Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
198 questions
4
votes
1
answer
605
views
KRACK: will there be an exploit soon?
Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.):
Is it likely that there will be an exploit available soon? I think of ...
- 14.5k
1
vote
0
answers
349
views
Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]
What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted.
I am overwriting with, setting frame like this:
/*
* Setup the fake frame
*...
- 1,007
1
vote
1
answer
891
views
Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]
Why it segfaults in __kernel_vsyscall+9?
Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c
(gdb) x/10x 0xb7fd9ce5
0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
- 1,007
2
votes
1
answer
2k
views
Stackpivoting techniques
I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that.
The question is, during the writing ...
- 171
7
votes
1
answer
738
views
Blueborne - Attack Scenario Clarification
Based on the Technical White Paper
http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper-1.pdf?t=1505319664351
After reading it, I understand it as follows (Page 13, bottom)
So to exploit ...
- 1,007
2
votes
2
answers
5k
views
x32 VS x64 Reverse Engineering and Exploit Development
I started to learn RE and Exploit Development and most materials almost all of them are on 32 bit architecture. what the difference in the point of view of Exploit Development. I know in Shellcoding ...
- 51
1
vote
0
answers
1k
views
Trick needed to make use of a local buffer overflow vulnerability to obtain root
I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
- 44
3
votes
0
answers
832
views
Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update
Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
- 1,900
6
votes
2
answers
44k
views
return to libc- finding libc's address and finding offsets
So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ .
I found libc's address by using "ldd vuln", and found system's ...
- 73
1
vote
1
answer
685
views
How to increase gadget occurence in a program
I'm exercising with ROP. In a vulnerable program I control the RIP, use "ropeme" and search for gadgets I find many references to 32 bits long registers, but not a single extended register.
I need a ...
- 89
1
vote
1
answer
2k
views
Shellcode parameter passing
I am trying to use an environment variable to store my shellcode and then point my RET to it, so that I may get to execute my shellcode.
Here is my vulnerable program 'abc.c'
#include string.h
#...
- 113
-2
votes
1
answer
193
views
How are viruses made for windows? [closed]
I know that windows source code is proprietary so how do hackers and others know what are the available exploits in windows so that the viruses can take their advantage.
- 107
5
votes
1
answer
7k
views
How to bypass ASLR with ROP
I was reading this article by the InfoSec institute:
http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref
And was able to follow along until he did the ...
- 51
3
votes
2
answers
3k
views
Unable to execute shellcode in basic buffer overflow example
I have a basic example of a program vulnerable to buffer overflow (extracted from this other question).
#include <string.h>
void vuln(char *arg) {
char buffer[500];
strcpy(buffer, arg)...
- 209
3
votes
2
answers
7k
views
Cannot overwrite EIP in basic exploitation example
I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c):
#include <string.h>
int main( int argc, char** argv ) {
char buffer[500];
...
- 209
1
vote
1
answer
3k
views
ROP: finding a useful stack pivot
I'm trying to write a rop chain to bypass dep on Windows 7 x64 SP1.
I'm working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered ...
- 171
0
votes
1
answer
3k
views
What exploits are possible in languages like C/C++ other than overflow errors? [closed]
I know that C/C++ programs are highly susceptible to overflow errors that lead to program compromise. But I was wondering, are there any other vulnerabilites that can exist other than overflow errors? ...
- 113
0
votes
0
answers
136
views
Are Metasploit built-in exploits used in real-life pen testing? [duplicate]
I just started seriously playing around with Metasploit, and a question kept coming into my mind.
In the case of Adobe Flash for example, there are thousands of Flash vulnerabilities in CVEdetails....
- 101
1
vote
1
answer
3k
views
BufferOverflow : ESP and access violation
The context :
I have a small question regarding ESP and access violation.
I just exploited a buffer overflow, with little space after ESP.
So i did this :
part 1 : NOP SLED
part 2 : my shellcode : ...
- 11
3
votes
3
answers
1k
views
EternalBlue exploit and ASLR
Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
- 153
1
vote
1
answer
2k
views
Malicious .so Library creation in CVE-2017-7494 Sambacry
I'm trying to understand the whole process behind the Sambacry exploit.
The problem is that I'm having a little problem understanding how do you create the malicious .so library to be loaded by the ...
- 61
1
vote
1
answer
882
views
Windows Applications for Exploit Development exercising? [closed]
I started to learn ASM and learned a lot about exploit development in the last few weeks. My question is, are there any comparable vulnerable windows programs like vulnserver out there which are good ...
- 113
0
votes
1
answer
2k
views
Setting a return address in a simple C exploit
I have an vulnerable program exploitable through the cmdline:
./vuln $(perl -e 'print "\x90"x22'; cat shell; perl -e 'print "\x90"x22';perl -e 'print "\xf4\xdd\xff\xff\xff\x7f"')
���������������������...
- 89
7
votes
1
answer
2k
views
Exploit only works in gdb
tl;dr: Why my exploit only works inside gdb.
I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
- 101
1
vote
2
answers
2k
views
Segmentation fault error when calling user defined function in shellcode
I am getting the segmentation fault error when I called function "target" in my shellcode.
Here's the C code of program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#...
- 113
3
votes
1
answer
5k
views
How to exploit binary with no syscall gadget or information leak in full ASLR and NX?
So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely.
The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. ...
- 181
8
votes
1
answer
6k
views
Can I do a String Format Exploit for x64 systems? [closed]
I was trying to replicate the experiment in Gray Hat Hacking - Third Edition, Chapter 12, about Format String Exploits, but their architecture is IA32, while mine is AMD 64bits. Therefore when I check ...
