1

I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not executable.

Is there a way to get around this without directly editing the executable?

Improve this question
1
  • 3
    Probably, but the question needs more information to provide a good answer. Are there any other protections on the executable (e.g., ASLR, etc.)? How exactly are you getting control of EIP (e.g., stack buffer overflow, heap overflow, type confusion, use-after-free, etc.)?
    – 3pidemix
    Commented Jul 12, 2018 at 5:36

1 Answer 1

Reset to default
2

well, you can’t execute non-executable pages, so you have the following options:

  • use an executable memory area for your shellcode if available.
  • somehow force the program to mark the memory with shellcode as executable
  • use ROP (return-oriented programming) instead of straight executable shellcode. The ROP payload does not need to be executable since it borrows executable gadgets from the existing code areas in the process.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.