Skip to main content
11 votes

What causes the need for NOP sleds?

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
julian's user avatar
  • 7,178
8 votes
Accepted

How to effectively bypass GCC stack smashing detection

The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
BitParser's user avatar
  • 196
7 votes
Accepted

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

WHY and WHEN do we need SEH for buffer overflowing

First of all, read this: https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf That's pretty much how all this started. A SEH buffer overflow is a specific stack overflow that ...
Abigail's user avatar
  • 684
6 votes
Accepted

x86-64 bit Buffer Overflow, help with overwriting %rip

Don't worry, the shellcode is executing properly, just that the debugger "skipped" past the execution. Remember that rip is the instruction pointer and whatever code present at the rip is executed. ...
user202729's user avatar
5 votes

What could be the purpose of XORing esp with a global variable? (stack canary protection)

Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth: When the function is compiled with /GS, the functions prolog will set ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
w s's user avatar
  • 8,508
5 votes
Accepted

x86-64 CALL opcode + disassembly

relative address can be forward or backward from end of current instruction or start of next instruction that e8 00 00 00 00 will be call to the next immediate instruction forward can be e8 ( ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

Can't get buffer to overflow over function pointer

I'm sorry, but this certainly works for me. Lets go through this step by step, shall we? 1. Set up I used your command line to compile the program: gcc -z execstack game_of_chance.c -fno-stack-...
Nordwald's user avatar
  • 2,906
4 votes
Accepted

Basic Buffer Overflow Help

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
Kerim Can Kalıpcıoğlu's user avatar
4 votes

A buffer overflow exercise using a shellcode

Okay, so I will try to answer to all your questions and add a few remarks. Do not disable ASLR system-wide, prefer to disable it within the current process. In fact, echoing 0 in randomize_va_space ...
perror's user avatar
  • 19.1k
4 votes
Accepted

Using a buffer overflow to call a function

Basically, when main calls body, it essentially pushes the return address (which is the value of the EIP register, containing the offset of the instruction following the CALL instruction) to the stack,...
Dvd848's user avatar
  • 559
3 votes
Accepted

Is the value of EBP before the main function important?

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

someone can help me recognize the vulnerability

The bug is in update_volume. pglobal_data -> radio_data.speakers_volume[index] = new_volume; index is an int, it can take negative values too. Ideally you should not be able to access -ve indices ...
sudhackar's user avatar
  • 2,709
3 votes
Accepted

Debug vs Release binaries - Overflow detection

the latest visual studio compilers use runtime checks to detect overflows it performs them using a variety of run-time checks you can use them in un-optimized builds only /Od (these don't work in ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

Buffer overflow on server

We have two major stack protection for buffer overflows: Stack canaries Non-executable stack You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
Kerim Can Kalıpcıoğlu's user avatar
3 votes
Accepted

Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools

If you change your process startup to p = process(["strace", "-o", "strace.out", "./bof"]) and check the resulting strace.out file, you will see: close(0) ...
mephi42's user avatar
  • 156
2 votes

How should I approach a basic CTF exploitation challenge?

As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand. If the vulnerable ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

GS Cookie and exception handlers

The function commented as "New Exception Handler", does contain a Cookie check. But I've never been able to step into it. Since the exception handler is called only during an exception, it won't be ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Debug vs Release binaries - Overflow detection

What you pasted is Visual C++'s /GZ switch or for newer versions /RTC. It fills the stack for local variables with 0xCC. What I couldn't find is if there's an actual function that checks at runtime if ...
Johann Aydinbas's user avatar
2 votes

Debug vs Release binaries - Overflow detection

I've checked the mentioned chapter and there's also an info about detecting an execution of the instruction on the stack. This is I think more common scenario. As for the overflow detection I can ...
Paweł Łukasik's user avatar
2 votes
Accepted

Illegal instruction error in simple buffer overflow

So, first, getting an illegal instruction while exploiting a buffer-overflow is quite common. It just means that you jumped in the middle of the memory where the bytes do not correspond to any ...
perror's user avatar
  • 19.1k
2 votes
Accepted

Why EIP is being overwritten before local buffer ends?

The esp value at the end of the function is computed based on the ecx value stored on the stack. This value is stored immediately "above" (has higher address) the buffer which in your case has 260 ...
bart1e's user avatar
  • 3,409
2 votes

The buffer is too short to insert addresses when exploiting buffer overflow

I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now. The buffer is too short Your main problem is somewhat a hint towards the solution. The logic is, if your buffer ...
multithr3at3d's user avatar
2 votes
Accepted

How can I get my shellcode to work outside of GDB?

I don't think your shell code works even in gdb. The problem is in the address of the string in your shellcode. You are not showing in your question how did you get the address of the string that you ...
Paweł Łukasik's user avatar
2 votes

Bypassing ASLR without leak address

Well if you are not able to leak any of the addresses you cannot really use ROP, but because ARM is little-endian, you can actually override the last few bytes of the return-address. You end up with a ...
Trac3r's user avatar
  • 31
2 votes
Accepted

Run ltrace to avoid detection (on a different PID?)

Ghidra method You can modify the binary via Ghidra in the following way: load the track move in the assembly code to the point where it checks the result (if statement) you will probably be faced ...
zi0Black's user avatar
  • 173
2 votes

Program goes to suspend when buffer overflow occurs

A program might act differently in gdb environment and the shell environment, due to the environment variables GDB sets upon execution. GDB sets two environment variables LINES and COLUMNS to show the ...
secnigma's user avatar
2 votes
Accepted

💻 This code does not crash on ARM (qemu). Why?

UPDATE: Ok, so the older glibc noncompliance I re-discovered was actually fixed back then, and it is a CVE by itself, CVE-2020-6096: https://github.com/bminor/glibc/commit/...
Attila Szász's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible