All Questions
Tagged with exploit-development linux
26 questions
0
votes
0
answers
351
views
64 Bit ELF Buffer Overflow Not working possibly due to if statement
I wrote the following:
#include <stdio.h>
int win(){
printf("Won!\n");
return 0;
}
int vulnerable(){
char buffer[20];
memset(buffer, 0, 10);
printf("Input: &...
1
vote
2
answers
666
views
How do attackers determine ROP gadgets remotely?
Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
- 11
2
votes
1
answer
583
views
Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]
I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS.
I have just one question:
Is it a mandatory to ...
- 59
2
votes
0
answers
212
views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
2
votes
1
answer
3k
views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
- 919
3
votes
0
answers
403
views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
- 919
2
votes
1
answer
505
views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
- 375
0
votes
1
answer
292
views
SegmentSmack exploit
I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
- 23
7
votes
1
answer
8k
views
Why does my x86 shellcode test program segfault?
I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
- 79
3
votes
0
answers
309
views
Is the difference between a loaded elf and libc a constant value?
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
0
votes
0
answers
581
views
Huge Dirty COW - Privileged access to files like with Dirty COW possible?
Has anybody read the Huge Dirty COW writeup?
Can we also shmem files using THP and achieve the same result as Dirty COW, privileged access to files?
- 1,007
1
vote
0
answers
349
views
Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]
What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted.
I am overwriting with, setting frame like this:
/*
* Setup the fake frame
*...
- 1,007
1
vote
1
answer
891
views
Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]
Why it segfaults in __kernel_vsyscall+9?
Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c
(gdb) x/10x 0xb7fd9ce5
0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
- 1,007
7
votes
1
answer
2k
views
Exploit only works in gdb
tl;dr: Why my exploit only works inside gdb.
I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
- 101
3
votes
1
answer
5k
views
How to exploit binary with no syscall gadget or information leak in full ASLR and NX?
So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely.
The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. ...
- 181
1
vote
0
answers
400
views
Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?
Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them.
So, such filesystems if implemented in user space can suffer of buffer ...
- 1,492
10
votes
2
answers
1k
views
Are memcpy() based race conditions exploitable for causing remote code execution?
Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
- 1,492
0
votes
1
answer
2k
views
Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?
when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...
- 189
2
votes
3
answers
2k
views
How can I execute shell in this CTF exercise?
I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough.
How can I:
Make strcmp to be 0 (evaluate ...
- 1,007
2
votes
2
answers
2k
views
Are SEH exploits valid against Linux?
I was trying to write an exploit for Crossfire (a game on Linux which has BOF vulnerability) to practice for a CTF.
While fuzzing the game, I found out that if you increase the buffer size you send ...
- 998
4
votes
0
answers
831
views
Practicing with return-2-libc exploits
I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/
I made ...
- 211
2
votes
1
answer
381
views
Run fuzzer on any service or process in Linux
I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
- 135
-4
votes
3
answers
440
views
Reverse Engineer and Exploits researching [closed]
Can some one give me a start point for finding exploits in software and reverse engineering?
I need some kind of a book or a site...
I have background with programming with high and low level such as ...
22
votes
5
answers
17k
views
Hackable linux distributions
A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux.
But unfortunately it looks like the project is dead. So my question is are there other
Linux distributions which ...
- 520
2
votes
1
answer
395
views
Security Features enabled in Linux Debian and Ubuntu
i am actually doing some tutorials about ROP on Linux. So i tried to follow the
tutorial and compiled some of the example codes to try ROP in a small scope. But
actually when i am trying to exploit ...
- 520
1
vote
1
answer
296
views
How to fuzz shared objects?
I know there have been similar questions about that topic, but I think mine differs from the others. I have this application which I am able to crash, but the error seems to happen inside of a shared ...
- 520