Questions tagged [stack-overflow]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
37 views

What can you do against fortify-source (stack overflow)?

I was practicing stack buffer exploitation on a well known application I was able to bypass canaries, ASLR and nx bit with techniques easily found on the internet However it has fortify-source enabled ...
2
votes
1answer
60 views

Is this paper on stack canaries outdated?

According to this paper on defeating stackguard, it seems canaries are placed lower in the stack (higher address) than EBP, allowing the attacker to overwrite EBP without being noticed. But when I ...
0
votes
0answers
60 views

IS there any way to deal with a null byte canary?

I am playing with a binary with a known vulnerability, a stack overflow. I have been able to find the random bytes of the canary, but unfortunately one of them is 00 so I can't write it since the ...
0
votes
0answers
54 views

How many canary values are there in a stack or buffer overflow?

Is there one value generated randomly at the start of the program and used in all the functions? One canary per function? One canary per function call, so it has to be generated each time a function ...
0
votes
0answers
56 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
0
votes
2answers
63 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
0
votes
0answers
90 views

Trouble understanding buffer overflow to print a string

I have the following program: #include<stdio.h> int main() { int i=0; foo(); printf("Hello there!"); func(); } int foo(void) { char str[14]; strncpy(str,&...
0
votes
0answers
40 views

What do you put in the overwritten return adress in stack buffer over?

I understand the idea, but let's assume I have properly overflown buff. Now i now that buff is 10 bytes long and since it is the 5th local variables, my shellchode would be at esp + (size of the 4 ...
1
vote
0answers
71 views

Question on stack overflow

I am preparing for an exam in Computer Security and doing a past-exam without soluions, so I wanted to check if my reasoning holds on a question about stack overflow. Below is the C code in question. ...
0
votes
1answer
465 views

Can you perform a buffer overflow and a format string attack at the same time?

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h&...
1
vote
1answer
292 views

Why does my compiler warn me about gets but not about scanf?

If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used: <source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations] ...
3
votes
1answer
116 views

Having trouble with learning Buffer Overflows

So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one ...
0
votes
1answer
87 views

Is it possible to use ROP to call legitimate functions even if the stack is not executable?

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment. For ...
0
votes
0answers
51 views

Where does the SP (Stack Pointer) point to when the buffer is overflown?

Let's consider a stack that grows downwards and a function that has a local variable for a buffer that takes 100 bytes of memory. So, reading from top to bottom, it would be a 4-byte long return ...
0
votes
0answers
166 views

Problem with return 2 libc in 64 bit arch

I want to perform return to libc in 64 bit architecture using execve. I found a gadget with /bin/sh in it (the /bin/sh offset is 18a143): cbcd8: 00 00 cbcda: 4c 89 ea ...
0
votes
1answer
156 views

BufferOverFlow - How come ESP points to the end of the payload

I just don't understand how ESP points to the shellcode let's say we've sent this string string = 100 * 'A' + 'BBBB' + 'CCCC' I have filled the stack with 'AAAA..' and overwritten the EIP value and ...
0
votes
1answer
67 views

Automatically insertion of 00 in EIP in Stack Overflow 64bit

I am trying to overflow a stack in C sample code to execute uncalled function in code. The problem is when i overflow stack by entering a(24 times), $EIP is 0x555555550061. I want it to be ...
1
vote
1answer
153 views

Return address incorrect (buffer overflow)

I'm trying to exploit the following code with a buffer overflow to get a shell: int main() { char str[64] gets(str); return(0); } The platform is Ubuntu 64 bit, arch i686. The program is ...
0
votes
1answer
443 views

Buffer overflow Mona modules all show Rebase SafeSEH ASLR True

Almost every beginners (noob friendly) tutorial written for Stack based buffer overflow explains when using mona module to locate a safe reliable memory address for our EIP to JMP to our shellcode ...
1
vote
1answer
341 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1
vote
1answer
548 views

Cannot execute shellcode using buffer overflow

As a home exercise I'm trying to achieve buffer overflow attack by running a simple char array program that stores the input argument in the program stack and then overflowing that stack with long ...
0
votes
1answer
335 views

EIP pointing to shellcode but shellcode is not executing?

