ELF x64 binary on a remote server communicates via simple socket server in C.

After overflowing the buffer (total buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (512 nops), inserting a reverse bind shellcode on the top of that, finding out a perfect address (without \x00) in middle of nop sled which after sliding it will execute the shellcode.

  • Remote server ASLR is off;

  • Binary compiled without canary and can execute code from stack.

  • No info leak AFAIK

I understand the many outcomes but if I decide to brute force the remote server to find the NOP-sled address. Any good practice for that ?

  • Correct me if I'm wrong but, I don't think brute-forcing memory addresses on remote server -especially for 64-bit address space- is not feasible. Maybe restricting searching space to certain stack addresses or leaking addresses someway could help your problem. I don't heard any other intelligent search method for this type of problem. Commented Dec 26, 2017 at 9:07
  • take a look github.com/Naetw/CTF-pwn-tips#leak-stack-address
    – whoopdedoo
    Commented Dec 26, 2017 at 13:21

1 Answer 1


Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return Oriented Programming). Currently you're bruteforcing the RIP, what if there's some code in the binary that will help you jump to your shellcode without bruteforcing and plus no PIE means that address is constant. When your control is getting transferred at ret, look at what other registers contain. You might find code such as call eax in the binary.

  • I can share the ROPgadget output, I have stack pivot but no rop chain, I do have "call rax" gadget but how do I populate rax to jump to nop sled ?
    – whoopdedoo
    Commented Dec 25, 2017 at 14:53
  • What are the contents of the registers? Do they refer to the buffer?
    – sudhackar
    Commented Dec 25, 2017 at 15:10
  • registers & stack hastebin.com/raw/axalohimur if you like I can edit the main question with the content
    – whoopdedoo
    Commented Dec 25, 2017 at 16:44
  • Can you share ROPgadget's output too?
    – sudhackar
    Commented Dec 26, 2017 at 8:57
  • ROPgadget & ropper output hastebin.com/raw/ehadepohod
    – whoopdedoo
    Commented Dec 26, 2017 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.