All Questions
Tagged with exploit-development assembly
13 questions
1
vote
2
answers
666
views
How do attackers determine ROP gadgets remotely?
Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
- 11
1
vote
1
answer
1k
views
Understanding ret2libc return address location
I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows:
bytes to fill buffer + address of system ...
- 13
0
votes
1
answer
3k
views
What is source of bad characters exist in buffer overflows
I'm new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I'm referring to the process of sending all possible characters to the ...
- 141
1
vote
0
answers
322
views
Exploit - Code execution without assembly call instruction, int etc on ia_64
Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory
The function has no call, int or other assembly instructions afterwards.
...
- 1,007
1
vote
1
answer
686
views
Remote Buffer Overflow w/out Memory Leak
I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ...
- 376
4
votes
1
answer
18k
views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
- 141
0
votes
1
answer
587
views
Stack Protection off but still cant overwrite EIP
When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
...
5
votes
1
answer
7k
views
How to bypass ASLR with ROP
I was reading this article by the InfoSec institute:
http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref
And was able to follow along until he did the ...
- 51
1
vote
2
answers
2k
views
Segmentation fault error when calling user defined function in shellcode
I am getting the segmentation fault error when I called function "target" in my shellcode.
Here's the C code of program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#...
- 113
2
votes
1
answer
331
views
Need help in bypassing Structured Exception Handling (SEH) + egghunter
I am practicing exploit development and trying to remake this exploit by myself in the same environment:
exploit link
I face an issue that the egghunter is not running I even tried the one in the ...
- 44
7
votes
1
answer
3k
views
ROP Programming/Exploitation on ARM - Gadget chain
Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions:
pop {r0, r1, r2, r3, pc}
Which instructions will achieve the same? What gadgets I have ...
- 1,007
-4
votes
3
answers
440
views
Reverse Engineer and Exploits researching [closed]
Can some one give me a start point for finding exploits in software and reverse engineering?
I need some kind of a book or a site...
I have background with programming with high and low level such as ...
1
vote
1
answer
234
views
When I controll EIP, how do I discover what the next steps are?
Lets say I can control the EIP CPU Register, and I want to jump to a specific function of which I know the correct memory address. This address is inside the same memory page. We have no exploit ...
- 520