25
votes
Accepted
Hackable linux distributions
Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community.
exploit-exercises.com provides a variety of virtual machines, documentation and challenges ...
- 9,797
21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,954
9
votes
Accepted
Why must a ret2libc attack follow the order "system(),exit(),command?
The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
- 5,700
9
votes
KRACK: will there be an exploit soon?
The question is not whether there will be an exploit but what will be the range of upcoming exploits.
This vulnerability receives so much attention precisely because of its impacts.
Would it be a ...
- 19k
9
votes
Is it necessary to understand Linux kernel internals to do binary exploitation?
Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
- 63.8k
7
votes
Accepted
How does exploit development work for penetration testers?
The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against ...
- 5,521
7
votes
Accepted
Are all vulnerabilities exploitable?
By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken ...
- 1,602
6
votes
6
votes
Hackable linux distributions
If you are interested in hacking web apps, check out the OWASP Hackademic Challenges. That sounds somewhat tangential to your interest, but I figured I'd mention it just in case.
- 71.8k
6
votes
Can I do a String Format Exploit for x64 systems?
If you're using the example code from the book (below), at some point you should reach the "AAAAAAAA" pattern (0x41). Note that, since you're running it on a 64-bit machine that stores elements in the ...
- 91
5
votes
Accepted
How to exploit a Use-After-Free vulnerability?
There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other ...
- 48.8k
5
votes
Accepted
Exploit does not work outside GDB
My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere.
I did solve the challange and I used a simple trick to bypass this ...
- 291
5
votes
Accepted
Using (cat $file; cat) to run a simple BOF exploit
The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
- 181k
5
votes
Accepted
How to exploit binary with no syscall gadget or information leak in full ASLR and NX?
It ends up that the solution was using a partial address overwrite after all.
Using the address to read in the GOT, a two-byte partial address overwrite can be done to jump within a guarantee of 8192 ...
- 171
5
votes
Accepted
How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?
There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know ...
- 63.8k
4
votes
Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)
It is not possible to have a buffer overflow vulnerability in a managed memory environment such as Java, .Net, or Python provide. Since the runtime, not the developers manage memory allocations and ...
- 35.5k
4
votes
Problems with overflowing the return address on stack x86_64
x86 SOLUTION ONLY: (see comments)
If I got your task right, you have to overflow the function pointer for sayHello.
Hence, the first task is to identify that functions address.
nm test | grep ...
- 448
4
votes
Accepted
Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?
I understand where you're coming from, I fuzz various products (chrome, flash, among some other things). The last thing you want to do is give away a possible bounty or advisory (I support the former ...
- 610
4
votes
Accepted
How to find Use-After-Free vulnerabilities?
Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and ...
- 2,103
4
votes
Accepted
Modifying shell code to bypass Windows Firewall
You are mistaken in your approach entirely, since you are exploiting IE which is a lower privileged process by default you will not be able to disable the firewall. furthermore when attacking with a ...
- 701
4
votes
Are all vulnerabilities exploitable?
My understanding is that there are a few possibilities for why some vulnerabilities do not have exploits:
Somebody may have identified the issue in source code but been unable to reproduce it.
...
- 393
4
votes
Accepted
Segmentation fault error when calling user defined function in shellcode
As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
- 56
4
votes
EternalBlue exploit and ASLR
RoRaZ and 40F4 made some real good points.
Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
- 422
4
votes
How to bypass ASLR with ROP
I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on.
The key part is here:
Our aim now is to build a chained ROP to execute execve(). ...
- 132k
4
votes
Shellcode parameter passing
Not every character in your payload can be sent through the argv of your binary. There are some "bad characters" which you can't have in your shellcode. An example is "\x00" as you're using strcpy to ...
- 248
4
votes
Bypassing ASLR using information leaks
Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
- 143
3
votes
Accepted
The way vulnerabilities like CVE-2014-4148 are discovered
Fuzzing and reversing. Kernel mode vulnerabilities can be discovered by fuzzing the working code, and if any memory corruption occurs, you can try to reverse the app and, try to write suitable exploit ...
- 56
3
votes
Bypass Full ASLR+DEP exploit mitigation
The text segment which is also called the code segment, contains the application's static functionality is not randomized by ASLR. An exploit can jump anywhere into this region of memory reliably, ...
- 46.8k
3
votes
Accepted
msfvenom -b flag not working?
Seems like msfvenom is having a problem. I can reproduce it at my end. Will report this to the concerned people. In the mean while, you can use the combination of msfpayload and msfencode tools:
./...
- 5,521
Only top scored, non community-wiki answers of a minimum length are eligible