Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
1
vote
1answer
84 views

How to increase gadget occurence in a program

I'm exercising with ROP. In a vulnerable program I control the RIP, use "ropeme" and search for gadgets I find many references to 32 bits long registers, but not a single extended register. I need a ...
1
vote
1answer
1k views

Shellcode parameter passing

I am trying to use an environment variable to store my shellcode and then point my RET to it, so that I may get to execute my shellcode. Here is my vulnerable program 'abc.c' #include string.h #...
-2
votes
1answer
128 views

How are viruses made for windows? [closed]

I know that windows source code is proprietary so how do hackers and others know what are the available exploits in windows so that the viruses can take their advantage.
5
votes
1answer
6k views

How to bypass ASLR with ROP

I was reading this article by the InfoSec institute: http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref And was able to follow along until he did the ...
2
votes
2answers
2k views

Unable to execute shellcode in basic buffer overflow example

I have a basic example of a program vulnerable to buffer overflow (extracted from this other question). #include <string.h> void vuln(char *arg) { char buffer[500]; strcpy(buffer, arg)...
2
votes
2answers
4k views

Cannot overwrite EIP in basic exploitation example

I'm trying to replicate a simple buffer overflow for which I have the following code (strcpy_ex.c): #include <string.h> int main( int argc, char** argv ) { char buffer[500]; ...
1
vote
1answer
2k views

ROP: finding a useful stack pivot

I'm trying to write a rop chain to bypass dep on Windows 7 x64 SP1. I'm working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered ...
0
votes
1answer
2k views

What exploits are possible in languages like C/C++ other than overflow errors? [closed]

I know that C/C++ programs are highly susceptible to overflow errors that lead to program compromise. But I was wondering, are there any other vulnerabilites that can exist other than overflow errors? ...
0
votes
0answers
125 views

Are Metasploit built-in exploits used in real-life pen testing? [duplicate]

I just started seriously playing around with Metasploit, and a question kept coming into my mind. In the case of Adobe Flash for example, there are thousands of Flash vulnerabilities in CVEdetails....
1
vote
1answer
2k views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
3
votes
3answers
883 views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
1
vote
1answer
983 views

Malicious .so Library creation in CVE-2017-7494 Sambacry

I'm trying to understand the whole process behind the Sambacry exploit. The problem is that I'm having a little problem understanding how do you create the malicious .so library to be loaded by the ...
1
vote
1answer
711 views

Windows Applications for Exploit Development exercising? [closed]

I started to learn ASM and learned a lot about exploit development in the last few weeks. My question is, are there any comparable vulnerable windows programs like vulnserver out there which are good ...
0
votes
1answer
2k views

Setting a return address in a simple C exploit

I have an vulnerable program exploitable through the cmdline: ./vuln $(perl -e 'print "\x90"x22'; cat shell; perl -e 'print "\x90"x22';perl -e 'print "\xf4\xdd\xff\xff\xff\x7f"') ���������������������...
7
votes
1answer
1k views

Exploit only works in gdb

tl;dr: Why my exploit only works inside gdb. I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C ...
1
vote
2answers
2k views

Segmentation fault error when calling user defined function in shellcode

I am getting the segmentation fault error when I called function "target" in my shellcode. Here's the C code of program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #...
2
votes
1answer
3k views

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

So I have a Linux x86-64 binary linked with libc dynamically running on patched Ubuntu 16.04 remotely. The executable makes one call to libc read and exits, allowing simple stack overflow into ROP. ...
7
votes
1answer
4k views

Can I do a String Format Exploit for x64 systems? [closed]

I was trying to replicate the experiment in Gray Hat Hacking - Third Edition, Chapter 12, about Format String Exploits, but their architecture is IA32, while mine is AMD 64bits. Therefore when I check ...
5
votes
2answers
2k views

Are all vulnerabilities exploitable?

I understand the difference between a vulnerability and an exploit, but as I surf the exploit databases, I see more vulnerabilities and less exploits. Shouldn't there be at least one exploit for every ...
4
votes
1answer
4k views

Using (cat $file; cat) to run a simple BOF exploit

Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
1
vote
0answers
23 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
2answers
286 views

Stack buffer overflow exploit stacking characters?

I have a program like this: int main() { char buffer[16]; printf("Write something: "); gets(buffer); printf("You wrote: %s\n", buffer); return 0; } And I have wrote a little ...
2
votes
1answer
1k views

Stagefright - building ROP stack - pivoting

Here I control r2 (vtable) 0xb6712c48 <+7120>: ldr r5, [r2, #28] 0xb6712c4a <+7122>: ldrd r2, r3, [r8] 0xb6712c4e <+7126>: blx r5 How I understand it: I control the ...
2
votes
0answers
499 views

Vtable - finding the vtable pointer

// overflow here, so that size + chunk_size == 32 and size > 32 uint8_t *buffer = new uint8_t[size + chunk_size]; // buffer is allocated immediately before mDataSource if (size > 0) {...
0
votes
0answers
437 views

ROP gadget - mmap - how to check if mmaped address is executable after gadget execution?

I am working with Stagefright exploit... my question is in bold below. Some background info: Below is the result of ROP chain/stack that mmap() stuff did including copying with other gadget (with ...
2
votes
0answers
227 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
1
vote
0answers
216 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
4
votes
2answers
558 views

Is it possible to develop memory corruption exploits without access to the executable?

Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she ...
5
votes
1answer
4k views

Exploit does not work outside GDB

I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
10
votes
2answers
751 views

Are memcpy() based race conditions exploitable for causing remote code execution?

Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
3
votes
1answer
2k views

Heap Overflow - unlink() technique exploitation on x86_64 (64 bit)

Trying to exploit this sample vulnerable program: /* Heap overflow vulnerable program. */ #include <stdlib.h> #include <string.h> int main( int argc, char * argv[] ) { char * ...
2
votes
1answer
678 views

Is it possible to execute code in this program using heap overflow?

Program code (with Pseudo code part): #include <stdio.h> #include <stdlib.h> int main(int argc, char** argv) { int controlled1=10; int controlled2=20; int controlled3=300; //test.bin ...
1
vote
1answer
289 views

CVE-2016-6254 - Understanding Heap Overflow

Trying to understand this piece of code: It containts Heap Buffer Overflow Vulnerability: static int parse_packet (sockent_t *se, /* {{{ */ void *buffer, size_t buffer_size, int flags, ...
4
votes
3answers
728 views

Why strace isn't showing system call being made in shellcode?

I'm new to shellcoding. I have written assembly code : section .text global _start _start: jmp end start: ;open file pop ebx ; get address of filename xor eax,eax mov [ebx+3], al mov al,...
2
votes
1answer
242 views

Need help in bypassing Structured Exception Handling (SEH) + egghunter

I am practicing exploit development and trying to remake this exploit by myself in the same environment: exploit link I face an issue that the egghunter is not running I even tried the one in the ...
0
votes
1answer
87 views

MCC records in JPEG2000

I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records ...
2
votes
1answer
749 views

Compiling exploit on a different kernel than target (but same arch): is it un-smart or risky?

I'm in a situation where I've compiled about 15 or more exploits for a machine and each has failed. The failures had to do with the kernel being compiled with highly secure settings, i.e. mmap ...
1
vote
1answer
50 views

how to create dependency free script? [closed]

I have a script which can exploit a specific vulnerability. This script works well with the latest system but in the older systems it failed to run because of dependency (glibc-2.14). So how can i ...
1
vote
1answer
272 views

Interpreting CVE ratings: Buffer Overflow vs. Denial of Service vs. Remote Code Executing (RCE)

If a CVE lists a buffer overflow vulnerability, but not a remote code execution, should I interpret that as: This vulnerability has not been confirmed to expose RCE, or This vulnerability has been ...
1
vote
0answers
417 views

Immunity Debugger - !mona suggest

Potentially simple question. I have been going through some tutorials for exploit development that use !pvefindaddr for help with creating unique patterns and discovering the offset. I know that mona ...
1
vote
0answers
298 views

My exploit does not overwrite EIP, why? [closed]

I am try to write my first exploit, that will exploit the pinfo program. I install the program via apt-get them i crash him with: neo@matrix:~$ pinfo -m `python -c 'print "A"*50064+"DCBA"'` ...
9
votes
2answers
6k views

Why must a ret2libc attack follow the order "system(),exit(),command?

In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
0
votes
0answers
623 views

Does the old technique of kernel32.dll search (find .dll base address) not work anymore?

Does the old technique of kernel32.dll search (find .dll base address) not work anymore? In the code below, I first take the kernel32.dll (return) address when the application starts, and then ...
1
vote
1answer
333 views

Discover framebuffer address on unknown architecture?

Recently I got running unsigned code through an exploit on an device. Now I would like to discover the framebuffer address so I could write to the screen and output data. The only way I can imagine ...
0
votes
1answer
1k views

Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?

when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...
1
vote
0answers
65 views

Dynamic memory management i386 vs amd64

I've spotted some differences in the behavior of the GNU/Linux dynamic memory allocator in i386 vs amd64. While it's possible that I'm misunderstanding something ( in this case let me know ), I don't ...
2
votes
3answers
1k views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
1
vote
0answers
890 views

Linux Priv Escalation Scripts

I am aware of a number of good linux priv escalation scripts out there which i use for my hacking ( legal only, mainly practice for my OSCP ). I like Linux Priv Escalation Scripts . My prefered one ...
4
votes
1answer
2k views

Modifying shell code to bypass Windows Firewall

As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on. I have an idea but I'm having hard time applying it. What I'...
3
votes
2answers
249 views

Proof of concepts for published exploits

Do industry pros have VM's or various workstations setup to go through known exploits after they've been patched or is that less beneficial for learning than i'm imagining? I'm thinking, how can you ...