1,541 questions
2
votes
1
answer
249
views
Forcing a C program to take a forged epilogue made with inline-assembly to jump to arbitrary function
This comes from a post about invoking a trivial buffer overflow (to jump to a function present in the source but not called explicitly in any place of the program (2333909/how-can-i-invoke-buffer-...
- 423
1
vote
0
answers
28
views
STM32F407 integration with SEGGER SYS VIEW Fails for LED blinking
I am trying to run FreeRTOS on my stm32f407 discovery board. I am using segger system view continuous recording via j-link. The problem I am facing is that when I run this code:
status = xTaskCreate(...
- 11
4
votes
1
answer
202
views
How can I exploit Buffer Overflow on x86-64 Linux?
I made a simple vulnerable program greet.c:
#include <stdio.h>
#include <string.h>
int main (int argc, char **argv) {
char buf[32];
strcpy(buf, argv[1]);
printf("%s\n"...
- 65
4
votes
1
answer
172
views
How to use buffer overflow to modify function pointer value?
I am currently trying to make a code more safe for a cybersecurity exercise. I was asked to make the flag contained in the secret_function() come out. The problem is that I can't modify the code and ...
- 119
0
votes
0
answers
115
views
Reference Error when exploiting buffer overflow
In the code below when I try to overwrite the stack by exploiting the buffer overflow in the line below.
memcpy(&local_1d,*(void **)local_10[1],(ulong)*(uint *)(local_10[1] + 8));
I also ...
- 17
0
votes
1
answer
110
views
Understanding buffer overflow output, when accessing the hidden function
Sorry if this is the wrong format. Im currently doing a CTF and have a problem where i have to overflow a buffer, to get access to a /bin/sh hidden function, where i then can get a flag.
I think i ...
- 41
1
vote
2
answers
89
views
Is this actually a buffer overflow, or is the author mistaken?
I came across this page here when looking for buffer overflow examples:
https://learn.microsoft.com/en-us/cpp/sanitizers/error-heap-buffer-overflow?view=msvc-170
In this, they mention this code as an ...
- 31
2
votes
1
answer
291
views
Buffer Overflow Exploit - Injecting Code & Redirecting Execution in Attack Lab (x86-64, GDB Debugging)
Here's a revised and well-structured Stack Overflow post incorporating all necessary improvements:
Buffer Overflow Exploit (x86-64, Attack Lab Phase 2) - Injecting Shellcode for Function Call
...
- 139
0
votes
0
answers
25
views
How to buffer overflow this
\`#include \<iostream\>
#include \<cstring\>
void secretFunction() {
std::cout \<\< " Exploit Successful! You've gained control! " \<\< std::endl;
}
void ...
2
votes
0
answers
171
views
Why is code vulnerable to buffer overflow? [closed]
Veracode reported:
This call to ReadFile() contains a potential buffer overflow. The specified size of 92 bytes is larger than the space allocated to the destination buffer (88 bytes).
The code:
...
- 3,968
0
votes
1
answer
207
views
How is a heap overflow attack implemented?
I am learning about heap overflow attacks, but I am encountering a problem.
Based on the knowledge I found online and my own guesses, I believe that a heap overflow attack involves overwriting ...
- 35
0
votes
0
answers
29
views
Error *** buffer overflow detected *** in CRAN check on r-devel-linux-x86_64-debian-clang
I have a package on CRAN that apparently from September last year started having *** buffer overflow detected *** problems in the CRAN checks. The error only occurs on r-devel-linux-x86_64-debian-...
2
votes
0
answers
107
views
system() returns the error sh: 1: : not found when I try to execute it with "/bin/sh" in the register rdi
I am following a walkthrough of a box on VulnHub, The Planets: Venus.
I got the shell to run through a buffer overflow, by putting an 8 byte padding, a gadget(pop rdi; ret), an address pointing to &...
- 31
1
vote
1
answer
148
views
Why are functions b and f called *twice* in this code after b overwrites its return address with &f (32-bit MSVC debug build)?
I have a very strange code, which as far as I understand, replaces the return address of the function b, and thus the function f is called from it. But I do not quite understand why after the function ...
- 21
0
votes
2
answers
67
views
Overflow when encoding a structure into bytes into a buffer
I wrote this function that should write a structure of data into a buffer of bytes then returns how many have been written. The function does the following:
ask as input a buffer of bytes (char *), ...
- 65
-1
votes
1
answer
129
views
Buffer Overflow strange behavior for RIP
I run test i gdb to exploit an buffer overflow, when testing with:
(gdb) r $(python3 -c 'print(b"\x41"*152+"\x42"*6 )')
(gdb) i r
...
rbp 0x4141414141414141 ...
