Collaborate Disseminate
How does strings find the offset for the string /bin/sh inside of libc.so.6
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep “/bin/sh”
Continue reading How does strings find the offset for a string? [on hold]
I have a vulnerable program, which i successfully exploited, i overwrote its return address. Then i found address of system and /bin/bash in libc, afterwards i created my payload like this:
[junk][address of system][fake retu… Continue reading using ret2libc doesnt give me root shell
I’ve downloaded vulnserver and I want to exploit it using SEH. I managed to overwrite SE Handler successfully, here is the code that I’m using to exploit this program:
import socket
s = socket.socket(socket.AF_INET,socket…. Continue reading SEH based exploit
Let’s say I found a vulnerability in some application and managed to exploit it on my machine. How do I make that exploit work against other machines when the stack layout and memory addresses are different?
Continue reading How are buffer-overflow exploits built to work against different targets?
I’ve created a small vulnerable C program, which normally won’t call function overflowed.
void overflowed(){
printf(“%s\n”,”Hijacked”);
}
void normally(char * st){
char buffer[80];
strcpy(buffer,st… Continue reading Can change flow of the program yet can’t execute shellcode
I’ve created a small vulnerable C program, which normally won’t call function overflowed.
void overflowed(){
printf(“%s\n”,”Hijacked”);
}
void normally(char * st){
char buffer[80];
strcpy(buffer,st… Continue reading Can change flow of the program yet can’t execute shellcode
I read the book “The Shellcoders Handbook”, and in it there is some C code which will execute shellcode (it will only call exit syscall).
char shellcode[] = “\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80”;
int main(){
int *ret;
… Continue reading How does shellcode really run?