New answers tagged

1

You need to repeat the buffers on the 0x0048, stack, if you do not do this before you compile the binaries then you will get return errors that point to the top of the stack, instead run GCC -compile/"lib64.zip= grep |pipe/usr/shr/, then create a directory for the 0x0048 return errors, this lets us debug it without having to first go back to source and ...


1

When you are overflowing a buffer to write on the stack in a way which is exploitable you will overwrite the return address on the stack. Ie, sending a long string of AAAAAAAAAAAAAAAAAAAAAAAAAAA.....AAAAAAAAA will result in EIP containing the value 0x41414141 when the application crashes. The reasons for this is all well documented in lots of places on the ...


0

Why does EBP corruption causing program crash? The EBP (Extended Base Pointer) register points to the base of the current function's stack frame. Some compilers use it to find local variables within the stack frame. For example, if you have two local ints in your function, the compiler might access them with *(ebp - 4) and *(ebp - 8). The EBP for the ...


0

It's dangerous. Is it exploitable? Possibly. You've already told us that you can cause a crash, so you may be able to DoS a system by crashing it... depending upon where argv1 comes from. If it's a hard coded value, or if it's generated by a calling app and can only ever be between 0 and 20, then it may not be exploitable in the system. It would still be a ...


0

Yes You don't need to use -1, any value larger than 20 will allow you to overflow the buffer. It will depend on the next instructions and the mitigations set by the compiler, but from this point on you can probably overwrite the return address and execute a shell code provided as the second parameter.


1

The direction of stack growth is hardware dependent. On x86 architectures, it grows downward, but it may be different on other architectures.


1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]): |~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~| Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!): |~~~~~9.95kb~~~~~|~~~...



Top 50 recent answers are included