I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C.
I have the source code, locally. After overflowing the buffer (socket buffer is 2000, password buffer is
less), overwriting the RIP, filling with NOP sled (512 nops), inserting a reverse bind shellcode on the top of that, finding out a perfect address (without
\x00) in middle of nop sled which after sliding it will execute the shellcode.
Remote server ASLR is off;
Binary compiled without canary and can execute code from stack.
I want to brute force the remote server to find the NOP-sled address. Any good practice for that ? Because, the last 5K attempts did not work at all.
My local address when I turn off ASLR is
The following code pops a shell (not interactive) locally :
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((h, p)) s.send(("hello " + "A" * 100).encode() + struct.pack("L", 0x7fffffffcccc) + (b'\x90'*512) + shell_code) print(s.recv(2048))