22
Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community.
exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, ...
20
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[----------------------------------registers-----------------------------------]
EAX: 0x5655700b --> 0xde3050f7
EBX: 0x5655550c (<main+35>: mov eax,0x0)
...
9
The question is not whether there will be an exploit but what will be the range of upcoming exploits.
This vulnerability receives so much attention precisely because of its impacts.
Would it be a theoretical weakness reserved to potential state agency or a thing easily fixable as part of automatic update processes, nearly no one would have ever heard of it ...
9
Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, how syscalls work, and how Linux manages process-specific attributes that can be relevant to exploitation. A solid understanding of Linux is very useful, but ...
7
The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames in great detail: https://en.wikipedia.org/wiki/Call_stack#Stack_and_frame_pointers
The stack frame dictates the order the function call and parameters are ...
6
You can check out Metasploitable 1 & 2 from Rapid7!
6
If you are interested in hacking web apps, check out the OWASP Hackademic Challenges. That sounds somewhat tangential to your interest, but I figured I'd mention it just in case.
6
The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against memory corruption exploits. Read the excellent answers at How Do DEP and ASLR Works. However, when buffer overflow exploits are created which targets anything ...
5
By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken advantage of using ex-filtration mechanisms - the primary reason to this could be two:
Extract data which is highly sensitive
Elevate furthermore privileges on ...
5
If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the stack with 8 bytes each, you should run it with $ ./fmtstr "AAAAAAAA %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x %016x" instead, or ...
4
There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other data. However, even after a C program has officially deallocated a block of memory, it can still read from it and write to it. If this happens it is ...
4
Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and run JavaScript/HTML.
This is how you find UAF vulnerabilities:
Provide an input that causes the application to crash or misbehave. E.g. by fuzzing or an ...
4
You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a client side exploit you can make no assumptions about network configurations, there might be more than one firewall between the host and you, a NAT might block ...
4
My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits:
Somebody may have identified the issue in source code but been unable to reproduce it.
Vulnerabilities are discovered for particular implementations/circumstances and thus a general-purpose exploit may not yet exist.
The exploits may exist but might not ...
4
It ends up that the solution was using a partial address overwrite after all.
Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 bytes from read into libc, with a 1/16th brute-force chance to jump within 65535 bytes (due to 4 byte entropy of ASLR).
Within the two-byte overwrite, there ...
4
As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, and not a function address.
When func() is called after typecasing("stuff") into a function pointer as you wrote
void (*func)() = (void (*)())stuff;
func();
...
4
There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know of is the commercial version of PaX RAP). Most CFI is coarse-grained, which means that a function can return not to only that one function, but to a number of ...
3
I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former more than the latter, especially considering what happened to Aaron Schwartz).
Think about it: in this case apngdis can yield a possible parser or file format ...
3
I don't think that the code you are marking is the one achieving to exploit the bug:
s.send(struct.pack('>I',len(buff) ))
What this line is doing is sending the length of the buffer he is going to send right behind in the proper endiannes (Big Endian or network endiannes).
I believe that the exploit itself will have to do with the lengths of the "buff" ...
3
Fuzzing and reversing. Kernel mode vulnerabilities can be discovered by fuzzing the working code, and if any memory corruption occurs, you can try to reverse the app and, try to write suitable exploit for it. But it is illegal, you must know it :)
3
x86 SOLUTION ONLY: (see comments)
If I got your task right, you have to overflow the function pointer for sayHello.
Hence, the first task is to identify that functions address.
nm test | grep sayHello
In my case this was the result
0804844b T sayHello
So I have to overwrite the return address (RET) of getInput() with 0x0804844b. Now you can either ...
3
The text segment which is also called the code segment, contains the application's static functionality is not randomized by ASLR. An exploit can jump anywhere into this region of memory reliably, which permits an attacker to build a chain of ROP gadgets. The most common goal of a ROP chain is to setup a stable environment to run shell code, but that is ...
3
It is not possible to have a buffer overflow vulnerability in a managed memory environment such as Java, .Net, or Python provide. Since the runtime, not the developers manage memory allocations and deallocations, this class of vulnerability is non-existent.
That said, there are vulnerabilities in these environments, but the JVM (or equivalent) is ...
3
Seems like msfvenom is having a problem. I can reproduce it at my end. Will report this to the concerned people. In the mean while, you can use the combination of msfpayload and msfencode tools:
./msfpayload windows/shell/bind_tcp R | ./msfencode -e x86/shikata_ga_nai -c 3 -b '\x00\x0a\x0d\x40' t python
Update: The problem was resolved in the commit here. ...
3
No. Structured Exception Handlers (SEH) are a Windows-only thing, so Linux cannot be exploited in the same way.
3
The relative costs depend very much on what the vulnerability is. To demonstrate this, I'm going to refer to two semi-recent vulnerabilities: the Bash "Shellshock" bug, and the glibc "Ghost" gethostbyname() bug.
Shellshock
The Shellshock bug was caused by an intricate flaw in Bash's function parsing that could be used to make Bash execute code directly ...
3
The strcmp call and what leads to it is correct. Your second hunch, to somewhat suppress the signal, is the right one.
signal(SIGABRT, SIG_DFL);
…
raise(SIGABRT);
The call to raise raises a signal whose default action is to kill the program. The prior call to signal ensures that the default action is taken. When a process signals itself, this is ...
3
I'm editing this answer to clean up the confusion about -e open. -e only does filtering and will not add extra info to the strace log. The only case when strace is not logging open syscalls is when a forked subprocess is invoking them and the -f parameter is not set, which is not relevant in your case.
3
I got the solution. Actually by mistake I compiled the shellcode testing program as 64bit executable and that's why the shellcode was being executed as 64bit and in 64bit mode the syscall no 5 is for "fstat" and that's what strace tool was showing.
Only top voted, non community-wiki answers of a minimum length are eligible
