare_kernel_cred(0));
#grep commit_creds /proc/kallsyms
c907eea0 T ...
1
vote
0answers
45 views
Sending payload and additional commands via Python
I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer.
My goal for payload is to overwrite EIP with address ...
0
votes
0answers
20 views
exploit dev issue with nops
I am doing corelan course , but I am stuck at tutorial #2 push ret
I am trying to overwrite my eip with my push esp ret to lauch my shellcode in this case a calc.exe , but it always overwrite with ...
2
votes
0answers
62 views
Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?
I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc.
However, I don't see how to exploit an executable ...
1
vote
2answers
69 views
When to perform secure code review?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
0answers
36 views
How to disable .got.plt protection using GCC on Ubuntu 18.10?
I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.
Usually, the function's .plt entry should (lazy) resolve the ...
2
votes
1answer
81 views
Bypassing ASLR using information leaks
Most of my questions were answered in this post ASLR bypass with info leak
However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
0
votes
1answer
66 views
Exploit Development on windows environments
I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?...
1
vote
0answers
33 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
2
votes
1answer
73 views
Why are there no free resources on exploit development on macOS? [closed]
There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.
Why are there no write-ups on macOS exploitation ...
1
vote
1answer
143 views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
1
vote
0answers
53 views
How to start with javascript engine exploitation [closed]
I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation.
1.What are five papers, books, ...
1
vote
0answers
48 views
Android Exploit Development Lab [closed]
Looking to setup an exploit development environment to do the following:
Fuzz Android libraries to find new vulnerabilities
Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
52 views
Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can't execute my ...
2
votes
0answers
49 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
2
votes
0answers
156 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
1
vote
1answer
99 views
Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?
If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website.
You trick the victim into visiting your URL;
Through the client_id and the matching ...
1
vote
1answer
164 views
Shellcode getting segmentation fault on vmware
I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example.
When I execute the program I am getting segmentation fault.
I'...
3
votes
0answers
79 views
Exploit “Blind” buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
3
votes
1answer
308 views
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
72 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
160 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
446 views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
0answers
128 views
Understanding execve() exploit instructions
There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
89 views
How to response to Meterpreter HTTP Request sent from client
First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
122 views
Vulnserver windows 10 only a few exploits
I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones.
As I found this weird I cheated a ...
1
vote
0answers
110 views
Empire Powershell DDE Office Exploit Help
So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete.
I have to use Empire (https://github.com/...
0
votes
1answer
163 views
SegmentSmack exploit
I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
2
votes
1answer
443 views
Why ret2libc is not working in the below code on x86_64?
I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh", but it ...
-1
votes
1answer
204 views
Exploitation With Java
I was wondering if it is possible to write exploits in java.
The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java?
I don't see any suitable ...
7
votes
1answer
2k views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
3
votes
1answer
121 views
Smashing stack in x86_64
Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
224 views
Developing MIPS exploit in python memory address getting parse as a value [closed]
I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.
below is the HTTP request which occurs the crash
POST /...
1
vote
1answer
215 views
Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)
I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
3
votes
0answers
264 views
Full ASLR and ROP
How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
2
votes
1answer
691 views
stdin does not wait for next input after ROP chain
I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented.
I recreated ...
0
votes
2answers
201 views
How do malware developers avoid wrecking their own computers?
Given
that there's quite a lot of malware running around targeting home computers;
that for there to be malware, someone has to have built it; and
most malware developers probably don't have the ...
1
vote
1answer
200 views
What is the point of escaping an interpreter's sandbox?
Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
63 views
Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?
Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
117 views
Is the difference between a loaded elf and libc a constant value?
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
812 views
Leak a GOT entry using return-to-printf@plt
I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
223 views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
2
votes
0answers
110 views
Meltdown - Reading processes info from leaked memory [closed]
Found this video:
https://www.youtube.com/watch?v=De4rBaAdKNA
In the video Meltdown is used to read process memory based by PID/name.
How it is done?
The program looks for task_struct in leaked ...
0
votes
1answer
162 views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
0
votes
1answer
110 views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
3
votes
1answer
542 views
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Inspired by this question and based on this:
Why does me unpatched sytsem *appear* to be not vulenrable by Spectre?
Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
85 views
Running exploit inside textbox
I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow.
So I'm able to trigger ...
3
votes
1answer
127 views
How does brainstorming look like for a team like Google's “Project Zero” [duplicate]
The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process.
Since the news of Meltdown/Spectre I was wondering: How do teams like ...
2
votes
1answer
217 views
Spectre: Problem with Understanding POC - Reading data from cache
I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
