All Questions
Tagged with exploit-development buffer-overflow
47 questions
1
vote
0
answers
32
views
Can't print hexadecimal formatted address in buffer overflow
I'm trying to overwrite the return address caused by a buffer overflow. I've already calculated the distance between the buffer and the return address. The address that I want to jump to is ...
- 81
0
votes
0
answers
351
views
64 Bit ELF Buffer Overflow Not working possibly due to if statement
I wrote the following:
#include <stdio.h>
int win(){
printf("Won!\n");
return 0;
}
int vulnerable(){
char buffer[20];
memset(buffer, 0, 10);
printf("Input: &...
1
vote
1
answer
2k
views
Can't overwrite EIP in bufferoverflow example
I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it.
However, ...
- 181
0
votes
1
answer
551
views
Assigning memory address of shellcode to buffer (for buffer overflow input)
I am attempting to exploit HEVD kernel driver buffer overflow challenge:
https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
However when running the below code my windows 7 machine doesn't ...
- 11
1
vote
1
answer
1k
views
Understanding ret2libc return address location
I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows:
bytes to fill buffer + address of system ...
- 13
2
votes
1
answer
721
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
- 23
2
votes
1
answer
2k
views
segmentation fault at strcpy while perforforming a buffer overflow
I have this code that I need to use to perform a ret2libc
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buf[256];
printf("buff is at:%p\n",buf);
...
- 23
1
vote
1
answer
228
views
Does flooding with bytes cause buffer overflow? [closed]
If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
- 33
2
votes
1
answer
532
views
How many actions do you need to take to disable DEP
I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works.
The application is a C++ app written in visual studio and I am running into ...
- 21
2
votes
2
answers
1k
views
Cannot build a ROP chain
My ROP exploit crashes with segmentation fault for unknown reason.
This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2):
#include <stdio.h>
#include &...
- 59
1
vote
1
answer
1k
views
64bit buffer overflow fails with SIGILL, cannot understand the reason
I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z ...
- 151
2
votes
0
answers
256
views
Why can't you jump from SEH straight to payload for SEH buffer overflow?
From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
- 515
1
vote
1
answer
1k
views
buffer overflow in MIPS - jump to address 0x0040xxxx
I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
- 11
1
vote
1
answer
3k
views
What is the purpose of using hex escape sequences when writing buffer overflow exploits?
I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian)
#include <stdlib.h>
#include <...
- 177
2
votes
1
answer
356
views
How to exploit buffer overflow without space after return address?
I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
- 121
0
votes
1
answer
1k
views
What does this opcode in my exploit code mean?
I'm trying to develop an already existing exploit for Windows XP.
All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes.
So far, I followed ...
- 83
1
vote
1
answer
307
views
When to perform secure code review?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
- 19
4
votes
1
answer
18k
views
Problem with overwriting the return address (buffer overflow)
I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf("%s\...
- 141
1
vote
1
answer
474
views
Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can't execute my ...
- 11
4
votes
1
answer
950
views
Exploit "Blind" buffer overflow in a lab
In a CTF/exploitation lab, I am aware of two separate machines.
Developer machine: Windows 7 x64, as blank, as it can get (no KB patch)
Service machine: UNKNOWN
On Developer:
I have a source code ...
- 1,900
2
votes
1
answer
2k
views
BufferOverflow attack Segment Fault
I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
- 19
3
votes
1
answer
3k
views
Why ret2libc is not working in the below code on x86_64?
I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
- 51
2
votes
1
answer
868
views
buffer overflow 64 bit issue
I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. ...
- 21
1
vote
1
answer
464
views
Developing MIPS exploit in python memory address getting parse as a value [closed]
I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.
below is the HTTP request which occurs the crash
POST /...
- 117
0
votes
1
answer
282
views
Is a filler needed in a buffer overflow exploit?
Why do I see a filler being used in some exploits?
Take as an example the code below:
exploit = junk + eip + nops + shellcode
fill = "\x43"*(BUF_SIZE-len(exploit))
buf = exploit + fill
I guess the ...
