21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
Mr. E's user avatar
  • 1,954
9 votes
Accepted

Why must a ret2libc attack follow the order "system(),exit(),command?

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
wireghoul's user avatar
  • 5,939
9 votes

KRACK: will there be an exploit soon?

The question is not whether there will be an exploit but what will be the range of upcoming exploits. This vulnerability receives so much attention precisely because of its impacts. Would it be a ...
WhiteWinterWolf's user avatar
9 votes
Accepted

How to exploit publicy known vunerable version of jquery?

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability. As with ...
Denis's user avatar
  • 3,808
9 votes

Is it necessary to understand Linux kernel internals to do binary exploitation?

Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
forest's user avatar
  • 66.5k
7 votes
Accepted

How does exploit development work for penetration testers?

The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against ...
void_in's user avatar
  • 5,591
7 votes
Accepted

Are all vulnerabilities exploitable?

By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken ...
Shritam Bhowmick's user avatar
6 votes
Accepted

Using (cat $file; cat) to run a simple BOF exploit

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
Steffen Ullrich's user avatar
6 votes

Can I do a String Format Exploit for x64 systems?

If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the ...
murphsghost's user avatar
5 votes
Accepted

How to exploit a Use-After-Free vulnerability?

There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other ...
Philipp's user avatar
  • 49.3k
5 votes
Accepted

Exploit does not work outside GDB

My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere. I did solve the challange and I used a simple trick to bypass this ...
akg's user avatar
  • 291
5 votes
Accepted

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

It ends up that the solution was using a partial address overwrite after all. Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 ...
Gbps's user avatar
  • 171
5 votes
Accepted

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know ...
forest's user avatar
  • 66.5k
4 votes
Accepted

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former ...
grepNstepN's user avatar
4 votes

Problems with overflowing the return address on stack x86_64

x86 SOLUTION ONLY: (see comments) If I got your task right, you have to overflow the function pointer for sayHello. Hence, the first task is to identify that functions address. nm test | grep ...
Zonk's user avatar
  • 508
4 votes
Accepted

Modifying shell code to bypass Windows Firewall

You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a ...
Jonathan Allon's user avatar
4 votes
Accepted

Are SEH exploits valid against Linux?

No. Structured Exception Handlers (SEH) are a Windows-only thing, so Linux cannot be exploited in the same way.
Peleus's user avatar
  • 3,857
4 votes
Accepted

How to find Use-After-Free vulnerabilities?

Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and ...
Rob W's user avatar
  • 2,113
4 votes

Are all vulnerabilities exploitable?

My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits: Somebody may have identified the issue in source code but been unable to reproduce it. ...
JonRB's user avatar
  • 393
4 votes
Accepted

Segmentation fault error when calling user defined function in shellcode

As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
Rahul Maini's user avatar
4 votes

EternalBlue exploit and ASLR

RoRaZ and 40F4 made some real good points. Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
kaiya's user avatar
  • 442
4 votes

How to bypass ASLR with ROP

I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on. The key part is here: Our aim now is to build a chained ROP to execute execve(). ...
Polynomial's user avatar
  • 135k
4 votes

Shellcode parameter passing

Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
sudhackar's user avatar
  • 248
4 votes
Accepted

return to libc- finding libc's address and finding offsets

First, before you can approach your problem, you need to check if the executable is running under ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization) If that's the case, you will ...
lightnet's user avatar
4 votes

Problem with overwriting the return address (buffer overflow)

It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice ...
user25972's user avatar
  • 153
4 votes

Bypassing ASLR using information leaks

Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
user25972's user avatar
  • 153
3 votes

How to find Use-After-Free vulnerabilities?

Your question is incorrect on many levels. First, JavaScript is memory managed language. That is, a developer never actually frees memory. Instead, the JavaScript interpreter manages all of that. So,...
Neil Smithline's user avatar
3 votes

Cost of finding vulnerabilities vs developing exploits

The relative costs depend very much on what the vulnerability is. To demonstrate this, I'm going to refer to two semi-recent vulnerabilities: the Bash "Shellshock" bug, and the glibc "Ghost" ...
Jander's user avatar
  • 1,001
3 votes

How does exploit development work for penetration testers?

You are asking how shellcode can defeat address space layout randomization but this isn't immediately clear from the way you worded your question. The art of "Return Oriented Programming" (ROP) has ...
mcgyver5's user avatar
  • 6,874
3 votes

Why strace isn't showing system call being made in shellcode?

I'm editing this answer to clean up the confusion about -e open. -e only does filtering and will not add extra info to the strace log. The only case when strace is not logging open syscalls is when a ...
Rápli András's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible