Hot answers tagged

28 votes
Accepted

Why are AMD processors not/less vulnerable to Meltdown and Spectre?

Only Meltdown is specifically an Intel vulnerability / design flaw. update: it seems AMD is mostly resilient to Spectre. It's not clear why that would be the case. But according to AMD: (from early ...
user avatar
26 votes
Accepted

Adding 65K buffer to protect from buffer overflows?

No. Most likely, you got that 64k limit from the Heartbleed bug, hovewer it is purely because in HTTPS Heartbeats the length field was 16 bits long. It doesn't mean that in your case your software ...
user avatar
  • 1,921
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
user avatar
  • 1,954
19 votes

Adding 65K buffer to protect from buffer overflows?

The best advise for avoiding buffer overflow bugs in C is to not use C in the first place. The design philosophy of the language was that whenever they had to choose between efficiency and safety, ...
user avatar
  • 48.8k
14 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
user avatar
  • 4,898
8 votes

Program exiting after executing int 0x80 instruction when running shellcode

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
user avatar
  • 81
8 votes
Accepted

Defeating ROP attacks in x86

No. Actually, most RoP attacks make use of existing codes (former return-into-libc-attacks). So, the RoP gadgets are snippets of existing code and have to be executable.
user avatar
  • 96
7 votes

Adding 65K buffer to protect from buffer overflows?

One of the known security approaches is to put a "canary" on the stack that would be damaged (modified) by the buffer overflow, if any would occur. It need not be so big, and it must be initialized ...
user avatar
  • 901
6 votes
Accepted

How to exploit variable's value

You are right that the buffer cannot overflow the flag because of the bounds check. Fgets also includes the null character in its bound check. http://www.cplusplus.com/reference/cstdio/fgets/ However,...
user avatar
6 votes

What is known about the capabilities of AMD's Secure Processor?

I was interested in the same issue and did some preliminary research. I'll try to answer some of the questions, though as a non-AMD engineer I cannot be certain. Does it have software-updatable ...
user avatar
  • 161
5 votes

What is known about the capabilities of AMD's Secure Processor?

So what I would say is anything that provides direct memory access and essentially does processing on behalf of the processor is a whole other set of threat surfaces you are introducing to the ...
user avatar
  • 2,787
5 votes
Accepted

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

First, this is not an OS question but more of a compiler one. OS can only execute binary programs that contain machine instructions and that can (if they were instructed to) test the overflow flag. ...
user avatar
4 votes
Accepted

Linux Kernel ROP - Returning to userland from kernel context?

I ended up writing my shellcode in a different way. As I could not figure out how to return, I let the kernel do the heavy lifting for me, in returning to userland. The idea was to execute my ...
user avatar
4 votes

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

why aren't operating systems using this overflow flag to stop integer overflows? The operating system can't just forbid integer overflows, because sometimes it's not a bug but a feature. There is ...
user avatar
  • 48.8k
4 votes

Buffer Overflow doesn't have enough space for exploit after being crashed

Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
user avatar
  • 9,227
4 votes
Accepted

What lies behind this complicated shellcode on linux?

If you have tried shellcode before which relies on absolute addresses, then that could explain the crashes. This shellcode survives because it uses call to obtain the absolute stack pointer address ...
user avatar
  • 5,898
4 votes
Accepted

Defeating code injection attacks in x86

Making the injected payload "not executable" is what Data Execution Prevention is about. There are various techniques to achieve that, depending on what the underlying hardware can do. On most ...
user avatar
  • 169k
3 votes
Accepted

Return oriented programming without int 0x80

int 0x80 is a really old way to make system calls. I'm not sure if it is even supported anymore. You might want to look for syscall/systenter instruction in the image. Ofcourse this depends on what ...
user avatar
  • 351
3 votes

Exploit a buffer overflow without SIGSEGV

Returning to normal execution from shellcode is hard. You're exactly right. Your function likely doesn't have a valid return address. I'm not entirely sure this is your problem, but your attempt ...
user avatar
  • 12.3k
2 votes

Are memcpy() based race conditions exploitable for causing remote code execution?

Based on what I see here, you can modify *src after ValidateOpcodesOrCrash finished checking that part of the memory but before SafeMemcpy starts. I don't know how ValidateOpcodesOrCrash is ...
user avatar
  • 31.1k
2 votes

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

TL;DR The reason why they're bad is listed in the links you've provided. Due to how the Windows OS is designed, the way the functions were coded, and the fact that determining if memory is valid is ...
user avatar
  • 12.3k
2 votes

How to exploit variable's value

flag is not local to any function and global in scope. Therefore, it is not located on the runtime stack. Either patch the binary or take advantage of the fact that input to buf is not sanitized and ...
user avatar
  • 1,269
2 votes
Accepted

Android x86 vs Android on Qemu ARM

Answer: Low-level vulnerabilities, such as buffer overflows in the stagefright binary or underlying Linux kernel, will behave differently on every system that you run them on (ie: x86 Android, QEMU ...
user avatar
2 votes

Do high level languages allow for buffer / heap overflow?

tl;dr: (most) high-level languages specifically protect you from that, but a very rare bug could make those protections fail. Long version: High-level languages are (generally) designed as not to ...
user avatar
  • 121
2 votes

Do high level languages allow for buffer / heap overflow?

The property you are looking for is called "memory safety", meaning that all memory access is well-typed and within bounds. Most high-level programming languages are specified to provide ...
user avatar
  • 1,449
1 vote

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

OS can't really check what the program is doing at the single add instruction level. This requires compiler to generate the conditional jump after every integer operation. That's a lot of additional ...
user avatar
1 vote

What lies behind this complicated shellcode on linux?

The Assembly that you've posted is not the shellcode, as you mentioned but rather the unpacking and execution of the shell script. The shellcode being executed is \xeb\x1f\x5b\x31\xc0\x88\x43\x0b\x88\...
user avatar
  • 9,227
1 vote
Accepted

Buffer Overflow doesn't have enough space for exploit after being crashed

There are various ways to do this. Are you able to get a fixed point in the code to set your EIP to? You are not telling us whether you have any ASLR restrictions, but if you do, are you then able to ...
user avatar
  • 617
1 vote
Accepted

C library functions in statically linked ELF32 binary no longer use int 0x80

int $0x80 is indeed executed by some of the C library functions in the statically linked binary, but not by nearly as many library functions as one would expect given how many library functions are ...
user avatar
  • 1,269

Only top scored, non community-wiki answers of a minimum length are eligible