Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Well, so you want the program to execute your shellcode. It's already in machine form, so it's ready to be executed by the system. You've stored it in a buffer. So, the question would be "How does the system know to execute my code?" More precisely, "How does the system know where to look for the next code to be executed?" The answer in this case is the return address you're talking about. </p> <p>Basically, you're on the right track. Have you tried executing the code? One thing I've noticed when performing this type of exploit is that it's not an exact science. Sometimes, there are other things in memory that you don't expect to be there, so you have to increase the number of bytes you add into your buffer in order to correctly align the return address with where the system expects it to be. </p> <p>I'm not a specialist in security, but I can tell you a few things that might help. One is that I usually include a 'NOP Sled' - essentially just a series of 0x90 bytes that don't do anything other than execute 'NOP' instructions on the processor. Another trick is to repeat the return address at the end of the buffer, so that if even one of them overwrites the return address on the stack, you'll have a successful return to where you want.</p> <p>So, your buffer will look like this:</p> <p>| NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS |</p> <p>(Note: These aren't my ideas, I got them from Hacking: The Art of Exploitation, by Jon Erickson. I recommend this book if you're interested in learning more about this).</p> <p>To calculate the address, you can use something similar to the following:</p> <pre><code>unsigned long sp(void) { __asm__("movl %esp, %eax");} // returns the address of the stack pointer int main(int argc, char *argv[]) { int i, offset; long esp, ret, *addr_ptr; char* buffer; offset = 0; esp = sp(); ret = esp - offset; } </code></pre> <p>Now, ret will hold the return address you want to return to, assuming that you allocate buffer to be on the heap.</p>
    singulars
    1. This table or related slice is empty.
    1. POIntentional buffer overflow exploit program
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USjwir3
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POIntentional buffer overflow exploit program
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COVery well explained, thanks very much for taking the time to help.
      singulars
      1. PO
      1. USCRO
    2. COI was a CSCI student once. I know learning the buffer overflow is difficult - I actually had to get similar help when I took my first undergraduate course in computer architecture. :) Just hope I could help.
      singulars
      1. PO
      1. USjwir3
    3. COAltough Jon Erickson's book is really nice, I would recommend "The Shellcoders Handbook". IMHO it's more advanced, it assumes you already know some stuffs (asm, C, OS details..)
      singulars
      1. PO
      1. USjyz
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload