All Questions
Tagged with shellcode buffer-overflow
55 questions
0
votes
0
answers
110
views
bin/sh in return-to-libc attacks
Return-to-libc is an attack where the attacker, in most cases, returns to the system function, which it uses to execute shell commands. However, I am confused about two things:
The command that the ...
- 1
0
votes
0
answers
148
views
push /bin/sh to get a shell
I usually use a different method to push /bin/sh in rdi to get a shell, but I wanted to try this one :
Put in case that I can control the RIP and there are no limitations or filters. So I can execute ...
- 1
1
vote
0
answers
156
views
How to properly pack address into bytes to overwrite EIP register
I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html
I am very close to ...
- 111
0
votes
1
answer
668
views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
1
vote
1
answer
493
views
Buffer overflow stops executing shellcode in the middle of it
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:...
- 121
0
votes
2
answers
884
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 211
0
votes
0
answers
620
views
Shell does not execute after buffer overflow
I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
- 1
4
votes
2
answers
309
views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
- 2,052
2
votes
1
answer
2k
views
BufferOverflow ESP too small for shellcode
I want to write an exploit for a test application that provides only 12 bytes of space at the ESP. I'm not able to place shellcode in such a small space. I have no clue what I can do to solve this.
I ...
- 21
2
votes
1
answer
721
views
Exploit education stack-five: trouble opening shell
Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
- 23
0
votes
0
answers
151
views
Pwnable: Process has its own home directory
I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection.
However, after the shell is spawned, the flag is read from /...
- 1
0
votes
2
answers
1k
views
Find Buffer Overflows at a target you want to gain access
I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows.
In the example in the videos, the guy has ...
- 123
0
votes
1
answer
2k
views
In Buffer overflow exploitation what if JMP ESP address contains bad characters?
I was writing an exploit for BOF. The server accepts only ASCII payloads. FInally I wnted to jump to my shellcode which is clearly in the stack. But only one module is available without ASLR and DEP ...
- 133
1
vote
3
answers
264
views
Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?
I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
- 113
4
votes
2
answers
5k
views
Why is a shell not spawning after a buffer overflow exploit?
I started learning about stack-smashing after it came up during a CTF exercise. I have been practicing on an ELF 32-bit executable that I received for the CTF.
After disassembling the binary file, I ...
- 143
2
votes
1
answer
2k
views
Should the shellcode be "reversed" before beeing injected in a simple buffer overflow?
I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts.
My goal is to spawn a shell, so I found the asm code to do an execve("/...
- 135
1
vote
2
answers
432
views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
- 713
2
votes
0
answers
274
views
Shellcode different on guide
I followed a guide to do narnia2 of overthewire and the shellcode generated by them was:
h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80
...
- 123
4
votes
1
answer
2k
views
Where in a binary can '/bin/sh' be written to get a shell?
I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it.
The CTF challenge was the can-you-gets-me challenge in ...
- 143
1
vote
0
answers
2k
views
Segmentation fault in exercise program
I am going through this video on buffer overflows but am having some trouble replicating the demo. The issue is that I am getting a segmentation fault when I expect to get a shell at the end.
The idea ...
- 147
1
vote
1
answer
149
views
Buffer Overflow shell question
If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked ...
- 1,900
4
votes
1
answer
2k
views
Not able to run the injected shellcode
#include <stdio.h>
void secret()
{
printf("Congratulations!\n");
}
void echo()
{
char array[60];
scanf("%s", array);
printf("You entered: %s\n", array);
}
int main()
{
...
1
vote
0
answers
608
views
Buffer overflow experiment: shell code executed but got "failed to read 0 bytes" error
I've doing a buffer overflow experiment on a Ubuntu 16.04 VM (Linux ubuntu 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux) and got a puzzling ...
- 145
0
votes
2
answers
2k
views
Buffer Overflow : segmentation error at 0x90909090
why am i getting a segmentation fault at a NOP sled isnt it supposed to sled the instructions till it gets to the shell code ?
0xbffff030: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff040: ...
1
vote
2
answers
3k
views
Shellcode does not execute as the owner
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia)
Here is the source code of the vulnerable script "narnia1" I intend to exploit:
#include <stdio.h>
int ...
- 11
7
votes
1
answer
2k
views
Why would legitimate programs have a `jmp esp` instruction?
It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the ...
- 251
4
votes
1
answer
683
views
Can change flow of the program yet can't execute shellcode
I've created a small vulnerable C program, which normally won't call function overflowed.
void overflowed(){
printf("%s\n","Hijacked");
}
void normally(char * st){
char buffer[80];
...
