Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
1
vote
0answers
400 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
0
votes
1answer
228 views

Stack Buffer Overflow using SEH in Simple Web Server 2.2rc2

I am practicing writing exploit for Simple Web Server 2.2rc2. I was able to: find proper offset to overwrite SE Handler and Next SEH find POP,POP,RET address My problem is that, I can't execute my ...
2
votes
0answers
118 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
1answer
1k views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
1
vote
1answer
138 views

Found how to get Oauth2 client_id along matching secret but redirect_uri is whitelisted as requirement. Is it still safe?

If you get an OAuth 2.0 client_id along with a matching secret, you can in theory impersonate the target website. You trick the victim into visiting your URL; Through the client_id and the matching ...
1
vote
1answer
443 views

Shellcode getting segmentation fault on vmware

I'm learning exploitation, and I downloaded some execve("/bin/sh") shellcode from exploit-db to use it in simple buffer overflow example. When I execute the program I am getting segmentation fault. I'...
4
votes
1answer
362 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
4
votes
1answer
1k views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
3
votes
0answers
215 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
300 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
2
votes
1answer
1k views

BufferOverflow attack Segment Fault

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and ...
0
votes
1answer
238 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
0answers
309 views

Vulnserver windows 10 only a few exploits

I am playing around with vulnserver on my windows 10 (up to date) host. The weird thing is I only get crashes with KSTET and GTER and nothing with the other ones. As I found this weird I cheated a ...
0
votes
1answer
206 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
2
votes
1answer
2k views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
-1
votes
1answer
451 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
7
votes
1answer
5k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
1
vote
1answer
275 views

buffer overflow 64 bit issue

I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. ...
3
votes
1answer
150 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
1
vote
1answer
312 views

Developing MIPS exploit in python memory address getting parse as a value [closed]

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem. below is the HTTP request which occurs the crash POST /...
1
vote
1answer
471 views

Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)

I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
2
votes
1answer
2k views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
0
votes
2answers
267 views

How do malware developers avoid wrecking their own computers?

Given that there's quite a lot of malware running around targeting home computers; that for there to be malware, someone has to have built it; and most malware developers probably don't have the ...
1
vote
1answer
537 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
72 views

Exploit development - Will different devices with the same OS/Architecture have the same exact process memory (e.g. addresses) for a given binary?

Sometimes, when I develop an exploit that perfectly works on a given machine, it will fail on a different one, despite them having the same OS/Architecture and configurations (like language, which in ...
3
votes
0answers
158 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
2k views

Leak a GOT entry using return-to-printf@plt

I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-...
0
votes
1answer
414 views

Stack Protection off but still cant overwrite EIP

When Compiling with: gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32 I am able to overwrite the return address with just about any value except a valid return address. ...
2
votes
0answers
155 views

Meltdown - Reading processes info from leaked memory [closed]

Found this video: https://www.youtube.com/watch?v=De4rBaAdKNA In the video Meltdown is used to read process memory based by PID/name. How it is done? The program looks for task_struct in leaked ...
0
votes
1answer
194 views

Spectre - Code Optimization/Branch Training concept [closed]

Trying to load "a" (lowecase a) speculatively using Spectre. Was hinted here: Spectre PoC - Paper based - opposite results that the problem why it does not load speculatively, could be not ...
0
votes
1answer
120 views

Spectre PoC - Paper based - opposite results

After long discussion with this Question (Thanks for help!) Spectre Proof of Concept (PoC) Speculative Execution - Checking for value Came up with simple PoC based on Spectre paper. Seems to be ...
3
votes
1answer
645 views

Spectre Proof of Concept (PoC) Speculative Execution - Checking for value

Inspired by this question and based on this: Why does me unpatched sytsem *appear* to be not vulenrable by Spectre? Figured out I will open a new question, instead of "polluting" somebody else ...
1
vote
0answers
122 views

Running exploit inside textbox

I'm developing an exploit against an x32 program running on a Windows x64 with DEP protection on. The vulnerability lies inside a textbox and it consists in an SEH Overflow. So I'm able to trigger ...
3
votes
1answer
144 views

How does brainstorming look like for a team like Google's “Project Zero” [duplicate]

The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process. Since the news of Meltdown/Spectre I was wondering: How do teams like ...
2
votes
1answer
257 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
2
votes
1answer
104 views

Understanding a crash

Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash. My normal steps are: load application into a debugger ...
1
vote
1answer
390 views

Meltdown - Reading Process Memory Data

Tried this PoC: https://github.com/mniip/spectre-meltdown-poc Which works for the sys_call_table. I was able to read the syscall sys_read address. Wanted to test it with a sample program to read ...
2
votes
1answer
2k views

KPTI - Meltdown - PoC Analysis

Based on this PoC: https://twitter.com/brainsmoke/status/948561799875502080 I see there are four rows outputed, the second one are two bytes of address of sys_read. What is the first one? Would ...
0
votes
0answers
488 views

Huge Dirty COW - Privileged access to files like with Dirty COW possible?

Has anybody read the Huge Dirty COW writeup? https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0 Am I correct that we can also shmem files using THP and achieve the same result ...
0
votes
0answers
118 views

Is a filler needed in a buffer overflow exploit?

Why do I see a filler being used in some exploits? Take as an example the code below: exploit = junk + eip + nops + shellcode fill = "\x43"*(BUF_SIZE-len(exploit)) buf = exploit + fill I guess the ...
1
vote
0answers
604 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
4
votes
1answer
527 views

KRACK: will there be an exploit soon?

Given that the probability is high that there are unpatched devices left even years from now (android devices, IoT-Things, etc.): Is it likely that there will be an exploit available soon? I think of ...
1
vote
0answers
257 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
582 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
2
votes
1answer
2k views

Stackpivoting techniques

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that. The question is, during the writing ...
7
votes
1answer
642 views

Blueborne - Attack Scenario Clarification

Based on the Technical White Paper http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper-1.pdf?t=1505319664351 After reading it, I understand it as follows (Page 13, bottom) So to exploit ...
2
votes
2answers
3k views

x32 VS x64 Reverse Engineering and Exploit Development

I started to learn RE and Exploit Development and most materials almost all of them are on 32 bit architecture. what the difference in the point of view of Exploit Development. I know in Shellcoding ...
1
vote
0answers
973 views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
3
votes
0answers
569 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
4
votes
2answers
23k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...