0

Why do I see a filler being used in some exploits?

Take as an example the code below:

exploit = junk + eip + nops + shellcode

fill = "\x43"*(BUF_SIZE-len(exploit))
buf = exploit + fill

I guess the buffer is the max number of byte we can send to the stack..our exploit could be smaller than that so we add a filter to make it more stable? Is it recommended? Can we just do without a filler?

3
  • "Why do I see a filler being used in some exploits?" - I am interested in examining real examples of this. If you could provide links to such examples it would be appreciated
    – julian
    Commented Nov 17, 2017 at 1:10
  • @SYS_V see here for an example shogunlab.com/blog/2017/08/19/zdzg-windows-exploit-1.html
    – Fabio
    Commented Nov 18, 2017 at 8:34
  • 1
    Sometimes you need to have a certain length of payload in order to trigger the vulnerability. if you have enough space that you can have your shellcode in a simple payload and even then you have some space left to trigger the vulnerability you add more junk to it in the last. Although I don't think it was needed here in this case cause you've already overflown to eip. as @SYS_V already mentioned, such cases are actually very rare.
    – sudhackar
    Commented Dec 21, 2017 at 9:51

1 Answer 1

1

The main reason for needing "filler" or more often referred to as "junk" is because we need to trigger the vulnerability in question.

For example, let's say we have a stack allocated buffer of 2048 bytes and a vulnerable gets(). We'll need to send at least 2048 bytes into the application to fill that stack buffer, anything after those 2048 bytes and we'll begin corrupting program state (stack, registers, etc) which eventually gives us control of the return address.

As mentioned in the comments, overflowing straight into the instruction pointer is extremely rare, so rare in-fact I could only imagine this being the case in CTFs. Essentially, we just need to fill the buffer with some data so that we can trigger the vulnerability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .