2

I was trying to exploit a buffer overflow in the following manner:

NOP sled -> shellcode -> address of NOP sled (before it was save RIP)

But, I was told on Stack Overflow that I should also append a NOP sled to my shellcode:

NOP sled -> shellcode ->address of NOP sled -> NOP sled.

Can anyone explain to me why should I append a NOP sled to my shellcode?

This is my original post on Stack Overflow:

https://stackoverflow.com/questions/38416045/im-trying-to-exploit-a-bufferoverflow-am-i-doing-something-wrong?noredirect=1#comment64836134_38416045

Thanks.

EDIT: I read another post in which someone had the same problem.

He fixed this by adding a small NOP sled after the shellcode. Since the shellcode was added to the stack at the end of the buffer, and it pushes some things to the stack itself, it was overwriting its own code.

But I don't understand how a push instruction can make the shellcode overwrite its own code.

Improve this question

1 Answer 1

Reset to default
2

There are two reasons for this as far as I know

  • The buffer overflow length might need to be a very specific number and your shell code might not take up the entire buffer. For instance if your buffer has to be exactly 400 bytes but your shellcode is only 312 then you'd insert 88 bytes worth of nops to ensure the correct length.
  • Shellcode can require a bit of room to "expand itself". You can typically get away with only adding a few extra nops to the end of the buffer but I've always been taught that the shellcode should have some padding at the end for successful execution.
Improve this answer
6
  • I don't know about your second point, but yes, the most common reason I come across is the reason given in your first point. :)
    – Abhinav Das
    Commented Aug 11, 2016 at 18:33
  • @DKNUCKLES Thank you for you answer, so if I understand, I just need to append another extra nops instruction at the end of buffer overflow... that's all ? I would like to understand why it doesn't work without the extra nops instruction
    – S7_0
    Commented Aug 11, 2016 at 19:20
  • @S7_0 Because the buffer length of an application might be a specific length in which case you pad to make up for a small shellcode, or you need some space for the shellcode to expand for execution. I always go JUNK (or nops) + RETN ADDRESS + SHELLCODE + NOPS
    – DKNUCKLES
    Commented Aug 11, 2016 at 19:51
  • @DKNUCKLES imagine I have a buffer[100], so if I want to exploit an buffer overflow, I need to overwrite the RBP and save RIP (so 100 + 8 bytes) as follow 58 bytes of nop sled + 50 byte of shellcode + address of the nop sled...So why it doesn't work as above even if I respected the specific size ? Why does it work only if I do something like 26 byte of nop sled + 50 byte of shellcode + 26 byte of another nop sled + addres of the nop sled ? Thanks
    – S7_0
    Commented Aug 12, 2016 at 10:23
  • If you've written the shellcode then you should know whether it needs some minimum "allocation" of working memory, but you still won't know the size of the buffer you're trying to overflow.
    – OrangeDog
    Commented Oct 10, 2016 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .