Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
20
votes
5answers
15k views

Hackable linux distributions

A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux. But unfortunately it looks like the project is dead. So my question is are there other Linux distributions which ...
11
votes
2answers
13k views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
10
votes
2answers
751 views

Are memcpy() based race conditions exploitable for causing remote code execution?

Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
9
votes
2answers
6k views

Why must a ret2libc attack follow the order "system(),exit(),command?

In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
8
votes
2answers
669 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
7
votes
1answer
5k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
7
votes
1answer
4k views

Can I do a String Format Exploit for x64 systems? [closed]

I was trying to replicate the experiment in Gray Hat Hacking - Third Edition, Chapter 12, about Format String Exploits, but their architecture is IA32, while mine is AMD 64bits. Therefore when I check ...
7
votes
1answer
1k views

Exploit only works in gdb

tl;dr: Why my exploit only works inside gdb. I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
7
votes
1answer
3k views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I have ...
7
votes
1answer
642 views

Blueborne - Attack Scenario Clarification

Based on the Technical White Paper http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper-1.pdf?t=1505319664351 After reading it, I understand it as follows (Page 13, bottom) So to exploit ...
6
votes
2answers
2k views

Buffer overflow exploit works with gdb but not without

I am learning about buffer overflows and I’m developing my very first exploit. There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
6
votes
2answers
676 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
5
votes
2answers
2k views

Are all vulnerabilities exploitable?

I understand the difference between a vulnerability and an exploit, but as I surf the exploit databases, I see more vulnerabilities and less exploits. Shouldn't there be at least one exploit for every ...
5
votes
1answer
4k views

Exploit does not work outside GDB

I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
5
votes
1answer
6k views

How to bypass ASLR with ROP

I was reading this article by the InfoSec institute: http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref And was able to follow along until he did the ...
4
votes
1answer
527 views

KRACK: will there be an exploit soon?

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.): Is it likely that there will be an exploit available soon? I think of ...
4
votes
2answers
1k views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
4
votes
3answers
728 views

Why strace isn't showing system call being made in shellcode?

I'm new to shellcoding. I have written assembly code : section .text global _start _start: jmp end start: ;open file pop ebx ; get address of filename xor eax,eax mov [ebx+3], al mov al,...
4
votes
1answer
1k views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
4
votes
2answers
23k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...
4
votes
1answer
4k views

Using (cat $file; cat) to run a simple BOF exploit

Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
4
votes
1answer
2k views

Modifying shell code to bypass Windows Firewall

As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on. I have an idea but I'm having hard time applying it. What I'...
4
votes
2answers
559 views

Is it possible to develop memory corruption exploits without access to the executable?

Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she ...
4
votes
2answers
616 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
4
votes
1answer
362 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
4
votes
0answers
658 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
1answer
681 views

Android Stagefright Google Zero Day Exploit doesn't run. How to fix? [closed]

Exploit is posted here, however it is missing several things, for example shellcode and it binds to localhost for exploitation, cannot access it from Android device when started on my computer. I ...
4
votes
0answers
607 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
3
votes
3answers
884 views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
3
votes
1answer
8k views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
3
votes
2answers
11k views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: gcc ...
3
votes
1answer
1k views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
3
votes
1answer
471 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b '\x00\...
3
votes
1answer
72 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
2answers
249 views

Proof of concepts for published exploits

Do industry pros have VM's or various workstations setup to go through known exploits after they've been patched or is that less beneficial for learning than i'm imagining? I'm thinking, how can you ...
3
votes
1answer
150 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
3
votes
1answer
645 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
3
votes
1answer
144 views

How does brainstorming look like for a team like Google's “Project Zero” [duplicate]

The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process. Since the news of Meltdown/Spectre I was wondering: How do teams like ...
3
votes
1answer
1k views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: \x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\...
3
votes
0answers
215 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
0answers
159 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
570 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
3
votes
1answer
2k views

Heap Overflow - unlink() technique exploitation on x86_64 (64 bit)

Trying to exploit this sample vulnerable program: /* Heap overflow vulnerable program. */ #include <stdlib.h> #include <string.h> int main( int argc, char * argv[] ) { char * ...
2
votes
1answer
328 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
2
votes
2answers
3k views

x32 VS x64 Reverse Engineering and Exploit Development

I started to learn RE and Exploit Development and most materials almost all of them are on 32 bit architecture. what the difference in the point of view of Exploit Development. I know in Shellcoding ...
2
votes
1answer
3k views

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely. The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. ...
2
votes
1answer
2k views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
2
votes
3answers
1k views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
2
votes
1answer
313 views

Security Features enabled in Linux Debian and Ubuntu

i am actually doing some tutorials about ROP on Linux. So i tried to follow the tutorial and compiled some of the example codes to try ROP in a small scope. But actually when i am trying to exploit ...
2
votes
2answers
3k views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...