Collaborate Disseminate
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:
#include <stdio.h>
#include <… Continue reading Buffer overflow stops executing shellcode in the middle of it
I see a LOT of buffer overflows in Process Monitor, and it is also among processes that are responsible for the security of the machine.
The program ran for 2-3 minutes, and 16751 out of 773514 events were buffer overflows.
Could this be a… Continue reading Could it be suspicious if I see a lot of buffer overflows in Process Monitor, among the processes of Microsoft Defender for Endpoint network scanner?
It’s a venerable program, and this version had a venerable bug in it. Continue reading Ping of death! FreeBSD fixes crashtastic bug in network tool
I recently seen a paper where COOP exploit dev was used to bypass DEP+ASLR+CET+CFG+SEHOP. JIT attack surfaces like v8 seem to have even less hardening. Is there a form of exploitable memory corruption that COOP doesn’t work on?
Continue reading Is there any combination of memory mitigations COOP doesn’t bypass?
I am facing a CTF challenge in which I have to conduct an attack using a ROP chain on this program below:
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <sys/stat.h>
#include <fcntl.h>
I’m learning about buffer overflows and that there are various different types of them, including ones you can do when you can’t directly hijack the return address.
In these cases, you can hijack a function instead and make that call a she… Continue reading Is obtaining a shell from this buffer overflow possible?
This is code for a CTF challenge, the goal is to call the system function to extract the flag but in order to do so the value of outcome should be changed to 0x4774cc. I am having hard time figuring out a way to overwrite/change that becau… Continue reading Overwrite a variable in a binary during execution
I’ve got a pretty tricky flag that I have been beating my head against for a while now and would love an explanation for how something like this would be possible. I have a program that when run, seemingly immediately cancels itself. File … Continue reading Buffer overflow on a program that only accepts arguments as input
In the function epilogue, the previous frame pointer, which is stored in the area below the return address, will be retrieved and assigned to the ebp register. However, when we overflow the return address, the previous frame pointer region… Continue reading Overflow the return address in the function epilogue
I just installed ASX to MP3 Converter 1.82.50 in order to try this Local Stack Overflow: https://www.exploit-db.com/exploits/38457
I generate a shell code in order to pop a calc.exe:
msfvenom -p windows/exec CMD=calc.exe -f python -b ‘\x00… Continue reading How to fix ASX to MP3 Converter 1.82.50 exploit code