- 133
7
votes
2
answers
3k
views
Are all vulnerabilities exploitable?
I understand the difference between a vulnerability and an exploit, but as I surf the exploit databases, I see more vulnerabilities and less exploits. Shouldn't there be at least one exploit for every ...
- 882
5
votes
1
answer
6k
views
Using (cat $file; cat) to run a simple BOF exploit
Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
- 133
1
vote
0
answers
94
views
How can I study/replicate multiple vulnerability types in a specific software?
I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
- 203
1
vote
2
answers
389
views
Stack buffer overflow exploit stacking characters?
I have a program like this:
int main() {
char buffer[16];
printf("Write something: ");
gets(buffer);
printf("You wrote: %s\n", buffer);
return 0;
}
And I have wrote a little ...
- 121
2
votes
1
answer
2k
views
Stagefright - building ROP stack - pivoting
Here I control r2 (vtable)
0xb6712c48 <+7120>: ldr r5, [r2, #28]
0xb6712c4a <+7122>: ldrd r2, r3, [r8]
0xb6712c4e <+7126>: blx r5
How I understand it:
I control the ...
- 1,007
2
votes
0
answers
605
views
Vtable - finding the vtable pointer
// overflow here, so that size + chunk_size == 32 and size > 32
uint8_t *buffer = new uint8_t[size + chunk_size];
// buffer is allocated immediately before mDataSource
if (size > 0) {...
- 1,007
0
votes
0
answers
700
views
ROP gadget - mmap - how to check if mmaped address is executable after gadget execution?
I am working with Stagefright exploit... my question is in bold below.
Some background info:
Below is the result of ROP chain/stack that mmap() stuff did including copying with other gadget (with ...
- 1,007
2
votes
0
answers
396
views
Disabling Android mediaserver (/system/bin/mediaserver) ASLR
I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod).
root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space
root@s3ve3g:/system # cat /proc/sys/kernel/...
- 1,007
1
vote
0
answers
400
views
Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?
Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them.
So, such filesystems if implemented in user space can suffer of buffer ...
- 1,492
4
votes
2
answers
732
views
Is it possible to develop memory corruption exploits without access to the executable?
Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she ...
- 143
5
votes
1
answer
5k
views
Exploit does not work outside GDB
I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
- 123
10
votes
2
answers
1k
views
Are memcpy() based race conditions exploitable for causing remote code execution?
Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
- 1,492
3
votes
1
answer
3k
views
Heap Overflow - unlink() technique exploitation on x86_64 (64 bit)
Trying to exploit this sample vulnerable program:
/*
Heap overflow vulnerable program.
*/
#include <stdlib.h>
#include <string.h>
int main( int argc, char * argv[] )
{
char * ...
- 1,007
2
votes
1
answer
948
views
Is it possible to execute code in this program using heap overflow?
Program code (with Pseudo code part):
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char** argv)
{
int controlled1=10;
int controlled2=20;
int controlled3=300;
//test.bin ...
- 1,007
1
vote
1
answer
406
views
CVE-2016-6254 - Understanding Heap Overflow
Trying to understand this piece of code:
It containts Heap Buffer Overflow Vulnerability:
static int parse_packet (sockent_t *se, /* {{{ */
void *buffer, size_t buffer_size, int flags,
...
- 1,007
4
votes
3
answers
959
views
Why strace isn't showing system call being made in shellcode?
I'm new to shellcoding.
I have written assembly code :
section .text
global _start
_start:
jmp end
start:
;open file
pop ebx ; get address of filename
xor eax,eax
mov [ebx+3], al
mov al,...
- 113
2
votes
1
answer
331
views
Need help in bypassing Structured Exception Handling (SEH) + egghunter
I am practicing exploit development and trying to remake this exploit by myself in the same environment:
exploit link
I face an issue that the egghunter is not running I even tried the one in the ...
- 44
0
votes
1
answer
163
views
MCC records in JPEG2000
I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records ...
- 929
3
votes
1
answer
1k
views
Compiling exploit on a different kernel than target (but same arch): is it un-smart or risky?
I'm in a situation where I've compiled about 15 or more exploits for a machine and each has failed. The failures had to do with the kernel being compiled with highly secure settings, i.e. mmap ...
- 402
1
vote
1
answer
114
views
how to create dependency free script? [closed]
I have a script which can exploit a specific vulnerability. This script works well with the latest system but in the older systems it failed to run because of dependency (glibc-2.14). So how can i ...
- 1,176
1
vote
1
answer
429
views
Interpreting CVE ratings: Buffer Overflow vs. Denial of Service vs. Remote Code Executing (RCE)
If a CVE lists a buffer overflow vulnerability, but not a remote code execution, should I interpret that as:
This vulnerability has not been confirmed to expose RCE, or
This vulnerability has been ...
- 1,630
1
vote
0
answers
515
views
Immunity Debugger - !mona suggest
Potentially simple question. I have been going through some tutorials for exploit development that use !pvefindaddr for help with creating unique patterns and discovering the offset.
I know that mona ...
- 195
1
vote
0
answers
416
views
My exploit does not overwrite EIP, why? [closed]
I am try to write my first exploit, that will exploit the pinfo program.
I install the program via apt-get them i crash him with:
neo@matrix:~$ pinfo -m `python -c 'print "A"*50064+"DCBA"'`
...
- 11