11
votes
What causes the need for NOP sleds?
On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
- 7,058
8
votes
How to effectively bypass GCC stack smashing detection
You don't need to bypass gcc's stack smashing detection. If you overwrite key correctly, you get an interactive shell before the stack check is performed at the end of func(). Here's the proof in the ...
- 20.6k
8
votes
Accepted
How to effectively bypass GCC stack smashing detection
The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but ...
- 196
7
votes
Accepted
What could be the purpose of XORing esp with a global variable? (stack canary protection)
Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
- 11.7k
6
votes
How to effectively bypass GCC stack smashing detection
first, you should disable ASLR system-wide, you can do this as follows:
echo "0" > /proc/sys/kernel/randomize_va_space
second, compile your program using flag with -zexecstack -fno-stack-...
6
votes
Accepted
WHY and WHEN do we need SEH for buffer overflowing
First of all, read this:
https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf
That's pretty much how all this started.
A SEH buffer overflow is a specific stack overflow that ...
- 684
6
votes
Accepted
x86-64 bit Buffer Overflow, help with overwriting %rip
Don't worry, the shellcode is executing properly, just that the debugger "skipped" past the execution.
Remember that rip is the instruction pointer and whatever code present at the rip is executed. ...
- 665
5
votes
What could be the purpose of XORing esp with a global variable? (stack canary protection)
Yes, this is Microsoft's stack overflow protection, commonly known as "GS cookie". From Compiler Security Checks In Depth:
When the function is compiled with /GS, the functions prolog will set
...
- 36.2k
5
votes
Accepted
How to find the stack and other info in a memory dump? ARM
The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
- 8,343
5
votes
Accepted
x86-64 CALL opcode + disassembly
relative address can be forward or backward from end of current instruction
or start of next instruction
that e8 00 00 00 00 will be call to the next immediate instruction
forward can be e8 ( ...
- 16.1k
4
votes
Accepted
Basic Buffer Overflow Help
You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
4
votes
Accepted
Can't get buffer to overflow over function pointer
I'm sorry, but this certainly works for me. Lets go through this step by step, shall we?
1. Set up
I used your command line to compile the program:
gcc -z execstack game_of_chance.c -fno-stack-...
- 2,896
4
votes
A buffer overflow exercise using a shellcode
Okay, so I will try to answer to all your questions and add a few remarks.
Do not disable ASLR system-wide, prefer to disable it within the current process.
In fact, echoing 0 in randomize_va_space ...
- 18.8k
3
votes
Accepted
Is the value of EBP before the main function important?
__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
- 36.2k
3
votes
Accepted
someone can help me recognize the vulnerability
The bug is in update_volume.
pglobal_data -> radio_data.speakers_volume[index] = new_volume;
index is an int, it can take negative values too. Ideally you should not be able to access -ve indices ...
- 2,584
3
votes
Accepted
Debug vs Release binaries - Overflow detection
the latest visual studio compilers use runtime checks to detect overflows it
performs them using a variety of run-time checks
you can use them in un-optimized builds only /Od
(these don't work in ...
- 16.1k
3
votes
Accepted
Buffer overflow on server
We have two major stack protection for buffer overflows:
Stack canaries
Non-executable stack
You land on nopsled but, you get segmentation fault. Because your operating system marked program stack ...
3
votes
Accepted
Trouble understanding this rop chain
The ROP chain uses gadgets, which are short code snippets performing a basic function. The instruction what you see in the Python script in the video are the gadgets names, which were selected in the ...
- 1,759
3
votes
Accepted
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) ...
- 156
3
votes
Accepted
Using a buffer overflow to call a function
Basically, when main calls body, it essentially pushes the return address (which is the value of the EIP register, containing the offset of the instruction following the CALL instruction) to the stack,...
- 539
2
votes
Passing arrays to a function call (Buffer Overflow)
What you're actually doing there is passing pointers to the array, not the array itself. If you look at the declarations:
char * const argv[] = {"cat", "/etc/target/file"};
char * const envp[]...
- 361
2
votes
How should I approach a basic CTF exploitation challenge?
As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand.
If the vulnerable ...
- 11.7k
2
votes
Accepted
GS Cookie and exception handlers
The function commented as "New Exception Handler", does contain a Cookie check. But I've never been able to step into it.
Since the exception handler is called only during an exception, it won't be ...
- 36.2k
2
votes
Debug vs Release binaries - Overflow detection
What you pasted is Visual C++'s /GZ switch or for newer versions /RTC. It fills the stack for local variables with 0xCC. What I couldn't find is if there's an actual function that checks at runtime if ...
- 1,391
2
votes
Debug vs Release binaries - Overflow detection
I've checked the mentioned chapter and there's also an info about detecting an execution of the instruction on the stack. This is I think more common scenario.
As for the overflow detection I can ...
- 4,742
2
votes
Accepted
Why EIP is being overwritten before local buffer ends?
The esp value at the end of the function is computed based on the ecx value stored on the stack. This value is stored immediately "above" (has higher address) the buffer which in your case has 260 ...
- 3,369
2
votes
The buffer is too short to insert addresses when exploiting buffer overflow
I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now.
The buffer is too short
Your main problem is somewhat a hint towards the solution. The logic is, if your buffer ...
- 609
2
votes
Accepted
How can I get my shellcode to work outside of GDB?
I don't think your shell code works even in gdb. The problem is in the address of the string in your shellcode. You are not showing in your question how did you get the address of the string that you ...
- 4,742
2
votes
Bypassing ASLR without leak address
Well if you are not able to leak any of the addresses you cannot really use ROP, but because ARM is little-endian, you can actually override the last few bytes of the return-address. You end up with a ...
- 31
Only top scored, non community-wiki answers of a minimum length are eligible