An exploit is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch, or vulnerability in order to cause unintended or unanticipated behavior to occur. This frequently includes such things as gaining control of a computer system, allowing privilege escalation, or a denial of service attack.
Questions tagged [exploit]
790 questions
2
votes
4 answers
Shellcode as payload for buffer overflow (or other) exploits executed as root?
When I use shellcode such as the ones provided here* as payload to some vulnerable program, how is the shell executed as root? I am asking about how the privileges are elevated to root? The shellcode doesn't seem to call setuid or anything to change…
extraeee
- 3,096
- 5
- 27
- 28
2
votes
1 answer
Return Oriented Programming Compiler
I'm trying to better understand my computer on the lower levels and what better way is there other than writing stack buffer overflow exploits? I recently came across ROP. I read the paper http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html and it…
Konstantin Weitz
- 6,180
- 8
- 26
- 43
2
votes
1 answer
The Shellcode to open Calc.exe too long and complex, can't understand! My first exploit program
I wrote my first exploit program on Windows XP OS using the shellcode i foung on the web. It opens the calculator and the overall program works successfully. However, even though i did not write the shellcode myself, I have to know very well what it…
Ann Gladyo
- 31
- 1
- 4
2
votes
2 answers
C (s)printf exploit, $hn and %10
when trying to follow a tutorial on string exploits in C, I had the following questions which I do not seem to find an answer to.
"If we were to pass the string AAAA%10$n, we would write the value 4 to the address 0x41414141!". This is an excerpt…
Wouter Vandenputte
- 1,948
- 4
- 26
- 50
2
votes
1 answer
Overwriting data via array vulnerabilities
I am trying to demonstrate a buffer overflow via an array index (when there isn't any bounds checking). What I am trying to do is change my bool authenticated = false to true by passing in a bad value.
I am using GCC 4.8.5
arrayVulnerability(int…
Kirby
- 77
- 9
2
votes
1 answer
What is the meaning of Write-4 primitive?
What is the meaning of Write-4 primitive? In the exploit development tutorials, I meet a lot. Does it mean that write 32 bits into the register or memory?
Gh0st
- 33
- 5
2
votes
2 answers
Is using `eval` to define functions with text from a file evil?
This is a follow-up question to eval cat inside a function.
I'm using eval to mimic import functionality from other languages (such as JavaScript). This is something I wanted to do on my local machine for a while since I've built up an overwhelming…
Nick Bull
- 9,518
- 6
- 36
- 58
2
votes
2 answers
Format string bugs - exploitation
I'm trying to exploit my format string bug, which lies in this program:
#include
#include
#include
#include
#include
void foo(char* tmp, char* format) {
/* write into tmp a string…
eleanor
- 1,514
- 3
- 19
- 40
2
votes
1 answer
Exploit a buffer overflow with canary protection
I'm trying to exploit this simple program for homework:
#include
#include
#include
#define BUFSIZE 1024
typedef struct {
char flag_content[BUFSIZE];
char guess[47];
unsigned canary;
char…
Kordo
- 31
- 5
2
votes
0 answers
bash: warning: ignored null byte in input
I've recently programmed a little C program that is vulnerable to a format string exploit. Here is the source code(it is copied from a book):
#include
#include
#include
int main(int argc, char *argv[]) {
char…
J0rdan
- 56
- 4
2
votes
1 answer
Is there a script to safely test for Meltdown and Spectre vulnerabilities on Ubuntu
I did a google search for "test for meltdown and spectre" and found a really disconcerting collection of disreputable-looking links.
I did find an ubuntu page on these attacks which referred to what appears to be an authoritative page detailing…
S. Imp
- 2,833
- 11
- 24
2
votes
3 answers
Exploiting file_get_contents()
Is it possible to read any file (not only those with the extension .html) from the server in the following script?
I know about wrappers (php://, file://, etc.) but achieved not too much.…
terjanq
- 301
- 1
- 3
- 13
2
votes
1 answer
CPU Redesign for Spectre and Meltdown
There are a lot of patches released to fix the recently found Spectre and Meltdown security vulnerability. However they all do this (to my understanding) by disabling usage of certain functionality on the cpu.
So I am wondering if the (predictive)…
vincent
- 1,953
- 3
- 18
- 24
2
votes
0 answers
Is Google Native Client (NaCl) vulnerable to Meltdown or Spectre attacks?
I run sel_ldr_x86_32 file32.nacl and sel_ldr_x86_64 file64.nacl on my Intel machine vulnerable to Meltdown and Spectre.
Given that even JavaScript can employ Spectre, I am curious if NaCl'ed binaries can. Are there any known vulnerabilities of NaCl…
Stair
- 21
- 2
2
votes
0 answers
Meltdown POC in C++
I heard about the Meltdown vulnerability and read the paper, which was kind of difficult since I am not a native speaker, but I decided to make a small proof of concept C++ program which is shown below, I would like to know the reasons for the code…
user9184386