Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
22 votes
5 answers
17k views

Hackable linux distributions

A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux. But unfortunately it looks like the project is dead. So my question is are there other Linux distributions which ...
Dirk's user avatar
  • 520
12 votes
2 answers
15k views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
dev's user avatar
  • 997
10 votes
2 answers
8k views

Why must a ret2libc attack follow the order "system(),exit(),command?

In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
Lew Wei Hao's user avatar
10 votes
2 answers
985 views

Are memcpy() based race conditions exploitable for causing remote code execution?

Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
user2284570's user avatar
  • 1,472
8 votes
1 answer
6k views

Can I do a String Format Exploit for x64 systems? [closed]

I was trying to replicate the experiment in Gray Hat Hacking - Third Edition, Chapter 12, about Format String Exploits, but their architecture is IA32, while mine is AMD 64bits. Therefore when I check ...
Fernando Pérez's user avatar
8 votes
2 answers
834 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
lily's user avatar
  • 968
7 votes
1 answer
7k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
tropz's user avatar
  • 79
7 votes
2 answers
2k views

Are all vulnerabilities exploitable?

I understand the difference between a vulnerability and an exploit, but as I surf the exploit databases, I see more vulnerabilities and less exploits. Shouldn't there be at least one exploit for every ...
GypsyCosmonaut's user avatar
7 votes
1 answer
2k views

Exploit only works in gdb

tl;dr: Why my exploit only works inside gdb. I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
Joao Daniel's user avatar
7 votes
1 answer
3k views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I have ...
dev's user avatar
  • 997
7 votes
1 answer
725 views

Blueborne - Attack Scenario Clarification

Based on the Technical White Paper http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper-1.pdf?t=1505319664351 After reading it, I understand it as follows (Page 13, bottom) So to exploit ...
dev's user avatar
  • 997
6 votes
2 answers
40k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...
Jonathan's user avatar
6 votes
2 answers
3k views

Buffer overflow exploit works with gdb but not without

I am learning about buffer overflows and I’m developing my very first exploit. There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
Andrei Socaciu's user avatar
6 votes
2 answers
811 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
D.W.'s user avatar
  • 99.6k
5 votes
1 answer
6k views

Using (cat $file; cat) to run a simple BOF exploit

Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
Fernando Pérez's user avatar
5 votes
1 answer
5k views

Exploit does not work outside GDB

I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
shxdow's user avatar
  • 123
5 votes
1 answer
7k views

How to bypass ASLR with ROP

I was reading this article by the InfoSec institute: http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref And was able to follow along until he did the ...
alloy's user avatar
  • 51
4 votes
2 answers
1k views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
HSN's user avatar
  • 998
4 votes
1 answer
599 views

KRACK: will there be an exploit soon?

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.): Is it likely that there will be an exploit available soon? I think of ...
Tobi Nary's user avatar
  • 14.4k
4 votes
3 answers
915 views

Why strace isn't showing system call being made in shellcode?

I'm new to shellcoding. I have written assembly code : section .text global _start _start: jmp end start: ;open file pop ebx ; get address of filename xor eax,eax mov [ebx+3], al mov al,...
Rakesh Mane's user avatar
4 votes
2 answers
2k views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
questioner's user avatar
4 votes
1 answer
2k views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
Shuzheng's user avatar
  • 1,227
4 votes
1 answer
17k views

Problem with overwriting the return address (buffer overflow)

I'm trying to exploit the following code with a buffer overflow and make it run the overflowed function: #include <string.h> #include <stdio.h> void overflowed() { printf("%s\...
user1758952's user avatar
4 votes
1 answer
2k views

Modifying shell code to bypass Windows Firewall

As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on. I have an idea but I'm having hard time applying it. What I'...
HSN's user avatar
  • 998
4 votes
2 answers
705 views

Is it possible to develop memory corruption exploits without access to the executable?

Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she ...
Echo Nolan's user avatar
4 votes
2 answers
736 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
Tim Matheson's user avatar
4 votes
1 answer
857 views

Exploit "Blind" buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
Lucian Nitescu's user avatar
4 votes
0 answers
814 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
devopsfun's user avatar
  • 211
4 votes
1 answer
739 views

Android Stagefright Google Zero Day Exploit doesn't run. How to fix? [closed]

Exploit is posted here, however it is missing several things, for example shellcode and it binds to localhost for exploitation, cannot access it from Android device when started on my computer. I ...
dev's user avatar
  • 997
4 votes
0 answers
950 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
David's user avatar
  • 322
3 votes
3 answers
1k views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
gigasai's user avatar
  • 153
3 votes
1 answer
4k views

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely. The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. ...
Gbps's user avatar
  • 181
3 votes
1 answer
9k views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
user104787's user avatar
3 votes
2 answers
13k views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: gcc ...
reyyez's user avatar
  • 137
3 votes
2 answers
7k views

Cannot overwrite EIP in basic exploitation example

I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c): #include <string.h> int main( int argc, char** argv ) { char buffer[500]; ...
Jausk's user avatar
  • 209
3 votes
1 answer
2k views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
JDeff's user avatar
  • 31
3 votes
1 answer
671 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b '\x00\...
Jordan Hanna's user avatar
3 votes
1 answer
763 views

Can't get this memory addressing

I am working with this INE eCXD material and I am working on my basics of buffer overflow on Linux. In the lab, there is supposed to be a binary that is using the strcpy() function and it SEGFAULTS ...
MoRizk's user avatar
  • 31
3 votes
1 answer
183 views

Leak multiple lines from file

I am researching this bug here, where the first line of an arbitrary file can be leaked by triggering a SyntaxError using the compile() function. Is there a method of leaking the rest of the file, ...
isopach's user avatar
  • 511
3 votes
1 answer
3k views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
bsdboy's user avatar
  • 51
3 votes
1 answer
156 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
Not Now's user avatar
  • 199
3 votes
1 answer
1k views

Compiling exploit on a different kernel than target (but same arch): is it un-smart or risky?

I'm in a situation where I've compiled about 15 or more exploits for a machine and each has failed. The failures had to do with the kernel being compiled with highly secure settings, i.e. mmap ...
Info5ek's user avatar
  • 402
3 votes
2 answers
334 views

Proof of concepts for published exploits

Do industry pros have VM's or various workstations setup to go through known exploits after they've been patched or is that less beneficial for learning than i'm imagining? I'm thinking, how can you ...
inbinder's user avatar
  • 155
3 votes
1 answer
301 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
Andy's user avatar
  • 263
3 votes
1 answer
831 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
dev's user avatar
  • 997
3 votes
1 answer
221 views

How does brainstorming look like for a team like Google's "Project Zero" [duplicate]

The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process. Since the news of Meltdown/Spectre I was wondering: How do teams like ...
NoRyb's user avatar
  • 131
3 votes
2 answers
3k views

Unable to execute shellcode in basic buffer overflow example

I have a basic example of a program vulnerable to buffer overflow (extracted from this other question). #include <string.h> void vuln(char *arg) { char buffer[500]; strcpy(buffer, arg)...
Jausk's user avatar
  • 209
3 votes
1 answer
2k views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: \x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\...
dev's user avatar
  • 997
3 votes
0 answers
384 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
Neon Flash's user avatar
3 votes
0 answers
297 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
Benoit Sevens's user avatar