Questions tagged [exploit]

An exploit is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch, or vulnerability in order to cause unintended or unanticipated behavior to occur. This frequently includes such things as gaining control of a computer system, allowing privilege escalation, or a denial of service attack.

Filter by
Sorted by
Tagged with
0 votes
0 answers
83 views

How to construct this basic buffer overflow to alter program flow?

I'm currently trying to (re)learn more about basics of vulnerabilities and more low level stuff again, but I have been beating my head against this for the last 2 days and really need some hlp. I ...
Furious Gamer's user avatar
0 votes
0 answers
23 views

Why is this code generating a php.mail.multipart.form exploit malware detection from my hosting provider?

Why is this code generating a php.mail.multipart.form exploit malware detection from my hosting provider? My hosting provider is detecting this code as containing malware? Why is this? it seems that ...
luckyclover's user avatar
3 votes
1 answer
56 views

Understanding of return address calculation from Hacking: the art of exploitation?

The program is shown in the similar thread here. Let's assume that my OS doesn't implement ASLR or other protections from buffer overflow. Long story short, the author is spawning a child process from ...
noob_user's user avatar
-1 votes
1 answer
44 views

i need solution for brute force 6 digit otp,

suppose I need to implement a system to brute force a 6-digit OTP. I have 100 Core 2 Duo computers. Each computer has 1/2gb ram and a 20mbps Broadband connection, but OTPs expire within 300 seconds or ...
Shafkat Raihan's user avatar
-1 votes
1 answer
71 views

ret2libc: sh: line 1: command not found

So I've been trying to develop a ret2libc exploit for my program as shown below: #include <stdlib.h> #include <stdio.h> void vuln() { char arr[0x10]; scanf("%s", arr); ...
bruh's user avatar
  • 1
2 votes
1 answer
191 views

Jinja2 SSTI filter bypasses

I'm doing a Capture The Flag (CTF) and I'm trying to exploit a server vulnerable to Jinja2 Server Side Template Injection (SSTI). I can't use the following characters: \, |, ,, . and _. I'm trying to ...
faint's user avatar
  • 21
1 vote
1 answer
74 views

Why is my stack filled with 0xc2 instructions when I passed the 0x90 instruction?

I have a C program to exploit buffer overflow #include <stdlib.h> #include <stdio.h> #include <string.h> int overflow(char *input) { char buf[256]; strcpy(buf, input); return ...
leandror's user avatar
0 votes
0 answers
35 views

Stack not aligned even when using only 4 byte values

OK this has been bothering my for a while. I have a x86 binary which I'm supposed to attack via ROP. I already have all the offsets I need which I will show you in a minute. I know that I need 44 ...
Slava's user avatar
  • 73
1 vote
0 answers
23 views

Which section of the modern compiled code controls the exit of a c program?

So, In the binary files of C program compiled using old gcc versions like 3.3.6 there is a section like .dtors but there is nothing like that in the binary files of C program compiled using new gcc ...
Vignesh SB's user avatar
0 votes
0 answers
20 views

What is the alternative of .dtors section in modern compilers

So guys I was working on an old gcc compiler 3.3.6 which generated an .dtors section with no code even when I did not use the destructor function. But now in new compilers there is no section like ....
Vignesh SB's user avatar
0 votes
0 answers
106 views

how to exploit vulnerability CVE-2022-20006 in Android Studio

I need to demonstrate this vulnerability being exploited for my mobile cybersecurity class. It should be possible in the following Android versions: Android-10, Android-11, Android-12, Android-12L (...
Thomas Todt's user avatar
0 votes
0 answers
61 views

use of nop(0xc3=ret) in return oriented programming

I am failing to see any use of nop's in rop why do people use them? I have seen some examples of rop gadget chains like (G2,G3,G4 are some gadgets) nop(return gadget)-(G2)-(G3)-somedata-(G4)---nop(...
Mike's user avatar
  • 11
0 votes
0 answers
35 views

Does a vulners nmap scan use CVSS v2 or v3 ratings?

nmap -oN scan.txt -sV -sC --script=vulners -iL ips.txt I am scanning using nmap with vulners as my NSE. The resulting scan.txt flags up vulnerabilities with their corresponding CVSS ratings. When I ...
Asteck's user avatar
  • 60
0 votes
0 answers
40 views

Are socket.IO session IDs secure?

I recently found out that clients can "spy" on other clients and all of their communications by joining the room with the victim's session id. Is this secure? My usage of socket.IO involves ...
py660's user avatar
  • 118
0 votes
1 answer
50 views

(Help) How to make the script below can be re run after respawn?

