21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,954
9
votes
Accepted
Why must a ret2libc attack follow the order "system(),exit(),command?
The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
- 5,939
9
votes
KRACK: will there be an exploit soon?
The question is not whether there will be an exploit but what will be the range of upcoming exploits.
This vulnerability receives so much attention precisely because of its impacts.
Would it be a ...
- 19.2k
9
votes
Accepted
How to exploit publicy known vunerable version of jquery?
One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability.
As with ...
- 3,808
9
votes
Is it necessary to understand Linux kernel internals to do binary exploitation?
Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
- 66.5k
7
votes
Accepted
How does exploit development work for penetration testers?
The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against ...
- 5,591
7
votes
Accepted
Are all vulnerabilities exploitable?
By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken ...
- 1,602
6
votes
Accepted
Using (cat $file; cat) to run a simple BOF exploit
The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
- 198k
6
votes
Can I do a String Format Exploit for x64 systems?
If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the ...
- 91
5
votes
Accepted
How to exploit a Use-After-Free vulnerability?
There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other ...
- 49.3k
5
votes
Accepted
Exploit does not work outside GDB
My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere.
I did solve the challange and I used a simple trick to bypass this ...
- 291
5
votes
Accepted
How to exploit binary with no syscall gadget or information leak in full ASLR and NX?
It ends up that the solution was using a partial address overwrite after all.
Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 ...
- 171
5
votes
Accepted
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know ...
- 66.5k
4
votes
Accepted
Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?
I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former ...
- 610
4
votes
Problems with overflowing the return address on stack x86_64
x86 SOLUTION ONLY: (see comments)
If I got your task right, you have to overflow the function pointer for sayHello.
Hence, the first task is to identify that functions address.
nm test | grep ...
- 508
4
votes
Accepted
Modifying shell code to bypass Windows Firewall
You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a ...
- 721
4
votes
Accepted
Are SEH exploits valid against Linux?
No. Structured Exception Handlers (SEH) are a Windows-only thing, so Linux cannot be exploited in the same way.
- 3,857
4
votes
Accepted
How to find Use-After-Free vulnerabilities?
Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and ...
- 2,113
4
votes
Are all vulnerabilities exploitable?
My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits:
Somebody may have identified the issue in source code but been unable to reproduce it.
...
- 393
4
votes
Accepted
Segmentation fault error when calling user defined function in shellcode
As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
- 56
4
votes
EternalBlue exploit and ASLR
RoRaZ and 40F4 made some real good points.
Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
- 442
4
votes
How to bypass ASLR with ROP
I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on.
The key part is here:
Our aim now is to build a chained ROP to execute execve(). ...
- 135k
4
votes
Shellcode parameter passing
Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
- 248
4
votes
Accepted
return to libc- finding libc's address and finding offsets
First, before you can approach your problem, you need to check if the executable is running under ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization)
If that's the case, you will ...
- 66
4
votes
Problem with overwriting the return address (buffer overflow)
It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice ...
- 153
4
votes
Bypassing ASLR using information leaks
Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
- 153
3
votes
How to find Use-After-Free vulnerabilities?
Your question is incorrect on many levels.
First, JavaScript is memory managed language. That is, a developer never actually frees memory. Instead, the JavaScript interpreter manages all of that. So,...
- 14.8k
3
votes
Cost of finding vulnerabilities vs developing exploits
The relative costs depend very much on what the vulnerability is. To demonstrate this, I'm going to refer to two semi-recent vulnerabilities: the Bash "Shellshock" bug, and the glibc "Ghost" ...
- 1,001
3
votes
How does exploit development work for penetration testers?
You are asking how shellcode can defeat address space layout randomization but this isn't immediately clear from the way you worded your question.
The art of "Return Oriented Programming" (ROP) has ...
- 6,874
3
votes
Why strace isn't showing system call being made in shellcode?
I'm editing this answer to clean up the confusion about -e open. -e only does filtering and will not add extra info to the strace log. The only case when strace is not logging open syscalls is when a ...
- 2,154
Only top scored, non community-wiki answers of a minimum length are eligible