Collaborate Disseminate
I am attempting to practice some return-to-libc exercise found here but I’m stumped.
According to the exercise, I am suppose to be able to obtain a shell by arranging my input as follows:
|——————————-|-… Continue reading Unable to system("/bin/sh") in return to libc practice
I’m learning about stack buffer overflow and I’d appreciate help.
I’m exploiting simple web server containing this log function. Argument s1 is the input that I supply via HTTP. Server is running on x86 linux with stack addr… Continue reading Bufferoverflow – jmp esp. Do I need nops sled? Does call esp also work?
Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can’t figure out how to exploit to begin w… Continue reading Software overflow exploitation lab
I’m trying to work through the modern binary exploitation course that was posted by RPI. I’m working on the shellcode lab and trying to understand something that’s happening in the example code here (condensed for clarity). T… Continue reading Help with overflow return address
I’m looking for some real projects which have stack overflow vulnerabilities. The important thing is, I am going to teach finding the vulnerabilities and the way of fixing them by these examples. So, the vulnerabilities shoul… Continue reading Some vulnerable projects in C or C++ for a lecture? [closed]
This question is primarily in the context of arbitrary command execution in a buffer (e.g. stack) overflow.
I read somewhere recently that hard-wired (absolute) addresses are not good for shellcode e.g. using /bin/sh for exa… Continue reading Hard-wired vs relative addresses in shellcode
I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our system has NX bit.
What if we made the… Continue reading Using instruction set architecture (ISA) to stop stack overflows
Here is what happens when I run it:
isuser@ubuntu:/mnt/assignment_2/code$ ./a.out pyexploit.bin
Floating point exception
isuser@ubuntu:/mnt/assignment_2/code$
But first here is the target code and my binary:
#include &l… Continue reading Floating-point exception when performing stack buffer overflow attack
Heres the target that I’m trying to start a root shell on:
#include <string.h>
#include <stdio.h>
void callme(char *filename) {
char b[256];
FILE* f;
printf(“%p pointer of b\”, &b);
f = fopen(filenam… Continue reading Stack Buffer Overflow adress gets mangled
I already tried various solutions provided to other “exploit doesn’t work outside gdb” questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the exploit does not work (behemoth… Continue reading Exploit does not work outside GDB