I try exploit a format string in a vulnerable program.

For information, it is the lab4A of the RPIsec course. The NX protection and ASLR is disable but the program is FULL RELRO.

So my idea, it is to overwrite the ret address to execute my shellcode. I do it with gdb but without it, I can't find the good adress.

This is my payload:B\xde\xf4\xff\xbf\xdc\xf4\xff\xbf%49142x%14$x%14290x%15$x

0xbffff4dc is the location of the return adress in my program. It can change a little like 0xbffff4cc or 0xbffff4bc.

So without gdb, I try to execute my payload with different addresses like this: 0xbffff4ec 0xbffff4fc 0xbffff50c... but I did'nt get success.

How can I find the good address?

1 Answer 1


I found my answer here: https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it

My problem was my shellcode is load in a environment variable.

So for bypass this problem, I used a return libc attack!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .