Questions tagged [exploit-development]

For questions about development of software which takes advantage of exploits (vulnerabilities in security systems).

Filter by
Sorted by
Tagged with
0
votes
1answer
335 views

What do the [-], [+], [!] line prefixes mean in exploit outputs?

When you're using exploits, in the output, every line is prefixed with a symbol inside a set of square brackets. For example: [+] Set arguments. [-] Running exploit. [!] Warning server returned 404. ...
-1
votes
2answers
2k views

How to find Use-After-Free vulnerabilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect UAF vulnerabilities in JavaScript or HTML (i.e. with a static analysis)...
1
vote
2answers
649 views

Is it possible to plan for race conditions?

Is it possible to plan for race conditions, so that you can execute specific commands at a specific time? For example, the following code is vulnerable to a race condition. Is it possible to modify ...
6
votes
2answers
676 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
3
votes
1answer
8k views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
0
votes
0answers
43 views

Winmap crashing differently when changing the crashing buffer

I'm trying to replicated the "egg hunting" exploitation for the Winmap . I started using the POC code provided (I rewrote it in Python) : __author__ = 'HSN' #!/usr/bin/python -w start = "[playlist]\...
1
vote
2answers
1k views

Are SEH exploits valid against Linux?

I was trying to write an exploit for Crossfire (a game on Linux which has BOF vulnerability) to practice for a CTF. While fuzzing the game, I found out that if you increase the buffer size you send ...
3
votes
1answer
1k views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: \x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\...
4
votes
2answers
1k views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
4
votes
2answers
614 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
1
vote
1answer
1k views

Exploit Stack Based buffer overflow (x64) while controlling rbx register

I can control these registers: (gdb) i r rax 0x1 1 rbx 0x4141414141414141 4702111234474983745 rcx 0x7ffff760cf90 140737343704976 rdx ...
11
votes
2answers
13k views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
-1
votes
2answers
562 views

Guidance towards exploit development and exploring codes [closed]

I am familiar with intel assembly ,c programming ,perl and linux kernel internals. I want to explore more through fuzzing , analyzing source code and developing exploits as well as proper safety ...
4
votes
0answers
656 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
6
votes
2answers
2k views

Buffer overflow exploit works with gdb but not without

I am learning about buffer overflows and I’m developing my very first exploit. There is a server process that listens to a socket and forks a new process for each client. The child process has a ...
1
vote
1answer
802 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
2
votes
1answer
258 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
2answers
11k views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: gcc ...
7
votes
1answer
3k views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I have ...
-2
votes
1answer
638 views

LFI exploitation using data:// [closed]

I found LFI in my website and I tried to exploit it, but when I use php://input or data:// it doesn't work, I cannot get the shell. Example: .index.php?lang=data:;base64,...
2
votes
1answer
1k views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
4
votes
1answer
681 views

Android Stagefright Google Zero Day Exploit doesn't run. How to fix? [closed]

Exploit is posted here, however it is missing several things, for example shellcode and it binds to localhost for exploitation, cannot access it from Android device when started on my computer. I ...
0
votes
0answers
58 views

Does Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training?

Does the Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to security training? Does it apply to security training on exploitation techniques? Is ...
-4
votes
3answers
277 views

Reverse Engineer and Exploits researching [closed]

Can some one give me a start point for finding exploits in software and reverse engineering? I need some kind of a book or a site... I have background with programming with high and low level such as ...
0
votes
1answer
345 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
4
votes
0answers
605 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
8
votes
2answers
668 views

When is memory allocation/layout deterministic?

I'm trying to learn about buffer overflow attacks, both on the stack and on the heap. However, I'm confused about when it's possible to determine the address of the buffer. The classic "Smashing the ...
3
votes
1answer
1k views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
0
votes
1answer
1k views

reading/downloading big files in metasploit module [closed]

I am writing a post exploitation module that supports meterpreter sessions. For my module to work, I need to read/download some files from the victim machine that may be small or bigger. I am having ...
0
votes
1answer
558 views

Browser fuzzing with Windbg [closed]

the story looks like this: we have a browser, we have attached windbg to this browser, we have a fuzzing 'page'. now, when browser will crash (and i.e. I know that bug occurs somewhere in the HTML ...
0
votes
2answers
2k views

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

Is it possible to exploit a vulnerable application that is running inside a process virtual machine? Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't ...
1
vote
1answer
102 views

When I controll EIP, how do I discover what the next steps are?

Lets say I can control the EIP CPU Register, and I want to jump to a specific function of which I know the correct memory address. This address is inside the same memory page. We have no exploit ...
20
votes
5answers
15k views

Hackable linux distributions

A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux. But unfortunately it looks like the project is dead. So my question is are there other Linux distributions which ...
3
votes
1answer
471 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b '\x00\...
2
votes
1answer
313 views

Security Features enabled in Linux Debian and Ubuntu

i am actually doing some tutorials about ROP on Linux. So i tried to follow the tutorial and compiled some of the example codes to try ROP in a small scope. But actually when i am trying to exploit ...
1
vote
1answer
194 views

How to fuzz shared objects?

I know there have been similar questions about that topic, but I think mine differs from the others. I have this application which I am able to crash, but the error seems to happen inside of a shared ...
-2
votes
1answer
2k views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
0
votes
1answer
260 views

Automatic exploit searches

How to automatically search and download exploits which matches for example with kernel release ? Is there for example a public REST web service which provide data in XML or JSON format to a client ...
2
votes
2answers
3k views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...

1 2 3
4