« first day (4426 days earlier)      last day (524 days later) » 

2:04 AM
@RohanBari Most of us have more...mixed feelings about C++. Not really much in the way of meaningful substitutes, but it's still easy to see problems and wish it were (a lot) better.
 
2:43 AM
@JerryCoffin OMG! I can't believe I'm talking to you! I have frequently seen you answering the questions where I'm stuck. Thanks for those explanations!
Have a look at my repo: https://github.com/rohanbari/CPlusPlus (not self-promoting)
I want you to know that I have been a fond of C++ for years, but not dedicatedly as I am now.
I have been following Stack Overflow, official references and manpages, Effective Modern C++ by Meyers, C++20 Recipes by Browning and Sutherland, and C++ Programming Language (4th edition) by Stroustrup.
Can't do my best as school work is necessary, too.
I'm always in try to apply the best coding practices and conventions. SO has taught me so much about programming "the right way."
 
3:28 AM
@RohanBari You're certainly welcome--I'm glad they were helpful.
 
3:45 AM
It's an honor to meet you, sir. :)
Someday, I'll have contribution points like you, which might be in another tag.
 
4:20 AM
@RohanBari Nice to meet you too. My personal advice is to concern yourself more with helping people than with points. Scores and answer quality don't always correlate very closely.
 
 
9 hours later…
1:09 PM
I wanted to scare my pet chicken a little, so I ran towards my chook with my hands out and my mouth open, I thought I looked like a fierce predator charging towards the bird. But the chicken just stood there looked at me like watching an idiot. So sad, I have been looked through by a chicken!
 
1:20 PM
Why did you want to scare your pet?
 
1:37 PM
The same reason why people visit theme parks? For fun.
 
2:17 PM
Fun out of the pet's mental anguish?
 
2:57 PM
Obviously, my pet has such a good mental health that she did not fuss. I am obviously a good enough pet owner.
 
3:15 PM
Excuses.
 
4:14 PM
Yup I stand by what I say. It seems like many binary level exploitations rely on buffer overflows. I am truly wondering whether that isn't a bit naive
I might be wrong and not creative enough. Maybe there are loads of (simple and complex) ways to create bufferoverflows on a stack. If not, then I do think that many exploits are extremely difficult to use and one has to be lucky to find a binary which is vulnerable to some buffer overflow somehow
 
4:38 PM
or there are a few simple ones and people keep making the correctness mistakes that allow for that flavor of buffer overflow
all it takes sometimes is not keeping the length of the buffer next to the pointer to the buffer in the API
 
Don't canaries and Address Space Randomization prevent buffer overflows?
 
no those make exploiting one harder because you cannot rely on known pointers
also keep in mind that the buffer overflow can be in the heap
where it might overwrite a function pointer or vtable of another object
 
Sounds like an interesting experiment to try.
Do you happen to have any available example?
 
a quick google gives me: win.tue.nl/~aeb/linux/hh/hh-11.html
where they exploited the free implementation
 
5:34 PM
So far I have dabbed into: bufferoverflows to inject eg shellcode, bufferoverflows to use ROP gadgets, race condition scenarios and simply tweaking function return values via the the eax register
is there anything else that you think is really worth it to look into or that is huge and I missed?
(Deffinitely not done reading up on the topic…)
 
6:14 PM
Wouldnt it be much better to always statically link all your binaries for security purposes?
I imagine it must be possible to wrap the glibc so on a target with your own glibc library. That way you could overwrite certain calls to glibc with your own custom implementation and thus trick the application
eg: if the application links to libc.6.so just rename that to realLibc.6.so and write your own libc.6.so that forwards specific calls to the real libc and "mocks" other ones on purpose
 
 
3 hours later…
9:34 PM
@MangaD Can confirm. Canary was enabled on my test binary and I could bypass it
 
But only on specific situations, right?
 
Not sure I understand what you mean
I must admit I could bypass the canary stuff when running the binary with gdb. Haven t looked at bypassing without gdb
without gdb when overflowing a buffer the canary stuff (presumably) immediately tells me stack smashing was detected
when using gdb I did not get that error. Also I m pretty sure there must be a way to use bitmasks or whetever so you can just go passed that series of bytes somehow
So far I only did the very naive part by overwriting the return address and setting it to some custom address I chose. next is to simply use the buffer overflow with a bitmask somehow to overwrite the content of %rip
 
GDB tells you the canary value. But if the program is running on another machine you cannot know what the canary value is.
 
This makes me realize bitmasks obvisously will not work here. A buffer overflow will just overwrite everything
hmm interesting
especially when it is on a different machine, as you mentioned
As mentioned, I am still discovering all of this. This is all pretty new to me. Just started reading about this stuff a couple of days ago
 
I did some experiments with this at school, but don't remember trying heap overflows.
 

« first day (4426 days earlier)      last day (524 days later) »