25 votes
Accepted

Hackable linux distributions

Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community. exploit-exercises.com provides a variety of virtual machines, documentation and challenges ...
user avatar
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
user avatar
  • 1,954
9 votes
Accepted

Why must a ret2libc attack follow the order "system(),exit(),command?

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
user avatar
  • 5,700
9 votes

KRACK: will there be an exploit soon?

The question is not whether there will be an exploit but what will be the range of upcoming exploits. This vulnerability receives so much attention precisely because of its impacts. Would it be a ...
user avatar
9 votes

Is it necessary to understand Linux kernel internals to do binary exploitation?

Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
user avatar
  • 63.8k
7 votes
Accepted

How does exploit development work for penetration testers?

The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against ...
user avatar
  • 5,521
7 votes
Accepted

Are all vulnerabilities exploitable?

By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken ...
user avatar
6 votes

Hackable linux distributions

You can check out Metasploitable 1 & 2 from Rapid7!
user avatar
  • 4,762
6 votes

Hackable linux distributions

If you are interested in hacking web apps, check out the OWASP Hackademic Challenges. That sounds somewhat tangential to your interest, but I figured I'd mention it just in case.
user avatar
  • 71.8k
6 votes

Can I do a String Format Exploit for x64 systems?

If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the ...
user avatar
5 votes
Accepted

How to exploit a Use-After-Free vulnerability?

There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other ...
user avatar
  • 48.8k
5 votes
Accepted

Exploit does not work outside GDB

My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere. I did solve the challange and I used a simple trick to bypass this ...
user avatar
  • 291
5 votes
Accepted

Using (cat $file; cat) to run a simple BOF exploit

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
user avatar
5 votes
Accepted

How to exploit binary with no syscall gadget or information leak in full ASLR and NX?

It ends up that the solution was using a partial address overwrite after all. Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 ...
user avatar
  • 171
5 votes
Accepted

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know ...
user avatar
  • 63.8k
4 votes

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

It is not possible to have a buffer overflow vulnerability in a managed memory environment such as Java, .Net, or Python provide. Since the runtime, not the developers manage memory allocations and ...
user avatar
  • 35.5k
4 votes

Problems with overflowing the return address on stack x86_64

x86 SOLUTION ONLY: (see comments) If I got your task right, you have to overflow the function pointer for sayHello. Hence, the first task is to identify that functions address. nm test | grep ...
user avatar
  • 448
4 votes
Accepted

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former ...
user avatar
4 votes
Accepted

How to find Use-After-Free vulnerabilities?

Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and ...
user avatar
  • 2,103
4 votes
Accepted

Modifying shell code to bypass Windows Firewall

You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a ...
user avatar
4 votes

Are all vulnerabilities exploitable?

My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits: Somebody may have identified the issue in source code but been unable to reproduce it. ...
user avatar
  • 393
4 votes
Accepted

Segmentation fault error when calling user defined function in shellcode

As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
user avatar
4 votes

EternalBlue exploit and ASLR

RoRaZ and 40F4 made some real good points. Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
user avatar
  • 422
4 votes

How to bypass ASLR with ROP

I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on. The key part is here: Our aim now is to build a chained ROP to execute execve(). ...
user avatar
  • 132k
4 votes

Shellcode parameter passing

Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
user avatar
  • 248
4 votes

Bypassing ASLR using information leaks

Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
user avatar
  • 143
3 votes
Accepted

The way vulnerabilities like CVE-2014-4148 are discovered

Fuzzing and reversing. Kernel mode vulnerabilities can be discovered by fuzzing the working code, and if any memory corruption occurs, you can try to reverse the app and, try to write suitable exploit ...
user avatar
  • 56
3 votes

Bypass Full ASLR+DEP exploit mitigation

The text segment which is also called the code segment, contains the application's static functionality is not randomized by ASLR. An exploit can jump anywhere into this region of memory reliably, ...
user avatar
  • 46.8k
3 votes
Accepted

msfvenom -b flag not working?

Seems like msfvenom is having a problem. I can reproduce it at my end. Will report this to the concerned people. In the mean while, you can use the combination of msfpayload and msfencode tools: ./...
user avatar
  • 5,521

Only top scored, non community-wiki answers of a minimum length are eligible