C++ Code Hacking 1: Pointer Exploitation

C++ Code Hacking 1: Pointer Exploitation

Today I am going to show you how you can access the values of private member variables directly inside main() without the use of any member function.

We know that we can access private member variables with the help of public member functions only. It is impossible to access it directly inside main() through objects.But I am going to prove you wrong . Note: This is the final code

Output: Password Extracted !!!

Now I will explain what I exactly did here. We know we can access public member variables directly. So I extracted the memory address of of the public variable 'id'. Now because all variable are stored in memory in a continuous manner it is possible to get the address of other variable by knowing the address of one variable.Here I knew the address of the variable 'id'. So I managed to get the password variable address by trial and error method . Once I got the address of the password variable then I managed to retrieve the value of password (a private member variable) inside main() without any public member functions.

Few thing you should note here:

To exploit in this manner you should have at least one variable in public section of same data type. I haven't tried with other data type so can't tell you about it.
To find the address of the variables you need to try out various combinations .

------------------------------------------------------------------------------------------------------------

KringleCon : Sans Holiday Hack 2018 Writeup

SANS HOLIDAY HACK 2018 Writeup , KRINGLECON The objectives Orientation Challenge Directory Browsing de Bruijn Sequences Data Repo Analysis AD Privilege Discovery Badge Manipulation HR Incident Response Network Traffic Forensics Ransomware Recovery Who Is Behind It All? First I go to Bushy Evergreen and try to solve the terminal challenge . Solving it is fairly easy , Escape_Key followed by ":q" without quotes After this we move to the kiosk and solve the questions The question were based on the themes of previous Holiday Hack Challenges. Once we answer it correctly we get the flag. For this I visited Minty Candycane and I tried to solve the terminal challenge. The application has command injection vulnerability , so injecting a system command with the server ip allows execution of the command. So first I perform an `ls` operation to list of the directory contents , followed by a cat of t

Linux Privilege Escalation : SUID Binaries

After my OSCP Lab days are over I decided to do a little research and learn more on Privilege Escalation as it is my weak area.So over some series of blog post I am going to share with you some information of what I have learnt so far. The methods mentioned over here are not my own. This is something what I have learnt by reading articles, blogs and solving CTFs SUID - Set User ID The binaries which has suid enabled, runs with elevated privileges. Suppose you are logged in as non root user, but this suid bit enabled binaries can run with root privileges. How does a SUID Bit enable binary looks like ? -r- s r-x--- 1 hack-me-bak-cracked hack-me-bak 7160 Aug 11 2015 bak How to find all the SUID enabled binaries ? hack-me-bak2@challenge02:~$ find / -perm -u=s 2>/dev/null /bin/su /bin/fusermount /bin/umount /usr/lib/openssh/ssh-keysign /usr/lib/eject/dmcrypt-get-device /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/gpasswd /usr/bin/newgrp /usr/bin

Bluetooth Low Energy : Build, Recon,Enumerate and Attack !

Introduction In this post I will try to share some information on bluetooth low energy protocol. Bluetooth Low Energy ( BLE ) is Bluetooth 4.0.It has been widely used in creating "smart" devices like bulbs that can be controlled by mobile apps, or electrical switches that can be controlled by mobile apps. The terms Low Energy refers to multiple distinctive features that is operating on low power and lower data transfer. Code BLE Internals and Working The next thing what we need to know is a profile. Now every bluetooth device can be categorized based on certain specification which makes it easy. Here we will take a close look into two profiles of Bluetooth which is specifically designed for BLE. Generic Access Profile (GAP) - This profiles describes how two BLE devices defines discovery and establishment of connection with each other. There are two types of data payload that can be used. The Advertising Data Payload and Scan Response Payload . The GAP uses br

echo "0xHat Security"

Search This Blog