2
votes
1
answer
3k
views
Buffer Overflow memory address calculation on 64bit
I have a assignment where i must exploit a buffer overflow vulnerability on a remote machine. I have only execute permission on the program, so i cant use gdb. I managed to take control of the rip and ...
- 151
3
votes
2
answers
1k
views
Hard-wired vs relative addresses in shellcode
This question is primarily in the context of arbitrary command execution in a buffer (e.g. stack) overflow.
I read somewhere recently that hard-wired (absolute) addresses are not good for shellcode e....
- 53
2
votes
1
answer
2k
views
Why is fnstenv giving me a NULL address in my shellcode on Windows XP?
I am going through an introductory tutorial on writing exploits, which can be found here. The tutorial goes over a simple stack based buffer overflow vulnerability in the Easy RM to MP3 Conversion ...
- 235
3
votes
1
answer
1k
views
Buffer overflow to server
I have a server, for reference: pastebin/ghJX69uH, that I can netcat to and it will ask to input a msg.
I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to run. I ...
- 773
2
votes
0
answers
641
views
Stack overflow return addr
I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy() to fill a 200 char buffer, without checking boundaries, and compiled with -z execstack and -fno-stack-...
- 89
1
vote
2
answers
2k
views
Shellcode doesn't execute despite correct address on EIP
I need to produce a presentation on buffer overflows for a college class. I managed to create a simple buffer overflow where i inject the address of a specific function on the EIP and the function ...
- 111
1
vote
1
answer
807
views
Is it possible to run shell code from programming language A in a script that is programmed in language B? [closed]
I am sorry about the confusing title, but what I'm asking is this: Could you run shell code from C (or any other programming language) in a buffer overflow script that is programmed in Java (or any ...
- 11
3
votes
2
answers
5k
views
Buffer overflow - Print "hello world"
I'm wondering what the shellcode would be to simply print "hello world" to the console. When testing for vulnerabilities, I think it would be very useful to have shellcode to test if the exploit works....
- 278
2
votes
1
answer
769
views
Interactive shell not opening
I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell.
When I type ...
4
votes
3
answers
5k
views
Install a vulnerable service for Windows 7
I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell.
I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
- 699
4
votes
0
answers
815
views
C program - exploit program (after seg fault)
The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary
As part of learning security - I am trying to buffer overflow this program. I ...
- 49
2
votes
1
answer
481
views
Is my understanding of buffer overflows correct?
I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
6
votes
1
answer
10k
views
Removing null bytes from shell code
I am learning the basics of shell coding so that I can learn to exploit buffer overflows. The problem is, the example byte code that I wrote contains null bytes. Here is the example:
xor %edi,%...
- 325
1
vote
0
answers
338
views
Buffer overflow and register contents?
I am doing an exam practice question, suppose I have a function like;
void func(char* arg)
{
char buf[32];
strcpy(buf, arg);
}
command break func:
-buf begins at 0xbffebfb0
-(gdb) x/2wx $...
- 145
0
votes
0
answers
105
views
unable to execute shellcode,which is place on stack [duplicate]
I am trying to execute the shellcode to spawn an "sh" shell.
I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
- 191
2
votes
1
answer
770
views
Execute form environmental variable while stack is not executable
Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG;
I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
- 21
4
votes
3
answers
10k
views
Program exiting after executing int 0x80 instruction when running shellcode
In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
- 153
2
votes
1
answer
357
views
Are stack buffer overflows even possible in this instance?
Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
- 21
11
votes
2
answers
16k
views
NX bit: does it protect the stack?
I once heard the NX bit was a panacea, then that it was not.
One detail I've wondered about though:
Does the NX (no execute) bit protect against code inserted into the stack and executed there?
It ...
- 153
2
votes
1
answer
5k
views
Starting a new shell in a strcpy exploit using buffer overflow
I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from:
#include <string.h>
void myfunction(char *arg);
int main(int argc, char **argv)
{
...
- 21
3
votes
1
answer
11k
views
Stack buffer overflow confusion
I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique.
Reading some articles and watching videos brought me to a confusion which can be ...
- 1,560
8
votes
3
answers
2k
views
Buffer overflow stack adjustment
I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. The shellcode was not executed until it was padded with NOPs although it's set properly in ...
- 751
4
votes
3
answers
2k
views
Is writing shellcode still a valid skill to have/learn?
Following up from this question: Should I bother teaching buffer overflows any more?
I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