- 183
1
vote
0
answers
783
views
Bufferoverflow attack shell code address calculation
I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by:
./binary $(python -c 'print overflow +shellcode + adressofshellcode')
Above exploit is working ...
- 11
1
vote
0
answers
1k
views
Trick needed to make use of a local buffer overflow vulnerability to obtain root
I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
- 44
6
votes
2
answers
44k
views
return to libc- finding libc's address and finding offsets
So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ .
I found libc's address by using "ldd vuln", and found system's ...
- 73
3
votes
2
answers
3k
views
Unable to execute shellcode in basic buffer overflow example
I have a basic example of a program vulnerable to buffer overflow (extracted from this other question).
#include <string.h>
void vuln(char *arg) {
char buffer[500];
strcpy(buffer, arg)...
- 209
3
votes
2
answers
7k
views
Cannot overwrite EIP in basic exploitation example
I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c):
#include <string.h>
int main( int argc, char** argv ) {
char buffer[500];
...
- 209
0
votes
1
answer
3k
views
What exploits are possible in languages like C/C++ other than overflow errors? [closed]
I know that C/C++ programs are highly susceptible to overflow errors that lead to program compromise. But I was wondering, are there any other vulnerabilites that can exist other than overflow errors? ...
- 113
0
votes
1
answer
2k
views
Setting a return address in a simple C exploit
I have an vulnerable program exploitable through the cmdline:
./vuln $(perl -e 'print "\x90"x22'; cat shell; perl -e 'print "\x90"x22';perl -e 'print "\xf4\xdd\xff\xff\xff\x7f"')
���������������������...
- 89
7
votes
1
answer
2k
views
Exploit only works in gdb
tl;dr: Why my exploit only works inside gdb.
I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
- 101
1
vote
2
answers
2k
views
Segmentation fault error when calling user defined function in shellcode
I am getting the segmentation fault error when I called function "target" in my shellcode.
Here's the C code of program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#...
- 113
5
votes
1
answer
6k
views
Using (cat $file; cat) to run a simple BOF exploit
Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
- 133
4
votes
2
answers
732
views
Is it possible to develop memory corruption exploits without access to the executable?
Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she ...
- 143
10
votes
2
answers
8k
views
Why must a ret2libc attack follow the order "system(),exit(),command?
In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
- 439
1
vote
1
answer
460
views
Discover framebuffer address on unknown architecture?
Recently I got running unsigned code through an exploit on an device. Now I would like to discover the framebuffer address so I could write to the screen and output data.
The only way I can imagine ...
- 179
0
votes
1
answer
2k
views
Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?
when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...
- 189
4
votes
2
answers
753
views
How do self-contained executable program exploits work, when considering virtual memory?
My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging.
As a consequence, a program can ...
- 41
6
votes
2
answers
3k
views
Buffer overflow exploit works with gdb but not without
I am learning about buffer overflows and I’m developing my very first exploit.
There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
- 255
3
votes
2
answers
13k
views
Problems with overflowing the return address on stack x86_64
To note before compiling the program I disabled ASLR via:
$ sudo -i
root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space
root@laptop:~# exit
logout
I then compiled the program via:
gcc ...
- 137
4
votes
0
answers
975
views
EIP getting changed in fgetc() Buffer Overflow Homework
Here is the gist of the code:
main(){
char s1[64], s2[64];
int a = 0, b = 0;
FILE *fp1, fp2*;
char temp;
scanf("%s", s1);
scanf("%s", s2);
...
//some checks happen, fp1 is opened to ...
- 332
8
votes
2
answers
866
views
When is memory allocation/layout deterministic?
I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer.
The classic "Smashing the ...
- 968
3
votes
1
answer
2k
views
Bypass Full ASLR+DEP exploit mitigation
Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free..
More over, the ...
- 31
-1
votes
1
answer
3k
views
Can this code be expoited using Buffer Overflow?
I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug.
...
- 29
2
votes
2
answers
4k
views
Python exploit question?
Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
- 23