Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
1 vote
1 answer
3k views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
1 vote
1 answer
366 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
1 vote
1 answer
1k views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
1 vote
1 answer
443 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
2 votes
1 answer
672 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1 vote
1 answer
1k views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
0 votes
1 answer
123 views

pvefindaddr p2 in mona?

Is there a "!pvefindaddr p2" (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py? Alternatively, is there any option to run pvefindaddr in ...
0 votes
1 answer
505 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
2 votes
1 answer
335 views

Python Code Injection With int()

I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor: type('',(),{'a':5,'b':6,'...
1 vote
2 answers
823 views

Rop: Handling a `push` in the middle of a gadget

In rop, often a gadget has an undesired pop or push in the middle. For a pop, we handle this simply by adding a dummy value to our chain: it is popped, and all is well. What about a push: What do we ...
1 vote
2 answers
8k views

How to exploit publicy known vunerable version of jquery?

I am trying to see how a publicly known "vulnerable version of the library jquery" can be exploited to make proof of concepts to website owners. Let's say we have jquery version 2.1.1 that ...
0 votes
0 answers
125 views

Specifying an integer within the maximum of an unsigned 64-bit integer does **not** cause a buffer overflow

The program I am working with has a POC published for it, but not a full explanation. I have been told by my mentor (I am part of a research program) to disclose as little information as possible ...
0 votes
1 answer
269 views

Is a filler needed in a buffer overflow exploit?

Why do I see a filler being used in some exploits? Take as an example the code below: exploit = junk + eip + nops + shellcode fill = "\x43"*(BUF_SIZE-len(exploit)) buf = exploit + fill I guess the ...
0 votes
0 answers
147 views

Custom PsExec csharp code with plaintext credentials

I have this code for exploiting PsExec that works perfectly fine when I have a TGS for the CIFS SPN on the target, however there are situations where I only have plaintext credentials for the local ...
2 votes
1 answer
826 views

buffer overflow 64 bit issue

I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. ...
1 vote
1 answer
160 views

Get in depth information about vulnerability from a CVE

I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to ...
3 votes
1 answer
766 views

Can't get this memory addressing

I am working with this INE eCXD material and I am working on my basics of buffer overflow on Linux. In the lab, there is supposed to be a binary that is using the strcpy() function and it SEGFAULTS ...
0 votes
0 answers
573 views

Huge Dirty COW - Privileged access to files like with Dirty COW possible?

Has anybody read the Huge Dirty COW writeup? Can we also shmem files using THP and achieve the same result as Dirty COW, privileged access to files?
3 votes
0 answers
386 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
1 vote
1 answer
168 views

WebApp Windows Command Injection without "||"

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web ...
2 votes
2 answers
1k views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
1 vote
0 answers
186 views

How does glibc prevent malloc unlink exploits?

The classic malloc overflow, of overwriting pointers in a free chunk, to cause free() unlink to overwrite an arbitrary location with an arbitrary value, is no longer possible with modern glibc (...
0 votes
0 answers
334 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
4 votes
2 answers
2k views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
1 vote
1 answer
1k views

How to read memory from format string exploit correctly

I'm trying to solve a problem on format string exploitation in which I have to overwrite anything in a specific address. Since the target address has a null byte at the begining, I need to write it at ...
1 vote
1 answer
406 views

Is a single infoleak enough to break ASLR if you don't have access to the binary?

With a single infoleak and access to the binary you can calculate the other addresses. Is this still possible when you don't have access to the binary?
0 votes
1 answer
118 views

Could a virus force a phone to download an app and spread it?

I'm writing a sci-fi story that includes a malicious app that spreads globally. The developer publishes an app without knowing it's infected, and it spreads because it forces phones to download it. ...
2 votes
1 answer
553 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
0 votes
1 answer
1k views

How can I generate a binary from an payload without any other addons?

For example how do I turn the payload/windows/format_all_drives into an exe without any other fancy addons? (I am talking about using msfvenom FYI)
22 votes
5 answers
17k views

Hackable linux distributions

A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux. But unfortunately it looks like the project is dead. So my question is are there other Linux distributions which ...
1 vote
2 answers
560 views

How do attackers determine ROP gadgets remotely?

Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
1 vote
1 answer
473 views

How many actions do you need to take to disable DEP

I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works. The application is a C++ app written in visual studio and I am running into ...
1 vote
1 answer
1k views

Understanding ret2libc return address location

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
0 votes
1 answer
3k views

What is source of bad characters exist in buffer overflows

I'm new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I'm referring to the process of sending all possible characters to the ...
0 votes
1 answer
336 views

Is it possible to use ROP to call legitimate functions even if the stack is not executable?

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment. For ...
1 vote
0 answers
299 views

Exploit - Code execution without assembly call instruction, int etc on ia_64

Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory The function has no call, int or other assembly instructions afterwards. ...
2 votes
1 answer
470 views

Are there any projects/papers on approaching exploit development with AI/automation?

I'm looking for research on the topic if at all possible or readings about efforts into this. Drilling down into binaries via fuzzing/fingerprinting for known vulnerable binary patterns and a little ...
0 votes
1 answer
343 views

Exploiting a service on 32bit OS on a 64bit processor with ShellCode

Let's theoretically assume I have an overflow vulnerability on a certain service I want to exploit. The service reside in 32bit Operating System on a 64bit Processor. I'm attempting to wrap my head ...
0 votes
0 answers
147 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
0 votes
0 answers
205 views

how to check offset for a program on remote server

I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
2 votes
1 answer
2k views

segmentation fault at strcpy while perforforming a buffer overflow

I have this code that I need to use to perform a ret2libc #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buf[256]; printf("buff is at:%p\n",buf); ...
1 vote
4 answers
315 views

What are the names of software vulnerabilities? [closed]

In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port. ...
1 vote
1 answer
217 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0 votes
0 answers
381 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
2 votes
1 answer
3k views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
2 votes
1 answer
452 views

How to use "jmp" in ROP

I'm trying to put together a ROP chain. I'm looking for a gadget to do the following: mov rdi, rdx ; mov rbp, rsp ; ret; But instead, I have a gadget like this : mov rdi, rdx ; mov rbp, rsp ; ...
6 votes
2 answers
40k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...
3 votes
2 answers
7k views

Cannot overwrite EIP in basic exploitation example

I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c): #include <string.h> int main( int argc, char** argv ) { char buffer[500]; ...
0 votes
1 answer
279 views

How do programmers write the initial exploits from the vulnerability details in a CVE? [closed]

I've noticed that lots of CVE at www.cvedetails.com do not have publicly available exploits. But they have high scores (ex: score higher than 9). With such a high score, I'd thought exploits would be ...
2 votes
2 answers
1k views

Cannot build a ROP chain

My ROP exploit crashes with segmentation fault for unknown reason. This is a vulnerable code (compiled via command gcc h2.c -no-pie -fno-stack-protector -m32 -o h2): #include <stdio.h> #include &...