Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

148 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
456 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
Damon's user avatar
  • 5,221
6 votes
0 answers
1k views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
darkhorizon's user avatar
6 votes
1 answer
726 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
Synthetic Ascension's user avatar
5 votes
1 answer
1k views

XXE OOB Large File Extraction

Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
Ravan87's user avatar
  • 51
4 votes
0 answers
2k views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
nilminus's user avatar
4 votes
0 answers
297 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
serv-inc's user avatar
  • 471
4 votes
0 answers
954 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
David's user avatar
  • 322
4 votes
1 answer
880 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
GarlicCheese's user avatar
3 votes
0 answers
2k views

How does PUA:Win32/InstallCore get on my PC?

I run a full (not quick) scan of Windows Defender every night. Somehow, between two nights ago and last night an instance of PUA:Win32/InstallCore got placed on my PC. Windows Defender removed it, ...
user316117's user avatar
3 votes
0 answers
812 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
Guysudai1's user avatar
  • 143
3 votes
0 answers
1k views

Buffer overflow exploitation: JMP ESP and CALL ESI

I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as ...
cNil's user avatar
  • 31
3 votes
1 answer
803 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
Stjubit's user avatar
  • 31
3 votes
0 answers
805 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
Lucian Nitescu's user avatar
3 votes
0 answers
469 views

Older Cell / Smart phones were susceptible to bluesnarfing / bluetooth attacks, Why specifically are smartphones secure from this attack now?

Older cell / smart phones were susceptible to bluesnarfing / Bluetooth attacks, Nokia phones in particular. But now in days, modern smart phone and cell phones that use Bluetooth technology for ...
Keith07304's user avatar
3 votes
1 answer
277 views

How to notify Adobe about a software issue

Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an ...
rolexgold18's user avatar
2 votes
1 answer
242 views

Does Routersploit install any malware or executables on my PC?

If I install Routersploit on my PC, would it install any malware or executable binaries as part of it to PC? Even though developers of Routersploit do not have any nefarious intention to add malware, ...
Ajay's user avatar
  • 41
2 votes
1 answer
377 views

Is running rsync as root problematic?

Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du? Background: I'm moving data from various systems ...
Fizz Khalifa's user avatar
2 votes
0 answers
165 views

Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?

I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all. Exploits like EternalBlue or BlueKeep wreaked havoc on ...
manatails's user avatar
2 votes
1 answer
681 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
Burst's user avatar
  • 23
2 votes
0 answers
153 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
microwth's user avatar
  • 2,473
2 votes
0 answers
233 views

Why can't you jump from SEH straight to payload for SEH buffer overflow?

From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH ...
Anderson's user avatar
  • 495
2 votes
0 answers
443 views

Binary exploitation

I am trying to upsolve a challenge from a CTF I played but I just can't get it right. I think you have to somehow manage to use buffer overflow, but I can't see what I'm doing wrong since this works ...
C. Cristi's user avatar
  • 121
2 votes
0 answers
201 views

Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
Shuzheng's user avatar
  • 1,247
2 votes
0 answers
392 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
John Doe's user avatar
2 votes
1 answer
3k views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
Rob Gates's user avatar
  • 259
2 votes
0 answers
362 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
bsdboy's user avatar
  • 51
2 votes
0 answers
147 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
Jim Baize's user avatar
2 votes
0 answers
934 views

Reverse_tcp exploit on VM with Windows XP

Well I'm doing learning to do pentest with Metasploit and i was using an exploit named "tugzip" that use a rever_tcp protocol so i actually installed Kali linux on my computer and used a virtual ...
Nelson Candia's user avatar
2 votes
0 answers
164 views

Could an attacker delete messages using an MMS exploit?

My SMS messages are getting deleted. What I noticed is, that some number keeps sending me MMS messages, mostly pictures. Yes, I had the "accept MMS automatically" turned on my Samsung device to ON. ...
balex's user avatar
  • 272
2 votes
0 answers
599 views

Vtable - finding the vtable pointer

// overflow here, so that size + chunk_size == 32 and size > 32 uint8_t *buffer = new uint8_t[size + chunk_size]; // buffer is allocated immediately before mDataSource if (size > 0) {...
dev's user avatar
  • 997
2 votes
0 answers
365 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
dev's user avatar
  • 997
2 votes
0 answers
279 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...
John's user avatar
  • 21
2 votes
0 answers
237 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
Saunders Eberly's user avatar
2 votes
0 answers
937 views

Windows 7 remote desktop access to utilman or stickykeys?

Is anyone aware of a windows 7 procedure where the attacker is able to access the host machine remotely via RDP on port 3389, and implement the utilman and/or stickykey exploit? afaik the utilman ...
Rahman's user avatar
  • 21
2 votes
0 answers
147 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
thatguylowjwj's user avatar
2 votes
0 answers
259 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
Juicy's user avatar
  • 1,447
2 votes
0 answers
210 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
Brian Allbee's user avatar
2 votes
0 answers
351 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] http:...
user avatar
2 votes
1 answer
639 views

How to avoid crash after successfully run shellcode?

I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
ruslan's user avatar
  • 21
2 votes
1 answer
488 views

What are the security implications of invalid free()?

CVE-2009-5030 OpenJPEG: Heap memory corruption leading to invalid free The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (...
voices's user avatar
  • 1,779
1 vote
0 answers
65 views

Information on the Exploitation and Automatability Data for Vulnerable components

Is there any tool providing information such as exploitability state (i.e., None, POC & Functional/Active) and automatability data for a specified vulnerable component name and version?
sad_semicolon's user avatar
1 vote
0 answers
102 views

How to properly pack address into bytes to overwrite EIP register

I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html I am very close to ...
Jay's user avatar
  • 111
1 vote
0 answers
92 views

How could the contents of multiple LastPass vaults be compromised?

According to this newly published article: Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies. ... Nick Bax, director of analytics at ...
End Antisemitic Hate's user avatar
1 vote
0 answers
278 views

XXE OOB File Content Extraction

Currently, I've discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk. So my file.dtd is: <!ENTITY % data SYSTEM &...
nicg's user avatar
  • 11
1 vote
0 answers
203 views

Why was CVE-2022-20411 (Bluetooth Remote Code Execution) not detected by Android's BoundSanitizer?

CVE-2022-20411 enabled remote code execution over Bluetooth on Android. It was fixed in December 2022. But why was it not detected by Android's BoundsSanitizer? Its purpose is to detect and prevent ...
Finni's user avatar
  • 111
1 vote
0 answers
841 views

Changing referer value in burp request has no impact on the response

I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response. The Referer contains the URL along with the unique ID of ...
Supraja's user avatar
  • 23
1 vote
2 answers
303 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients. While the image formats are ...
DividedByZero's user avatar
1 vote
0 answers
295 views

What equipment would an attacker need to infect a SIM card?

I'm aware that SIM cards can store malware according to this question but what equipment would be needed to do such an attack? For example, would you need a Computer and a SIM card reader or could it ...
verynormal's user avatar
1 vote
1 answer
373 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
Rick's user avatar
  • 138
1 vote
0 answers
525 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
K P's user avatar
  • 11