Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

45 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
657 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
0answers
607 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
3
votes
0answers
215 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
0answers
158 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
569 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
2
votes
0answers
91 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
2
votes
0answers
105 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
2
votes
0answers
118 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
499 views

Vtable - finding the vtable pointer

// overflow here, so that size + chunk_size == 32 and size > 32 uint8_t *buffer = new uint8_t[size + chunk_size]; // buffer is allocated immediately before mDataSource if (size > 0) {...
2
votes
0answers
227 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
2
votes
1answer
1k views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
2
votes
1answer
1k views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
1
vote
0answers
40 views

WebApp Windows Command Injection without “||”

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web ...
1
vote
0answers
125 views

Exploit - Code execution without assembly call instruction, int etc on ia_64

Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory The function has no call, int or other assembly instructions afterwards. ...
1
vote
1answer
209 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1
vote
0answers
59 views

Kernel exploit fails after executing first command

While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand. TLTR After escalating process privileges my exploit ...
1
vote
0answers
196 views

heap-one (x64) CTF exploit exercise: cannot overwrite GOT entry using arbitrary write (qword) primitive?

I'm currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy(): https://exploit.education/...
1
vote
1answer
533 views

buffer overflow in MIPS - jump to address 0x0040xxxx

I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses ...
1
vote
0answers
179 views

Sending payload and additional commands via Python

I'm trying to exploit ropasaurusrex binary. Basically It has buffer overflow vulnerability. Binary reads data from stdin and fills it to buffer. My goal for payload is to overwrite EIP with address ...
1
vote
0answers
52 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
1
vote
0answers
122 views

Running exploit inside textbox

I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow. So I'm able to trigger ...
1
vote
0answers
604 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
1
vote
0answers
973 views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
1
vote
1answer
2k views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
1
vote
0answers
23 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
0answers
216 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
1
vote
0answers
417 views

Immunity Debugger - !mona suggest

Potentially simple question. I have been going through some tutorials for exploit development that use !pvefindaddr for help with creating unique patterns and discovering the offset. I know that mona ...
1
vote
0answers
65 views

Dynamic memory management i386 vs amd64

I've spotted some differences in the behavior of the GNU/Linux dynamic memory allocator in i386 vs amd64. While it's possible that I'm misunderstanding something ( in this case let me know ), I don't ...
1
vote
0answers
890 views

Linux Priv Escalation Scripts

I am aware of a number of good linux priv escalation scripts out there which i use for my hacking ( legal only, mainly practice for my OSCP ). I like Linux Priv Escalation Scripts . My prefered one ...
0
votes
0answers
63 views

Can't overwrite EIP in bufferoverflow example

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, ...
0
votes
0answers
41 views

Exploiting buffer overflow in 64-bit macOS executable

I'm following this tutorial to create a buffer overflow demo. The article illustrates a 32-bit executable, but I'm feeling adventurous and decided to do a 64-bit one. Below is the deliberately ...
0
votes
1answer
66 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
0
votes
0answers
34 views

TCmalloc heap exploitation

I can control the addresses of Freelist pointer during deallocation https://github.com/marcinguy/CVE-2020-15999#update-7 Are there any TCMalloc Attacks that can turn this into RCE? TCmalloc should ...
0
votes
0answers
78 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
0
votes
0answers
55 views

how to check offset for a program on remote server

I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
0
votes
1answer
464 views

is there any way to exit meterpreter without exit the process?

I have a target process I'm injecting meterpreter shellcode (windows/meterpreter/reverse_tcp) into, I manage to get a shell but when I exit it, the process exits as well. Is there any easy way to make ...
0
votes
0answers
68 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
0
votes
1answer
228 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
0
votes
0answers
309 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
0
votes
0answers
488 views

Huge Dirty COW - Privileged access to files like with Dirty COW possible?

Has anybody read the Huge Dirty COW writeup? https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0 Am I correct that we can also shmem files using THP and achieve the same result ...
0
votes
0answers
118 views

Is a filler needed in a buffer overflow exploit?

Why do I see a filler being used in some exploits? Take as an example the code below: exploit = junk + eip + nops + shellcode fill = "\x43"*(BUF_SIZE-len(exploit)) buf = exploit + fill I guess the ...
0
votes
0answers
437 views

ROP gadget - mmap - how to check if mmaped address is executable after gadget execution?

I am working with Stagefright exploit... my question is in bold below. Some background info: Below is the result of ROP chain/stack that mmap() stuff did including copying with other gadget (with ...
0
votes
0answers
623 views

Does the old technique of kernel32.dll search (find .dll base address) not work anymore?

Does the old technique of kernel32.dll search (find .dll base address) not work anymore? In the code below, I first take the kernel32.dll (return) address when the application starts, and then ...
0
votes
0answers
43 views

Winmap crashing differently when changing the crashing buffer

I'm trying to replicated the "egg hunting" exploitation for the Winmap . I started using the POC code provided (I rewrote it in Python) : __author__ = 'HSN' #!/usr/bin/python -w start = "[playlist]\...
0
votes
0answers
58 views

Does Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training?

Does the Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training? Does it apply to security training on exploitation techniques? Is ...