ELF x64 binary on a remote server communicates via simple socket server in C.
After overflowing the buffer (total buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (512 nops), inserting a reverse bind shellcode on the top of that, finding out a perfect address (without \x00
) in middle of nop sled which after sliding it will execute the shellcode.
Remote server ASLR is off;
Binary compiled without canary and can execute code from stack.
No info leak AFAIK
I understand the many outcomes but if I decide to brute force the remote server to find the NOP-sled address. Any good practice for that ?