- 19
0
votes
0
answers
149
views
Failed to construct a Palindromic Shellcode
To exploit the buffer overflow vulnerability in a challenge program, I need to craft a payload that satisfies a palindrome check and executes arbitrary code. This requires creating a palindromic ...
- 19
1
vote
1
answer
132
views
Why does not using C's static keyword on integers cause shell to abort when I access an array out of bounds?
I was trying to assign a value to a location outside of an array in a demo program in C. The array was of type int, and I thought it might overflow into the next variable I had declared, b. However, ...
2
votes
2
answers
889
views
How do I successfully test this trivial buffer overflow written in C?
I am trying to test this example from StackOverflow (how-can-i-invoke-buffer-overflow), but I am not having success.
I also asked for clarification two weeks ago, directly on the post (through a ...
- 423
1
vote
1
answer
107
views
Cannot overwrite the EIP register
Context
I am creating an application vulnerable to Buffer Overflow in Linux to practice this type of vulnerability (creation and exploitation) and I got stuck in this part.
My problem
I cannot ...
1
vote
1
answer
688
views
Understanding Stack Frames and Stack Layout in Function Calls on x86 Systems
I'm currently exploring stack frames and how they work in C programs, specifically on unprotected 32-bit x86 systems (no ASLR, stack canaries, or DEP). I'm not primarily a CS Student — I'm a physics ...
- 11
0
votes
1
answer
104
views
C++ Use Container annotation wrapper for detect memory buffer overflow does not work
I am trying to use Container annotation wrappers for force ASan to detect buffer overflow for a pointer which allocates memory from the stack.
Below is my example
#include <sanitizer/...
- 1,117
2
votes
0
answers
156
views
How do you attack this C doubly linked list through control flow hijacking and buffer overflow?
The attack target
The attack target is a C program which uses a doubly linked list:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
typedef struct node {
struct node *...
- 147
1
vote
1
answer
101
views
Overflowing a stack frame with 0x00001292 in C
I'm following a book on hacking, currently studying buffer overflows. My silly_password.c program takes a command line argument which overflows into the return address of a function. I have been able ...
- 350
1
vote
0
answers
681
views
How to solve this CTF buffer overflow exploit in C, that takes user input with gets(), but the secret needs to contain a newline?
I am a total beginner in CTF challenges (and not much of an expert in programming in general if I'm being honest) and I've been playing around with gerasdf's InsecureProgramming exercises as a way to ...
- 27
4
votes
2
answers
223
views
Why does fgets() require a maximum size of user input? Is it because it does not have the "restrict to first space" property of scanf()?
This is fgets()'s official prototype:
char *fgets(char *str, int n, FILE *stream);
Why specify the size (n) ? Is it to prevent buffer overflow of some sort? Or is it just a design flaw?
I would think ...
- 93
-1
votes
3
answers
165
views
Why this c code below works fine? (C Basic, Buffer overflow test) [closed]
#include <stdio.h>
int main(int argc, char *argv[])
{
int arr[5] = {1, 2, 3, 4, 5};
arr[6] = 7; // [1, 2, 3, 4, 5, 6]
printf("arr[6] = %d\n", arr[6]);
return 0;
}...
0
votes
2
answers
119
views
How to prevent buffer overflow when we recursively ask for input if input is not valid
Have to take a input string of size 5. Also have to check for validity in some unrelated sense. If the input is not valid user is prompted to input again.
Using the scanf("%4s", input);
But ...
0
votes
1
answer
84
views
Getting Overflow Error in Excel when using Format() to format as date
I have a vba automation to concatenate some text but it's been giving me the "Overflow" error when changing the result to date in this specific file (works fine in others).
Function ...
0
votes
1
answer
142
views
C strcat buffer overflow after hundreds of iterations [closed]
I have written a status bar utility in C for DWM to display the time, date, CPU temp, and battery level. I recently noticed the program had crashed and found that it had a coredump. I recompiled the ...
- 3
3
votes
1
answer
44
views
How does g++ detect format-overflow
With gcc version 13.2.0 (Ubuntu 13.2.0-23ubuntu4)
the following code compiles OK:
char mm[3]; sprintf (mm, "%02d", date_struct->tm_mon); // tm_mon is from 0 to 11
How does gcc know that ...
- 99
-2
votes
1
answer
71
views
eCPPTv2 Buffer overflow exploit development
I'm having ecPPTv2 exam, and I successfully developed the exploit for the buffer overflow section, so I found offset, bad chars and the return address, i debugged with Immunity Debugger and It's all ...
