2

I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.

"It's difficult to know the starting address of the shellcode"

Why do we need to know the address of the shellcode? Why does stack not execute the shellcode as it is?

say we inject our shellcode this way

our shellcode -- some padding -- our choice of saved return address

should the shellcode not be executed by default by the stack? Why do we add NOP sleds and complicate things.

  • 1
    Can you link one of those articles? Maybe there's something specific there. I think with the current information you provide it's difficult to correctly answer your questions. – Paweł Łukasik Aug 27 '18 at 6:34
1

Exploiting a software by injecting a shellcode in its memory always requires the following steps:

  1. Have a way to inject your shellcode in memory (usually, it can take place in any buffer of the program).

  2. Redirect the execution flow (i.e. be able to write on the rip) to point to the shellcode and execute it (usually, it is done through a buffer-overflow).

If you are not sure about the address of your shellcode, the second part of the exploitation (the redirection of the eip) cannot be achieved reliably.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.