Collaborate Disseminate
I’ve been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don’t understand what the consequences can be. Will it be safe for me to turn o… Continue reading How safe is it to disable DEP for a program?
I’m learning stack buffer overflow exploitation, and I later posted question Shellcode segmentation fault. that executing shellcode from test program, or when injected to vulnerable program, causes segmentation violation. Now… Continue reading How to disable NX on linux
I am trying to bypass DEP in x86_64 (64 bit – ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter “/bin/sh”, but it is not working I don’t kno… Continue reading Why ret2libc is not working in the below code on x86_64?
ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple instantiations.
But ho… Continue reading How does ASLR protect libc entry points?
Is it possible to reliably execute arbitrary code from a single overwrite of the Global Offset Table when W^X is enabled? By “reliably” I mean assuming I control only the location pointed to by the instruction pointer and po… Continue reading Is arbitrary code execution possible using GOT overwrite with W^X enabled?
I’m practicing in exploit development and one of the scenario i have most difficulties is stack pivoting besides the “ADD ESP, XXX” or something like that. The question is, during the writing of a ROP chain, when you don’t ha… Continue reading Stackpivoting techniques
I’m practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the “ADD ESP, XXX” or something like that.
The question is, during the writing of a ROP chain, when you d… Continue reading Stackpivoting techniques
Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/
I was able to produ… Continue reading Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update
I’m trying to write a rop chain to bypass dep on Windows 7 x64 SP1.
I’m working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered and ESP was moved away. … Continue reading ROP: finding a useful stack pivot
I’m trying to write a rop chain to bypass dep on Windows 7 x64 SP1.
I’m working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered and ESP was moved away. … Continue reading ROP: finding a useful stack pivot