I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o ...
0
votes
3answers
852 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
45
votes
3answers
9k views

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Since buffer overflows always let an evil hacker write outside the buffer and overwrite the return pointer to a shellcode the evil hacker can place, does it mean that successful exploitation of a ...
1
vote
3answers
170 views

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but ...
0
votes
1answer
240 views

ret2libc calling function arguments order

While I was studying ret2libc, I saw that tutorials use: call_to_function + ret addr + arguments For example I understand that if I want to execute system function from libc I can use the following ...
4
votes
1answer
195 views

How are stack canaries padded by unmapped pages?

I was reading the wikipedia article on this subject and it states that when a program starts, the canary is calculated at random, stored in a local variable(which I presume was introduced by the ...
1
vote
2answers
303 views

In Return-Oriented Programming how can the machine execute unaligned instructions?

I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)". The author claims that x86 code is like English written without punctuation or spaces, ...
2
votes
1answer
1k views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
1
vote
1answer
405 views

What is Return-Oriented Programming? [closed]

With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
1
vote
0answers
103 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
2
votes
2answers
2k views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
3
votes
1answer
165 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
4
votes
2answers
3k views

How does gcc compiler guard stack for stack overflow?

When we compile c program with gcc, we have to inlude "-z execstack" option to enable stack overflow attack. The question I want to ask is how does gcc implement this . Without this option, how does ...
4
votes
2answers
2k views

Why do we need to remove null bytes from shell code?

I'm studying the basics of making shell codes. I have a question about it. In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
1
vote
2answers
782 views

Buffer Overflow Stack Attack Exercise Help

So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
2
votes
1answer
913 views

How do I bypass a return address overwrite not doing anything?

This is main: (gdb) disass main Dump of assembler code for function main: 0x000000000040057c <+0>: push rbp 0x000000000040057d <+1>: mov rbp,rsp 0x0000000000400580 <+4&...
2
votes
2answers
963 views

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

General Background: I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such: // .... including the corresponding libraries depending ...
2
votes
1answer
113 views

Understanding a crash

Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash. My normal steps are: load application into a debugger ...
1
vote
1answer
841 views

Why do registers get overwritten upon overflow?

I know that upon a overflow, the stack gets partially overwritten, but I do not understand why registers such as EIP or RIP get changed in this process. How come some registers are modified by such ...
2
votes
1answer
2k views

Stackpivoting techniques

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that. The question is, during the writing ...
1
vote
1answer
2k views

Bufferoverflow - jmp esp. Do I need nops sled? Does call esp also work?

I'm learning about stack buffer overflow and I'd appreciate help. I'm exploiting simple web server containing this log function. Argument s1 is the input that I supply via HTTP. Server is running on ...
2
votes
2answers
155 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
0
votes
3answers
4k views

Some vulnerable projects in C or C++ for a lecture? [closed]

I'm looking for some real projects which have stack overflow vulnerabilities. The important thing is, I am going to teach finding the vulnerabilities and the way of fixing them by these examples. So, ...
3
votes
2answers
795 views

Hard-wired vs relative addresses in shellcode

This question is primarily in the context of arbitrary command execution in a buffer (e.g. stack) overflow. I read somewhere recently that hard-wired (absolute) addresses are not good for shellcode e....
7
votes
0answers
225 views

Using instruction set architecture (ISA) to stop stack overflows

I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our ...
10
votes
2answers
19k views

How is the stack protection enforced in a binary?

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. How is this encoded into the binary? (Can I see this info using readelf? ). Is it encoded into every page/...
5
votes
1answer
4k views

Exploit does not work outside GDB

I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
39
votes
3answers
12k views

How big is a canary word on Linux, typically?

A canary word is a sequence of bits placed at the boundary between a buffer (such as a stack) and control data in a program, as a way of detecting and reacting to buffer overflows. How many bits long ...
1
vote
1answer
143 views

Restoring the stack frame after payload is executed

Is it possible to restore the stack frame so that the EIP returns to the place that is was at(before the overflow) after a payload has been executed? If a stack frame is overflowed and the payload ...