So, i am trying to make it can be re run after respawn but it does not work, i am kept struggling. My purpose with this script (autofarm, when the tween is done, it does waiting until respawn, when it'...
user20853472's user avatar
0 votes
1 answer
81 views

How to fix syntax Roblox Lua

I kept getting error, but its seems already good at if and elseif statements, kept giving me last line error How the code works? When chat :example it does do ..., You can check under below, also this ...
user20853472's user avatar
0 votes
0 answers
237 views

My Python DDoS script wont run (packet doesn't send to the target)

Im creating a Python DDoS program, and when i try to run it and target my own testing server, it doesn't send any packets. And the server didn't receive any activities either. Here is the code def ...
Arm64's user avatar
  • 21
0 votes
0 answers
96 views

Segmentation fault at nop sled Stack Buffer Overflow

Now we are at ret instruction and jump to esp which is when x/10i $esp it's look like this 0xffffd12a: nop 0xffffd12b: nop 0xffffd12c: nop 0xffffd12d: nop 0xffffd12e: nop ...
XCN _ Nate's user avatar
0 votes
0 answers
195 views

RSA with python Challenge, Any tip on cracking python code

Hy Guys, I know this will sound weird but can u guys help me with finding readme value. I know python and still having a hard time cracking this variable from Crypto.Util.number import getPrime, ...
HOH_HOH's user avatar
  • 105
0 votes
1 answer
282 views

Converting shellcode hex bytes to text based inputs in Python for an unknown byte value '\x87'? Not a UTF-8 string?

So I am currently doing a beginner CTF challengeon pwnable.tw, the "start" challenge specifically. After reversing the challenge binary I found out there was a buffer overflow exploit, and ...
leatherprofitable's user avatar
0 votes
0 answers
61 views

How do I escape user input, if input is a path?

I am writing a simple Mail Server-Client App which is taking a users input for a receiver, a subject line and a message. To store the message, there is a directory in which a subdirectory is being ...
user avatar
0 votes
0 answers
31 views

What is the logic behind the For Loop Condition, "for( i = 0; i < 160; i += 4 )" in exploit_notesearch.c in Hacking - The Art of Exploitation Book

I've been focused on this book for several years trying to get through it slowly but truly by understanding all of the details. However, I've come to a roadblock with a specific line of code in the ...
Iceman's user avatar
  • 11
0 votes
1 answer
49 views

What is the difference between an exploit and a compromise?

I see the words compromise and exploit being used interchangeably. When I did basic Google searches for this question, the answers were about the difference between an exploit and a vulnerability, not ...
Nora McDougall-Collins's user avatar
0 votes
0 answers
110 views

Own Roblox Exploit not working (Access denied for Exlpoit dll)

enter image description hereSo I wrote my own Roblox Mod Menu witht the help of Youtube. Yesterday when I started it everything was fine, but since I turned on my Microsoft Antivirus again, Im just ...
Gökcan's user avatar
0 votes
1 answer
85 views

How to get job and telescope command on chrome's V8 x64.release version? (No symbol "_v8_internal_Print_Object" in current context)

I'm trying to get chrome's V8 (d8) x64.release version to use the V8 support tools in GDB, specifically for the job and telescope commands (predominantly the former). My x64.debug version has this ...
Sarah M.'s user avatar
  • 167
0 votes
0 answers
22 views

why eot character is inserted in shell

I'm trying to exploit a process with pwntools. #include<stdio.h> #include <stdlib.h> #include <unistd.h> const char* binsh = "/bin/sh"; int main() { char buf[0x30]; ...
Chung's user avatar
  • 13
0 votes
1 answer
51 views

how to change stack protection via syscalls without parameters

This is a little bit strange question. I am trying to find a syscall that allowed to execute code on the stack without parameters on i386. I am doing ctf and I success to find a way to call syscall ...
nadav levin's user avatar
0 votes
1 answer
80 views

Prevent Replay attacks when client side NONCES aren't an option

I'm searching for an alternative to NONCES to prevent replay attacks. My scenario: I have implanted a ticket shop where you can buy tickets and to prevent two persons trying to buy the same ticket, I ...
Fatorice's user avatar
  • 415
0 votes
1 answer
35 views

Call function with arra out of bounds access

so I've got a buggy C file in which i need to find an exploit. I have found a bug when accessing the following struct: #define BOARD_SIZE 10 typedef int (*turn_function_t)(struct board *); typedef ...
Dan23's user avatar
  • 1
0 votes
0 answers
85 views

I have attempted to supply hand written shellcode, but it is being read as a string and not as bytes, what next?

How do I get "\x90" to be read as the byte value corresponding to the x86 NOP instruction when supplied as a field within the standard argument list in Linux? I have a buffer being stuffed ...
William Raezer's user avatar
1 vote
1 answer
251 views

syscall in ROP gadget chain not running

I'm trying to call execve("/bin/cat", "filename" , NULL) via a chain of ROP gadget I'm able to step through the syscall but no output or error is shown so I'm not sure what is the ...
nkt's user avatar
  • 383
0 votes
1 answer
71 views

Buffer overflow exploit

I'm trying to learn some basics in cyber security and have been trying to solve an exercise. in my exercise, I need to exploit this code in order to bypass the username and get in. (I know it's very ...
Gilad Tayeb's user avatar
-2 votes
1 answer
200 views

Buffer overflow with pointer issue

I am trying to figure out this buffer overflow exploit. Any pointer would be helpful. #include <stdio.h> #include <stdlib.h> #include <unistd.h> typedef struct node_t { int ...
Iconik Omrondo's user avatar
0 votes
1 answer
68 views

inject code onto command line input using python27

I have written a simple c program with a bufferoveflow. It is basically a game to guess 4 digits number but starts by asking players to enter their name and this is where buffer overflow happens...I ...
newbieprogrammer's user avatar
-1 votes
1 answer
515 views

Windows Defender ATP - Disable .LNK files from running on USB devices

Dear Stackoverflow Community! I've got a question concerning Windows Defender, Attack Surface Reduction and Endpoint Device Manager. To prevent LNK Worm Expoitation I want to block .LNK files on ...
DBretschneider's user avatar
2 votes
1 answer
125 views

Using eval() to assess user input and some condition. What alternatives?

First, to provide some context, I am designing a console based version of Blackjack for entertainment and learning purposes. The code below was my solution to evaluate different conditions given user ...
Paulo Martins's user avatar
0 votes
0 answers
56 views

What can be exploited here?

I'm doing this exercise on ROP and I'm given a stripped binary that when disassembled with ghidra gives void secret(long num,char *str){ if(num == 1){ pass = strcmp(str, "Hewhewbrew") ...
Cheesewaffle's user avatar
0 votes
0 answers
144 views

check PDF files for javascript or other threads

I want to be able to detect if a PDF file uploaded by a user contains possible threats (JavaScript, System commands etc.) using PHP. I need a quick and easy way to do this. Can someone give me a ...
Junior's user avatar
  • 487
0 votes
1 answer
226 views

RIP register size

I've been studying binary exploitation and recently I found a problem that I cannot find an answer for... I have the following code: void vuln(char *s) { char buf[10]; strcpy(buf, s); } int ...
Snox's user avatar
  • 580
1 vote
0 answers
275 views

How can service run as a logged in user?

I'm trying to find out if it's possible for a service to run under the logged in user account. The reason why I'm trying to figure out whether it's possible is because we have, during a penetration ...
Mikuláš Hrdlička's user avatar
0 votes
0 answers
33 views

Need Explaining With Specific Exploit Terminology

I was looking at the Azorult 3.3.1 SQLI exploit and I would appreciate if someone can explain me what does guid mean in this content. Also it says that I can retrieve the guid and key from the sample ...
balbavik's user avatar
0 votes
0 answers
38 views

How does pi fit into CVE-2018-16763

Exploit: CVE-2018-16763 I'm confused about is this comment: #http://10.10.12.27/fuel/pages/select/filter=%27%2Bpi(print(%24a%3D%27system%27))%2B%24a(%27ls%20-la%27)%2B%27 I know this is showcasing ...
InexactRex69's user avatar
1 vote
1 answer
118 views

solidity security fallback function priority

I know that the fallback is triggered when sending a transaction to this contract and calling a non-existent function, what I want to understand is: Contract A sends a transaction to Contract B (...
nopnopttt's user avatar
0 votes
0 answers
260 views

How to build a lab with ASLR and DEP turned off to prepare a remote, stack-based buffer overflow exploit for a pentesting certification exam?

For my first pentesting certification exam I have to prepare the virtual lab in order to locally analyze a vulnerable binary and build a BOF-exploit, which I then have to use against a remote target ...
stack_canary's user avatar
0 votes
1 answer
234 views

How to Pack a variable with p32() ik python?

I would like to pack a variable and also multiply it .But i can't did it properly can anyone help me to fix it from pwn import * p= process (./format2) target = "deadbeef" payload = p32(&...
Gobinath B's user avatar
0 votes
0 answers
66 views

Can't understand XOR behaviour

I've been trying to solve the badchars CTF from ROP Emporium and since I've struggled a bit on this one I decided to search for writeups but I am unable to understand how a piece of code acts. Here is ...
KayB's user avatar
  • 21
0 votes
1 answer
45 views

Protect Zero-Day Windows Exploit

How to protect Zero-Day Windows Exploit From word document
Natthawut Ponkrut's user avatar
0 votes
2 answers
134 views

Exploit the code calling call_me function + use of shellcode

I need to exploit the following code but not sure how to do it. The idea is to exploit the code trying to call the function which is not used call_me. Second idea is to exploit the code using a ...
Aura's user avatar
  • 1
-2 votes
1 answer
237 views

Acces a broken screen android phone with PC [closed]

is there a way to recover some pictures inside my phone ? (2 phones actually, Galaxy A5 and A50) -the screen is broken -i tried ADB, but device unauthorized
Alex Rudes's user avatar
-1 votes
1 answer
97 views

I have a buffer overflow assignment like this, I set the correct varaible to the HEX value of 1 (31) and still nothing, how do I solve this

How do I set the value of correct to 1 with an buffer overflow exploit? When I pass nothing to this the value of temper is 4D2 which is hex for 1234, but when I overflow the buffer with lets say 10 A'...
Jack Harris's user avatar

1
2 3 4 5
16