buffer-overflow

FileSystemWatcher InternalBufferOverflow

我是研究僧i 提交于 2019-12-06 11:51:24
I am getting an exception System.IO.Internal.BufferOverflowException when I am trying to monitor a folder on network path(DFS - Distributed File System): To many changes at once . It works fine when FileSystemWatcher is monitoring local/network path that don't use this filesystem. I am able to get an event from 1000 + files on local path and I am not getting BufferOverflow exception, however when I am copying file to folder that is on DFS I am not even able to get an event from one(To clarify this, I am getting an error event raised...). I've already tried to set: fileSystemWatcher

Execution of function pointer to Shellcode

纵然是瞬间 提交于 2019-12-06 06:23:38
I'm trying to execute this simple opcode for exit(0) call by overwriting the return address of main. The problem is I'm getting segmentation fault. #include <stdio.h> char shellcode[]= "/0xbb/0x14/0x00/0x00/0x00" "/0xb8/0x01/0x00/0x00/0x00" "/0xcd/0x80"; void main() { int *ret; ret = (int *)&ret + 2; // +2 to get to the return address on the stack (*ret) = (int)shellcode; } Execution result in Segmentation error. [user1@fedo BOF]$ gcc -o ExitShellCode ExitShellCode.c [user1@fedo BOF]$ ./ExitShellCode Segmentation fault (core dumped) This is the Objdump of the shellcode.a [user1@fedo BOF]$

How to disable possible stack smashing protection (EIP is not being overwritten, EBP is)

狂风中的少年 提交于 2019-12-06 04:50:05
I'm trying to figure out how stash smashing is carried out step by step. I have already used Google to no avail, I still don't know why my EIP is not being overwritten. I have this example program: 1 #include <stdio.h> 2 #include <string.h> 3 4 int main(int argc, char *argv[]) 5 { 6 char buf[10]; 7 8 strcpy(buf, argv[1]); 9 printf("Done.\n"); 10 return 0; 11 12 } It's compiled with gcc -g -o prog main.c When I put a lot of AAAAAA's I get SEGV and the register EBP (and also argc and argv addresses are overwritten: Program received signal SIGSEGV, Segmentation fault. 0x08048472 in main (argc=

Hex values in gdb input files

自作多情 提交于 2019-12-06 04:30:00
I'm trying to bof a particular exploitme on DVL by redirecting input (to gets) using run < inputfile inside gdb I can overflow the program successfully but am having trouble appending hex values to the string.. I have tried quotations, converting the value of the mem addr to ascii and various escape attempts (\,\,\) with no luck Input file example: AAAA\x42 In the above example it would appear that the backslash is being read as an ascii char (5c) and the value 42 remains in the stack (oddly?). How would one go about specifying a hex value inside a gdb input file? Thanks Use perl! :) reader

Why I do get “Cannot find bound of current function” when I overwrite the ret address of a vulnerable program?

自闭症网瘾萝莉.ら 提交于 2019-12-06 03:08:37
问题 I want to exploit a stack based buffer overflow for education purposes. There is a typical function called with a parameter from main, which is given as input from the program a local buffer where the parameter is saved. Given an input such that nops+shellcode+address_shellcode , I will exploit it. After debugging with gdb I found the address of the shell code as it will pass as a parameter, and right after the strcpy I examine the stack and the $ebp+8 which is the return address has

Exploiting a string-based overflow on x86-64 with NX (DEP) and ASLR enabled

走远了吗. 提交于 2019-12-06 01:27:36
问题 Consider the following vulnerable code/program: #include <string.h> int main(int argc, char *argv[]) { char buf[16]; strcpy(buf, argv[1]); return 0; } On IA-32 (x86, 32-bit) running Linux with NX and ASLR enabled, I would exploit this using GOT-overwrite technique, which essentially includes the following steps: Overflow buffer till RIP Overwrite RIP with the address of strcpy@plt Use a clean gadget from .text , e.g. pop edi ; pop ebp ; ret , as return address for strcpy Write arguments for

Tool to debug buffer overflows in C++ program with Visual Studio? [closed]

别等时光非礼了梦想. 提交于 2019-12-05 22:50:31
Closed. This question is off-topic . It is not currently accepting answers. Want to improve this question? Update the question so it's on-topic for Stack Overflow. Closed 4 years ago . A long time ago when I was doing C++ work on Windows, there was an advanced diagnostics tool for debugging buffer overflows. It initialized all allocated memory areas, stack or heap, with a special pattern of characters so it could detect buffer overflows. It injected itself into the memory manager to do this and also so it could check all memory areas after a memory write to look for corruption. In exhaustive

sprintf(buf, “%.20g”, x) // how large should buf be?

≯℡__Kan透↙ 提交于 2019-12-05 21:47:27
I am converting double values to string like this: std::string conv(double x) { char buf[30]; sprintf(buf, "%.20g", x); return buf; } I have hardcoded the buffer size to 30, but am not sure if this is large enough for all cases. How can I find out the maximum buffer size I need? Does the precision get higher (and therefore buffer needs to increase) when switching from 32bit to 64? PS: I cannot use ostringstream or boost::lexical_cast for performance reason (see this ) I have hardcoded the buffer size to 30, but am not sure if this is large enough for all cases. It is. %.20g specifies 20 digits

Smashing the stack example3.c confusion

风格不统一 提交于 2019-12-05 20:01:06
问题 This question was migrated from Information Security Stack Exchange because it can be answered on Stack Overflow. Migrated 7 years ago . Article can be found here. I'm reading up on smashing the stack and have found myself to be getting stuck on example3.c. 0x80004a3 <main+19>: call 0x8000470 <function> 0x80004a8 <main+24>: addl $0xc,%esp 0x80004ab <main+27>: movl $0x1,0xfffffffc(%ebp) 0x80004b2 <main+34>: movl 0xfffffffc(%ebp),%eax The author indicates that we want to skip from 0x80004a8 to

Heap / buffer overflow exception

久未见 提交于 2019-12-05 15:23:24
Just curious, Is there or has anyone ever come across a heap / buffer overflow exception in C#? You can cause a buffer overflow in C# in unsafe code. For example: public unsafe struct testo { public int before; public fixed int items[16]; public int after; } testo x = new testo(); x.after = 1; for (int i = 0; i <= 16; ++i) { unsafe { x.items[i] = 99; } } Console.WriteLine(x.after); The above will print "99" because it overflowed the buffer. Absent unsafe code, I do not know of any way to cause a buffer overrun that doesn't trigger an exception. Depending on what you mean by Buffer overflow, an