Questions tagged [code-execution]
The process of executing code, either maliciously or not, on a system or device. The term is often used when talking about code injection vulnerabilities.
93 questions
3 votes
0 answers
151 views
Am I being attacked via a libglesv2 vulnerability in Skype?
On 2024-12-22 and 2024-12-23, Skype crashed 7 times with an access violation. This resulted in DMP files written to disk in a crash report folder. WinDbg's !analyze -v command outputs these top 5 ...
- 3,484
13 votes
3 answers
5k views
Filter arbitrary code for blacklisted keywords except on commented lines
I have a Rust-app executing Python-scripts using PyO3. The Python-scripts are uploaded by users, so I need to check for unsafe code before executing it. The scripts should only be able to do ...
- 3,540
1 vote
2 answers
702 views
execute command in go without storing the command in a .exe file
I am trying to do a go program to execute a .exe file, but without be actually a .exe file. The idea is to read the executable from a .txt file and decode it (it is in base64). Once I have that code ...
- 11
0 votes
2 answers
865 views
Unable to execute shellcode on x86_64 architecture
I currently got interested in binary exploitation (even though I do not know if today is still useful). I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
0 votes
1 answer
219 views
What are all ways to run code at Windows startup?
I'm the attacker. What are all the options to run code at the Windows startup: If I have administrator rights? If I have normal user rights? Can someone put any program (or script) in this method or ...
- 31
3 votes
2 answers
2k views
Check if javascript in pdf is malicious
I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf: How do I check if this is malicious code?
- 43
1 vote
3 answers
3k views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
- 41
-1 votes
1 answer
133 views
Recommended way to merge a security feature with the rest of the software? [closed]
I am searching for the best way to merge two parts of software together, so it would be as hard as possible to separate them again through reverse engineering. At the moment are both parts python, but ...
- 56
1 vote
2 answers
967 views
How can code signing posibly be secure on Windows when signed executables act on unsigned input?
As a security measure, my Windows-based work computer has been configured to deny any application that hasn't been signed with a valid certificate; my system will run a signed executable from DropBox'...
- 111
1 vote
2 answers
3k views
Security Implications from Base64 Image
I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
3 votes
1 answer
457 views
Remote code execution after a valid SMB (net use) password in Windows?
I am doing a capture-the-flag exercise in a Windows scenario. It uses Windows 2016 server. I was able to find the password and I can access the files with a: net use z: \\computer\C$ password /user:...
- 31
0 votes
1 answer
3k views
What can I do with a Pdf upload vulnerability on a CTF server?
A web server running iis 10 ,PHP (windows) allows users to upload any type of pdf (the location and filename does not change on the server ). The files uploaded go though some file extension check ...
- 1
0 votes
0 answers
161 views
What ways a website could hack a device? [duplicate]
Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...
- 1
0 votes
0 answers
138 views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
- 155
0 votes
1 answer
237 views
Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?
When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
- 3