Skip to main content
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
Mr. E's user avatar
  • 1,964
10 votes
Accepted

How to exploit publicy known vunerable version of jquery?

One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability. As with ...
Denis's user avatar
  • 3,848
9 votes
Accepted

Why must a ret2libc attack follow the order "system(),exit(),command?

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
wireghoul's user avatar
  • 5,969
9 votes

KRACK: will there be an exploit soon?

The question is not whether there will be an exploit but what will be the range of upcoming exploits. This vulnerability receives so much attention precisely because of its impacts. Would it be a ...
WhiteWinterWolf's user avatar
9 votes

Is it necessary to understand Linux kernel internals to do binary exploitation?

Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
forest's user avatar
  • 67k
7 votes
Accepted

Are all vulnerabilities exploitable?

By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken ...
Shritam Bhowmick's user avatar
6 votes
Accepted

Using (cat $file; cat) to run a simple BOF exploit

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
Steffen Ullrich's user avatar
6 votes

Can I do a String Format Exploit for x64 systems?

If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the ...
murphsghost's user avatar
5 votes
Accepted

Exploit does not work outside GDB

My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere. I did solve the challange and I used a simple trick to bypass this ...
akg's user avatar
  • 291
5 votes
Accepted

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

It ends up that the solution was using a partial address overwrite after all. Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 ...
Gbps's user avatar
  • 181
5 votes
Accepted

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know ...
forest's user avatar
  • 67k
4 votes
Accepted

Modifying shell code to bypass Windows Firewall

You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a ...
Jonathan Allon's user avatar
4 votes
Accepted

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former ...
grepNstepN's user avatar
4 votes

Are all vulnerabilities exploitable?

My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits: Somebody may have identified the issue in source code but been unable to reproduce it. ...
JonRB's user avatar
  • 403
4 votes
Accepted

Segmentation fault error when calling user defined function in shellcode

As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
Rahul Maini's user avatar
4 votes

EternalBlue exploit and ASLR

RoRaZ and 40F4 made some real good points. Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
kaiya's user avatar
  • 452
4 votes

How to bypass ASLR with ROP

I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on. The key part is here: Our aim now is to build a chained ROP to execute execve(). ...
Polynomial's user avatar
  • 135k
4 votes

Shellcode parameter passing

Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
sudhackar's user avatar
  • 248
4 votes
Accepted

return to libc- finding libc's address and finding offsets

First, before you can approach your problem, you need to check if the executable is running under ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization) If that's the case, you will ...
lightnet's user avatar
4 votes

Problem with overwriting the return address (buffer overflow)

It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice ...
user25972's user avatar
  • 153
4 votes

Bypassing ASLR using information leaks

Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
user25972's user avatar
  • 153
3 votes
Accepted

Why strace isn't showing system call being made in shellcode?

I got the solution. Actually by mistake I compiled the shellcode testing program as 64bit executable and that's why the shellcode was being executed as 64bit and in 64bit mode the syscall no 5 is for "...
Rakesh Mane's user avatar
3 votes

Why strace isn't showing system call being made in shellcode?

I'm editing this answer to clean up the confusion about -e open. -e only does filtering and will not add extra info to the strace log. The only case when strace is not logging open syscalls is when a ...
Rápli András's user avatar
3 votes

EternalBlue exploit and ASLR

From the Risk Sense PDF (opens a PDF): 3.6.2 DEP Bypass Starting sometime in Microsoft Windows 8/8.1 (Server 2012), the HAL Heap became non-executable. A virtual memory Page Table Entry (PTE) ...
RoraΖ's user avatar
  • 12.5k
3 votes
Accepted

EternalBlue exploit and ASLR

From RiskSense P.19: The ASLR bypass of the original EternalBlue exploit exploits the weakness that the HAL Heap (used by the Hardware Abstraction Layer) was static located at 0xffffffffffd00000 ...
40F4's user avatar
  • 922
3 votes

return to libc- finding libc's address and finding offsets

Here are two methods: 1. strings -t x -a /path/to/libc | grep "/bin/sh"--> this outputs the offset of the string in libc. 2. with pwntools: first define the libc with libc=ELF('/path/to/libc') ...
Arav Garg's user avatar
3 votes
Accepted

x32 VS x64 Reverse Engineering and Exploit Development

There are millions of 32-bit systems still in use today, and the 64-bit systems all use "thunking" to run 32-bit programs. Lots (most) of the apps out there are still released today only as 32-bit ...
John Deters's user avatar
  • 34.3k
3 votes

x32 VS x64 Reverse Engineering and Exploit Development

Architecture and Register (R*X) Differences Over time, many 64-bit architectures have been introduced. The first to be supported by Windows, Itanium, was designed for performance computing and was ...
atdre's user avatar
  • 19.1k
3 votes
Accepted

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9

If you have a look in x86/include/asm/uaccess.h you will see that there is a size check copy_from_user(). Normally you would want this to be detected, but as you are doing a deliberate buffer overflow ...
LarsH's user avatar
  • 46
3 votes
Accepted

Meltdown - Reading Process Memory Data

On Linux, the kernel half of the address space (all addresses above 0x8000000000000000) is constant across applications. If you use grep to find the address of the system call table, that address ...
Mark's user avatar
  • 34.7k

Only top scored, non community-wiki answers of a minimum length are eligible