801 questions
-3
votes
0
answers
118
views
How to overwite the GOT table from a stack buffer overflow?
I'm working on an assignment where I need to overwrite the GOT table with the system call in order to execute a payload. The initial access is done via a stack buffer overflow. Here is the code of the ...
- 11
4
votes
2
answers
211
views
Trying to exploit the stack content with a format string, but I can't understand where it takes the output from
I am studying for my Computer Security exam and I am on the Format String Bugs section. In the notes there is this code, and I was testing it on my VM:
#include <stdio.h>
void test(char *arg) {
...
- 51
4
votes
1
answer
204
views
How can I exploit Buffer Overflow on x86-64 Linux?
I made a simple vulnerable program greet.c:
#include <stdio.h>
#include <string.h>
int main (int argc, char **argv) {
char buf[32];
strcpy(buf, argv[1]);
printf("%s\n"...
- 65
1
vote
1
answer
215
views
Attack Lab Phase 4: rdi gets the wrong value despite correct assembly being put on stack
I am working on phase 4 of the buffer overflow attack lab, where the solution is is to use ROP (Return Oriented Programming). The idea is that you are given a "farm" where you will look for ...
- 43
2
votes
0
answers
112
views
system() returns the error sh: 1: : not found when I try to execute it with "/bin/sh" in the register rdi
I am following a walkthrough of a box on VulnHub, The Planets: Venus.
I got the shell to run through a buffer overflow, by putting an 8 byte padding, a gadget(pop rdi; ret), an address pointing to &...
- 31
0
votes
1
answer
44
views
How to call the ctypes function from bytes in Python?
I have the disassamble bytes of a simple function
89 4C 24 08 mov dword ptr [sum],ecx
while (sum>=1) {
83 7C 24 08 01 cmp dword ptr [sum],1
7C 0C ...
- 392
2
votes
2
answers
890
views
How do I successfully test this trivial buffer overflow written in C?
I am trying to test this example from StackOverflow (how-can-i-invoke-buffer-overflow), but I am not having success.
I also asked for clarification two weeks ago, directly on the post (through a ...
- 423
5
votes
2
answers
131
views
Segmentation fault in C shellcode x64
I am learning about shellcode development in C with an example from here. I can compile the assembly code and get de opcodes, also I can run successfully the ELF compiled with NASM, but I get a ...
- 135
2
votes
0
answers
129
views
RequestFilterValve constantly throws an error on startup in Apache Tomcat 10.1.28
There is a vulnerability in Tomcat 10.1.28 where inserting a semicolon in the url path will allow seeing the contents of a file. For example, the URL: mysite.com/myapp;/thisfile.config will display ...
- 21
0
votes
0
answers
44
views
PDU interactions with the RDP
I'm working with CVE-2019-0704 (BlueKeep) and have found myself working with PDU protocols. I understand the surface-level, but I need a deeper understanding of the ways that it interacts with the RDP ...
1
vote
0
answers
107
views
Format string vulnerability not showing values on the stack
PROBLEM
I am trying to put together a short demonstration of a simple hack for a presentation about cyber-security. I thought about using a format string vulnerability, and heavily inspired by this ...
- 108
0
votes
1
answer
99
views
Shellcode stub got exited right after executed in Buffer Overflow Exploitation
I am currently playing around with some exploitation techniques in 64-bit Intel executable. My program was compiled with canary protection disabled (-fno-stack-protector), buffer overflow error ...
- 13
2
votes
1
answer
330
views
After modifying msr[lstar], why the expected breakpoint cannot be hit?
I discovered a driver vulnerability that allows arbitrary modification of the msr register.
A common attack scenario is to modify msr[lstar] to point it to the attacker's malicious code. Then, when ...
- 33
-1
votes
2
answers
98
views
Why does an empty method works like a sink in JavaScript?
I define object a with an empty method b(). The method has no parameter and does nothing!
Please someone tell me, why when I call a.b() and pass JS code as a parameter, does it execute the code?
...
- 24
1
vote
1
answer
135
views
Exploiting this code in order to change grade into an A+
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
/*
I obtained access to the professor's grade management program.
Can I change my grade to an '...
- 39
0
votes
1
answer
58
views
Buffer does it stay or get popped of the stack?
Just a quick question, lets say we have this following C code:
int hello(){
char arr[16];
scanf("%s",arr);
printf("%s",arr);
return 0;
}
I have a doubt that when the arr ...
1
vote
0
answers
72
views
Format string exploitation, how to write memory?
I have the following simple program:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char ** argv) {
if(argc < 2) {
printf("Missing ...
