Collaborate Disseminate
I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows:
bytes to fill buffer + address of system + return address for system/address of… Continue reading Understanding ret2libc return address location
I’m new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I’m referring to the process of sending all possible characters to the vulnerable process to see if there are… Continue reading What is source of bad characters exist in buffer overflows
I’m new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I’m referring to the process of sending all possible characters to the vulnerable process to see if there are… Continue reading What is source of bad characters exist in buffer overflows
; Fill buffer with data from standard input.
; Buffer is stored on the stack.
;
extern printf
extern puts
extern strlen
extern gets
extern fgets
extern stdin
section .data
read_message: db "insert buffer string: ", 0
bu… Continue reading how to overflow fgets asm x86 32 bits. i want to give a input from a file such that i overwrite the local variable
; Fill buffer with data from standard input.
; Buffer is stored on the stack.
;
extern printf
extern puts
extern strlen
extern gets
extern fgets
extern stdin
section .data
read_message: db "insert buffer string: ", 0
bu… Continue reading how to overflow fgets asm x86 32 bits. i want to give a input from a file such that i overwrite the local variable
I can control the addresses of Freelist pointer during deallocation
https://github.com/marcinguy/CVE-2020-15999#update-7
Are there any TCMalloc Attacks that can turn this into RCE?
TCmalloc should have some basic, if any protections.
Confu… Continue reading TCmalloc heap exploitation
I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn’t run at that moment.
For example;
#include<stdio.h>
Found a bug in a function in a loop where I can go past a loop in assignment where value is read from past malloced memory
The function has no call, int or other assembly instructions afterwards.
Instruction I control is movzbl. I control … Continue reading Exploit – Code execution without assembly call instruction, int etc on ia_64
I am learning libc shellcode attacks and trying to execute /bin/sh from system
I can execute other commands from system like whoami and ls -a but can not run /bin/sh
the following works
string = b"ls -a\0"
# system, _exit, system… Continue reading system doesn’t invoke /bin/sh
I’m looking for research on the topic if at all possible or readings about efforts into this.
Drilling down into binaries via fuzzing/fingerprinting for known vulnerable binary patterns and a little boilerplate shellcode to insert into bin… Continue reading Are there any projects/papers on approaching exploit development with AI/automation?