Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

44 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
814 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
devopsfun's user avatar
  • 211
4 votes
0 answers
950 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
David's user avatar
  • 322
3 votes
0 answers
384 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
Neon Flash's user avatar
3 votes
0 answers
298 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
Benoit Sevens's user avatar
3 votes
0 answers
798 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
Lucian Nitescu's user avatar
2 votes
1 answer
671 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
Burst's user avatar
  • 23
2 votes
0 answers
225 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
Anderson's user avatar
  • 495
2 votes
0 answers
197 views

Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
Shuzheng's user avatar
  • 1,227
2 votes
0 answers
200 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
Marshall Whittaker's user avatar
2 votes
0 answers
594 views

Vtable - finding the vtable pointer

// overflow here, so that size + chunk_size == 32 and size > 32 uint8_t *buffer = new uint8_t[size + chunk_size]; // buffer is allocated immediately before mDataSource if (size > 0) {...
dev's user avatar
  • 997
2 votes
0 answers
359 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
dev's user avatar
  • 997
2 votes
1 answer
2k views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
K.Doe.x's user avatar
  • 19
1 vote
0 answers
184 views

How does glibc prevent malloc unlink exploits?

The classic malloc overflow, of overwriting pointers in a free chunk, to cause free() unlink to overwrite an arbitrary location with an arbitrary value, is no longer possible with modern glibc (...
SRobertJames's user avatar
1 vote
1 answer
363 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
Rick's user avatar
  • 138
1 vote
1 answer
1k views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
n00b.exe's user avatar
  • 181
1 vote
0 answers
297 views

Exploit - Code execution without assembly call instruction, int etc on ia_64

Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory The function has no call, int or other assembly instructions afterwards. ...
dev's user avatar
  • 997
1 vote
0 answers
155 views

Kernel exploit fails after executing first command

While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand. TLTR After escalating process privileges my exploit ...
Rob D's user avatar
  • 51
1 vote
0 answers
535 views

heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?

I'm currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy(): https://exploit.education/...
Shuzheng's user avatar
  • 1,227
1 vote
1 answer
1k views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
takadito15's user avatar
1 vote
0 answers
112 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
Chandan Kumar's user avatar
1 vote
1 answer
439 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
Artur's user avatar
  • 11
1 vote
0 answers
253 views

Running exploit inside textbox

I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow. So I'm able to trigger ...
Kartone's user avatar
  • 171
1 vote
0 answers
754 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
Umer's user avatar
  • 11
1 vote
0 answers
1k views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
HAlmusajjen's user avatar
1 vote
1 answer
3k views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
Jeremy's user avatar
  • 11
1 vote
0 answers
85 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
aedcv's user avatar
  • 203
1 vote
0 answers
376 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
user2284570's user avatar
  • 1,472
1 vote
0 answers
505 views

Immunity Debugger - !mona suggest

Potentially simple question. I have been going through some tutorials for exploit development that use !pvefindaddr for help with creating unique patterns and discovering the offset. I know that mona ...
user3046771's user avatar
1 vote
0 answers
135 views

Dynamic memory management i386 vs amd64

I've spotted some differences in the behavior of the GNU/Linux dynamic memory allocator in i386 vs amd64. While it's possible that I'm misunderstanding something ( in this case let me know ), I don't ...
brakio's user avatar
  • 11
1 vote
0 answers
963 views

Linux Priv Escalation Scripts

I am aware of a number of good linux priv escalation scripts out there which i use for my hacking ( legal only, mainly practice for my OSCP ). I like Linux Priv Escalation Scripts . My prefered one ...
rockstar's user avatar
  • 148
0 votes
0 answers
120 views

Specifying an integer within the maximum of an unsigned 64-bit integer does **not** cause a buffer overflow

The program I am working with has a POC published for it, but not a full explanation. I have been told by my mentor (I am part of a research program) to disclose as little information as possible ...
MrCaters's user avatar
0 votes
0 answers
144 views

Custom PsExec csharp code with plaintext credentials

I have this code for exploiting PsExec that works perfectly fine when I have a TGS for the CIFS SPN on the target, however there are situations where I only have plaintext credentials for the local ...
Ankylo Gomez's user avatar
0 votes
1 answer
120 views

pvefindaddr p2 in mona?

Is there a "!pvefindaddr p2" (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py? Alternatively, is there any option to run pvefindaddr in ...
user286591's user avatar
0 votes
0 answers
331 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
Greg Gregson's user avatar
0 votes
1 answer
503 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
asd40732's user avatar
0 votes
0 answers
145 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
user5623335's user avatar
0 votes
0 answers
203 views

how to check offset for a program on remote server

I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
Shubham Kumar's user avatar
0 votes
0 answers
378 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
Mike Vonar's user avatar
0 votes
0 answers
425 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
Wealot's user avatar
  • 899
0 votes
0 answers
571 views

Huge Dirty COW - Privileged access to files like with Dirty COW possible?

Has anybody read the Huge Dirty COW writeup? Can we also shmem files using THP and achieve the same result as Dirty COW, privileged access to files?
dev's user avatar
  • 997
0 votes
0 answers
671 views

ROP gadget - mmap - how to check if mmaped address is executable after gadget execution?

I am working with Stagefright exploit... my question is in bold below. Some background info: Below is the result of ROP chain/stack that mmap() stuff did including copying with other gadget (with ...
dev's user avatar
  • 997
0 votes
0 answers
747 views

Does the old technique of kernel32.dll search (find .dll base address) not work anymore?

Does the old technique of kernel32.dll search (find .dll base address) not work anymore? In the code below, I first take the kernel32.dll (return) address when the application starts, and then ...
Shuzheng's user avatar
  • 1,227
0 votes
0 answers
94 views

Winmap crashing differently when changing the crashing buffer

I'm trying to replicated the "egg hunting" exploitation for the Winmap . I started using the POC code provided (I rewrote it in Python) : __author__ = 'HSN' #!/usr/bin/python -w start = "[playlist]\...
HSN's user avatar
  • 998
0 votes
0 answers
108 views

Does Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training?

Does the Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training? Does it apply to security training on exploitation techniques? Is ...
3asm_'s user avatar
  • 198