0
votes
1
answer
71
views
Runtime error: addition of unsigned offset in leetcode
I was solving a question on Leetcode(322. Coin Change) and I wrote my solution which is working on VScode. the code is:
int coinChange(vector<int>& coins, int amount) {
int n = coins.size(...
0
votes
0
answers
60
views
In C, There is no buffer overflow in strings [duplicate]
Whenever we store data more than the memory allocated to variable we got some unexpected results.But I declare a character array (name) with size 5 and get value from the user (greater than 5 ...
0
votes
0
answers
50
views
Issue of readdir() reading the pointer to a directory
The basic logic in this problem is that the program scans over a directory for N times, and does some operation on specific file inside.
The bug comes out as: program employs rewinddir() to put the ...
- 1
-1
votes
1
answer
1k
views
how to debug "*** buffer overflow detected ***: program_name terminated" along with _FORTIFY_SOURCE=2
My program crashes with the message "*** buffer overflow detected ***: program_name terminated", and I suspect it may be related to the compiler option "_FORTIFY_SOURCE=2" that I ...
- 6,244
2
votes
1
answer
77
views
Broken pipe passing Python output to C++ input due to size
I'm trying to transform an image into a matrix of it's rbg values in c++, i really like the simplicity of PIL on handling different images extensions, so i currently have two codes
from PIL import ...
0
votes
4
answers
125
views
Avoiding buffer overflow at scanf using a macro determining string length [closed]
I've got an assignment where I have to acquire a string input whose length must not be greater than, say, 32. This length is given by a macro called MAX_BUF_LEN. I found solutions on StackOverflow ...
1
vote
0
answers
59
views
Buffer overflow with gdb: can't print to the stack to identify buffer start
I'm a student trying to solve an exercise for my cybersecurity course. It's the first time I get in contact with buffer overflows, gdb and so on, so not a lot of experience here. I was given a simple ...
3
votes
0
answers
111
views
Buffer Overflow Exploit to Redirect Execution to Another Function Causes Segmentation Fault
I am working on a security engineering assignment where I need to create a buffer overflow exploit to change the execution flow of a C program. The goal is to overwrite the return address and redirect ...
- 31
0
votes
1
answer
99
views
Shellcode stub got exited right after executed in Buffer Overflow Exploitation
I am currently playing around with some exploitation techniques in 64-bit Intel executable. My program was compiled with canary protection disabled (-fno-stack-protector), buffer overflow error ...
- 13
2
votes
1
answer
146
views
How do buffer overflows execute instructions on stack?
I have read a bit about buffer overflows.
One thing I don't understand is that normally stack space isn't executable. Then how can code placed in it, be run?
- 601
2
votes
1
answer
832
views
Trying to write a pwntools exploit to buffer-overflow a binary
My goal is to buffer-overflow a binary written in C. That binary asks me to input a name.
After having opened the binary with Ghidra, I discovered the following code that should help me to build an ...
- 629
3
votes
1
answer
950
views
The dangers of overflow using sprintf and how to avoid them
I've been using an IDE making calls to the compiler without me having to configure much, but from the options I can see it seems my project is set to use gnu99 for the C Language Standard and gnu++11 ...
- 133
0
votes
1
answer
153
views
Writing a application which uses a Buffer Overflow to execute code from within application which is not called normally
For demonstration / educational purposes I want to write a simple proof of concept application which uses a buffer overflow to execute code from within this app which is not called normally. I thought ...
- 1
1
vote
1
answer
135
views
Exploiting this code in order to change grade into an A+
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
/*
I obtained access to the professor's grade management program.
Can I change my grade to an '...
- 39
0
votes
3
answers
362
views
Code vulnerability to buffer overflow attack
#include <stdio.h>
int main(void){
int len;
char input[40]="";
printf("input length : \n");
scanf("%d", &len);
if(len > 40){
return 0;
}
...
- 3
0
votes
1
answer
287
views
buffer overflow exercise in c
I am a cybersecurity student and I was doing an exercise in which I have to access the vip_queue function through a buffer overflow without changing the value of check. I've been trying for hours but ...
-1
votes
1
answer
129
views
Trying to simulate buffer overflow but getting segmentation fault
I am trying to simulate buffer overflow on my mac, but it keeps getting segmentation fault even with -fno-stack-protector.
Below is the output I get.
Vulnerable function executed!
data:...
1
vote
1
answer
247
views
Not getting the expected output when running a shell code in a buffer overflow
After finding the eip offset i'm trying to input some shell code to my program. With the following command run $(python -c 'print("A"*108 + "BBBB")') i get the following output
...
- 187