Questions tagged [exploit-development]
For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).
11 questions
0
votes
1
answer
201
views
Spectre PoC - Paper based - opposite results
After long discussion with this Question (Thanks for help!)
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Came up with simple PoC based on Spectre paper.
Seems to be ...
- 1,007
10
votes
2
answers
8k
views
Why must a ret2libc attack follow the order "system(),exit(),command?
In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
- 439
6
votes
2
answers
44k
views
return to libc- finding libc's address and finding offsets
So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ .
I found libc's address by using "ldd vuln", and found system's ...
- 73
6
votes
2
answers
3k
views
Buffer overflow exploit works with gdb but not without
I am learning about buffer overflows and I’m developing my very first exploit.
There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
- 255
5
votes
1
answer
6k
views
Using (cat $file; cat) to run a simple BOF exploit
Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
- 133
3
votes
1
answer
848
views
Spectre Proof of Concept (PoC) Speculative Execution - Checking for value
Inspired by this question and based on this:
Why does me unpatched sytsem *appear* to be not vulenrable by Spectre?
Figured out I will open a new question, instead of "polluting" somebody else ...
- 1,007
3
votes
3
answers
1k
views
EternalBlue exploit and ASLR
Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
- 153
3
votes
2
answers
7k
views
Cannot overwrite EIP in basic exploitation example
I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c):
#include <string.h>
int main( int argc, char** argv ) {
char buffer[500];
...
- 209
2
votes
1
answer
2k
views
segmentation fault at strcpy while perforforming a buffer overflow
I have this code that I need to use to perform a ret2libc
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
char buf[256];
printf("buff is at:%p\n",buf);
...
- 23
1
vote
0
answers
400
views
Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?
Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them.
So, such filesystems if implemented in user space can suffer of buffer ...
- 1,492
0
votes
1
answer
283
views
Spectre - Code Optimization/Branch Training concept [closed]
Trying to load "a" (lowecase a) speculatively using Spectre.
Was hinted here:
Spectre PoC - Paper based - opposite results
that the problem why it does not load speculatively, could be
not ...
- 1,007