Tag Info

New answers tagged

1

int 0x80 is a really old way to make system calls. I'm not sure if it is even supported anymore. You might want to look for syscall/systenter instruction in the image. Ofcourse this depends on what underlying hardware and OS you are using. If you are using any hardware/hardware vm emulator and software newer than from 1995, you should probably be looking for ...


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.


2

What you're looking at is a PLT, which is a way of doing late-bound library imports. The "calling convention" of PLTs isn't standard, but the toolchain usually uses register-based parameter passing for performance, which is why you're seeing edi as the address of the string. The call will go to a stub in the Global Offset Table (GOT) which then calls into ...


0

Rather than using google to find answers for "How to avoid IDS", turn it around. Search for IDS and read about the various IDS solutions. To answer this question, you need to first define what is meant by IDS. Not what the letters stand for, but what you understand the term refers to and the main techniques used. You will find these fall into a few typical ...


3

Your problem is ASLR randomly choosing where your program is loaded. You can turn off ASLR in Linux using sudo sysctl -w kernel.randomiz_va_space=0. Here's my program. I'm using RAX instead of EAX, and an unsigned long * rather than an int *. #include <stdio.h> #include <stdlib.h> unsigned long *get_stack_ptr(void) { __asm__( "mov ...


8

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research). Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc): Use a valid but less common ...


5

Utilizing readily available system resources. Alphanumeric shellcode. Encrypt the shellcode. Polymorphic shellcodes. Metamorphic shellcode. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html Follow the link and skip down to "More Advanced Techniques" for additional information.


2

In most (if not all) modern operating systems that run on x86 hardware, segments are ignored. The segment registers are set to begin at address 0 and to extend for the whole 32-bit address space; thus, offsets computed relatively to one segment are valid for all segments, since they all start at the same place and exactly overlap each other. In practice, ...


0

if you have peda installed for gdb, then you could simply type this in gdb: gdb-peda$ searchmem SHELL The output would show Searching for 'SHELL' in: None ranges Found 1 results, display max 1 items: [stack] : 0xbffff540 ("SHELL=/bin/bash")


3

ROP is about leveraging an initial execution thread hijack into arbitrary code execution even in situations where the OS tries to prevent just that (with DEP and ASLR). By "execution thread hijack" I mean that the attacker succeeds in making execution jump to an unforeseen place, normally by overwriting a memory slot that the application code will later on ...


4

A quick Google search says "no". The original paper from the original presentation (Section 4.2) says that although Buffer Overflow is easiest, it is not necessary. However, a stack overflow isn’t necessary. The payload containing the return-oriented program could be on the heap, and the attacker could trigger its execution by overwriting a function ...


6

Crash Course in Computer Architecture In an Intel x86 and x64 architectures there is something called the stack. This is essentially where everything to determine the execution path is stored. Parameters to functions, local variables, and return addresses are all stored on the stack. CPU registers keep track of where in the stack the program is ...


12

There are two things going on here: On x86 and x86-64 (and most other hardware), the stack grows from the top of memory downwards. Because of this, data used by a function (eg. the buffer you're overflowing) occurs at a lower address number than data used in calling the function (eg. the address to return to after the function is done, which you're trying ...



Top 50 recent answers are included