I have a 32 bit linux binary that is susceptible to a buffer overflow. I figured out I need to input 1040 bytes before I can control the EIP register.
I have a shellcode size of 28 bytes. How do I arrange this input to fill the buffer, insert my shellcode, and set EIP to the address of the first byte of shellcode?
I tried inserting the shellcode at 1040-28 bytes, then the address, but that did not work.
The goal here is to make eip point to your shellcode. There are many ways to do that. The first thing would be to check if your shellcode is placed in a register. If that happens then you can perform a ret2reg (return to register) by finding a gadget that will let you return to that register (like call reg etc...). Another way would be to use a nopsled - but that is not that stable. In that case your payload could be like:
nops + shellcode + (1040 -len(nops+shellcode))*"A" + pack32(a_nop_address)
Have in mind though, that the "a_nop_address" from the above payload changes inside gdb and will not be stable in case aslr is enabled. All the above ways assume that your stack is executable of course. Another way is also to use a shell variable that will contain your shellcode and then make eip point to that address. Finally, there are also more advanced methods, like ret2libc, ret2plt, ROP etc..., that do not even use a shellcode to pop a shell and can also help to bypass some security mitigations like aslr and non-executable stack.