- 121
0
votes
0
answers
530
views
Predicting V8's Math.random() truncated outputs
I'm doing a research & working around Math.random() like a month ago.
Math.random() uses XORSHIFT128+, so, if we can get the state of the PRNG, it'll be easy to predict future outputs.
It is ...
- 1
1
vote
0
answers
203
views
how to write a large value > 32 bits with a format string exploit %n
I'm working on a challenge that requires me to overwrite a memory address with a libc address, which is usually around 48 bits.
I can write a 32-bit number into an address but with anything larger ...
- 11
0
votes
0
answers
1k
views
Trying to understand CVE-2023-3824
I recently came across CVE-2023-3824, which has been rated as critical with a score of 9.8. This vulnerability constitutes a Remote Code Execution (RCE) and does not require any user interaction. The ...
- 21
1
vote
0
answers
23
views
Trying to call different class's variable but java reflection does not work
I am trying out a challenge where the system has an app installed from which I need to extract a variable called x.
The app has a man-in-the-disk vulnerability where it calls a file in the external ...
- 11
0
votes
0
answers
205
views
How to use gadget in a ROP attack
Could someone explain what this assembly code does and how could it be used in a ROP attack?
What type of data could go in the registers to successfully perform a ROP attack?
Should it be chained to ...
- 1
0
votes
0
answers
93
views
Having Trouble Running SambaCry exploit
errorI'm testing the Sambacry Vulnerability with the exploit from Github. My current machine is Kali Linux 2021 and Python version is 2.7.18. I have already installed the Impacket. But I still have ...
1
vote
1
answer
283
views
Is there a way to make GDB disassemble all memory in a specific range, without regard for instruction boundaries?
x/16i 0xdeadbeef yields:
0x80481be <_init+22>: shlb $0x3a,-0x18(%ebp,%eax,1)
0x80481c3 <_init+27>: jle 0x80481c0 <_init+24>
0x80481c5 <_init+29>: .byte ...
- 13
1
vote
0
answers
236
views
Buffer overflow exploit, create a bad file and pass it to a program
I am working with buffer overflow exploit to understand it. I have been provided with a program called is_log_file.c to test the buf_exploit.c program I write on it. I am trying to write a program ...
- 11
0
votes
0
answers
90
views
Linux Shell: How do I overload the echo command?
I created a file with
echo "/bin/sh" > cp
Made it an executable and updated the $PATH variable to consider the current folder first.
chmod +x cp export PATH=.:$PATH
The program cp is ...
-1
votes
1
answer
798
views
My flag is not displaying via terminal after completing an exploit in a ctf
To be as concise as possible, I am running a python exploit that passes all the checks that it needs to, but when the original ELF is supposed to write the flag to flag.txt, nothing gets displayed. I ...
- 19
0
votes
1
answer
819
views
Only "cat" command doesn't print any output after getting shell by pwntool
I was making a simple CTF(Capture The Flag) problem with docker. The current case is simple(It's not a real problem, it's just a test.); enter a specified string and get a shell(/bin/bash) if correct.
...
- 356
0
votes
0
answers
177
views
Why is this code generating a php.mail.multipart.form exploit malware detection from my hosting provider?
Why is this code generating a php.mail.multipart.form exploit malware detection from my hosting provider?
My hosting provider is detecting this code as containing malware?
Why is this?
it seems that ...
3
votes
1
answer
124
views
Understanding of return address calculation from Hacking: the art of exploitation?
The program is shown in the similar thread here.
Let's assume that my OS doesn't implement ASLR or other protections from buffer overflow.
Long story short, the author is spawning a child process from ...
- 117
-3
votes
1
answer
2k
views
i need solution for brute force 6 digit otp,
suppose I need to implement a system to brute force a 6-digit OTP. I have 100 Core 2 Duo computers. Each computer has 1/2gb ram and a 20mbps Broadband connection, but OTPs expire within 300 seconds or ...
-1
votes
1
answer
436
views
ret2libc: sh: line 1: command not found
So I've been trying to develop a ret2libc exploit for my program as shown below:
#include <stdlib.h>
#include <stdio.h>
void vuln()
{
char arr[0x10];
scanf("%s", arr);
...
- 1
4
votes
1
answer
5k
views
Jinja2 SSTI filter bypasses
I'm doing a Capture The Flag (CTF) and I'm trying to exploit a server vulnerable to Jinja2 Server Side Template Injection (SSTI).
I can't use the following characters: \, |, ,, . and _.
I'm trying to ...
- 41
1
vote
2
answers
375
views
Why is my stack filled with 0xc2 instructions when I passed the 0x90 instruction?
I have a C program to exploit buffer overflow
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int overflow(char *input) {
char buf[256];
strcpy(buf, input);
return ...
- 59
0
votes
0
answers
120
views
Stack not aligned even when using only 4 byte values
OK this has been bothering my for a while. I have a x86 binary which I'm supposed to attack via ROP. I already have all the offsets I need which I will show you in a minute.
I know that I need 44 ...
- 309
1
vote
0
answers
33
views
Which section of the modern compiled code controls the exit of a c program?
So, In the binary files of C program compiled using old gcc versions like 3.3.6 there is a section like .dtors but there is nothing like that in the binary files of C program compiled using new gcc ...
- 21
0
votes
0
answers
198
views
use of nop(0xc3=ret) in return oriented programming
I am failing to see any use of nop's in rop why do people use them? I have seen some examples of rop gadget chains like (G2,G3,G4 are some gadgets)
nop(return gadget)-(G2)-(G3)-somedata-(G4)---nop(...
- 43
0
votes
0
answers
88
views
Are socket.IO session IDs secure?
I recently found out that clients can "spy" on other clients and all of their communications by joining the room with the victim's session id.
Is this secure? My usage of socket.IO involves ...
- 147
0
votes
1
answer
125
views
How to fix syntax Roblox Lua
I kept getting error, but its seems already good at if and elseif statements, kept giving me last line error
How the code works? When chat :example it does do ..., You can check under below, also this ...
- 13
0
votes
0
answers
990
views
RSA with python Challenge, Any tip on cracking python code
Hy Guys, I know this will sound weird but can u guys help me with finding readme value.
I know python and still having a hard time cracking this variable
from Crypto.Util.number import getPrime, ...
- 135
0
votes
1
answer
1k
views
Converting shellcode hex bytes to text based inputs in Python for an unknown byte value '\x87'? Not a UTF-8 string?
So I am currently doing a beginner CTF challengeon pwnable.tw, the "start" challenge specifically. After reversing the challenge binary I found out there was a buffer overflow exploit, and ...
0
votes
0
answers
100
views
How do I escape user input, if input is a path?
I am writing a simple Mail Server-Client App which is taking a users input for a receiver, a subject line and a message. To store the message, there is a directory in which a subdirectory is being ...
user15967184
0
votes
0
answers
35
views
What is the logic behind the For Loop Condition, "for( i = 0; i < 160; i += 4 )" in exploit_notesearch.c in Hacking - The Art of Exploitation Book
I've been focused on this book for several years trying to get through it slowly but truly by understanding all of the details. However, I've come to a roadblock with a specific line of code in the ...
- 11
0
votes
1
answer
216
views
What is the difference between an exploit and a compromise?
I see the words compromise and exploit being used interchangeably. When I did basic Google searches for this question, the answers were about the difference between an exploit and a vulnerability, not ...
0
votes
1
answer
407
views
How to get job and telescope command on chrome's V8 x64.release version? (No symbol "_v8_internal_Print_Object" in current context)
I'm trying to get chrome's V8 (d8) x64.release version to use the V8 support tools in GDB, specifically for the job and telescope commands (predominantly the former).
My x64.debug version has this ...
- 189
0
votes
1
answer
179
views
how to change stack protection via syscalls without parameters
This is a little bit strange question. I am trying to find a syscall that allowed to execute code on the stack without parameters on i386. I am doing ctf and I success to find a way to call syscall ...
- 91
0
votes
1
answer
227
views
Prevent Replay attacks when client side NONCES aren't an option
I'm searching for an alternative to NONCES to prevent replay attacks.
My scenario:
I have implanted a ticket shop where you can buy tickets and to prevent two persons trying to buy the same ticket, I ...
- 772
0
votes
1
answer
46
views
Call function with arra out of bounds access
so I've got a buggy C file in which i need to find an exploit. I have found a bug when accessing the following struct:
#define BOARD_SIZE 10
typedef int (*turn_function_t)(struct board *);
typedef ...
- 1
0
votes
0
answers
110
views
I have attempted to supply hand written shellcode, but it is being read as a string and not as bytes, what next?
How do I get "\x90" to be read as the byte value corresponding to the x86 NOP instruction when supplied as a field within the standard argument list in Linux? I have a buffer being stuffed ...
1
vote
1
answer
870
views
syscall in ROP gadget chain not running
I'm trying to call execve("/bin/cat", "filename" , NULL) via a chain of ROP gadget
I'm able to step through the syscall but no output or error is shown so I'm not sure what is the ...
- 413