1

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not executable.

Is there a way to get around this without directly editing the executable?

  • 2
    Probably, but the question needs more information to provide a good answer. Are there any other protections on the executable (e.g., ASLR, etc.)? How exactly are you getting control of EIP (e.g., stack buffer overflow, heap overflow, type confusion, use-after-free, etc.)? – 3pidemix Jul 12 '18 at 5:36
1

well, you can’t execute non-executable pages, so you have the following options:

  • use an executable memory area for your shellcode if available.
  • somehow force the program to mark the memory with shellcode as executable
  • use ROP (return-oriented programming) instead of straight executable shellcode. The ROP payload does not need to be executable since it borrows executable gadgets from the existing code areas in the process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.