6

I have a 32 bit linux binary that is susceptible to a buffer overflow. I figured out I need to input 1040 bytes before I can control the EIP register.

I have a shellcode size of 28 bytes. How do I arrange this input to fill the buffer, insert my shellcode, and set EIP to the address of the first byte of shellcode?

I tried inserting the shellcode at 1040-28 bytes, then the address, but that did not work.

  • Well that doesn't sound right if you can control EIP after 1040 bytes and try to insert the shell code after 1012 bytes. Shell code is not insert in EIP but in ESP. The instruction pointer, points to the next memory address that will be executed by the program. – Jeroen Mar 22 '18 at 21:46
1

The goal here is to make eip point to your shellcode. There are many ways to do that. The first thing would be to check if your shellcode is placed in a register. If that happens then you can perform a ret2reg (return to register) by finding a gadget that will let you return to that register (like call reg etc...). Another way would be to use a nopsled - but that is not that stable. In that case your payload could be like:

nops + shellcode + (1040 -len(nops+shellcode))*"A" + pack32(a_nop_address)

Have in mind though, that the "a_nop_address" from the above payload changes inside gdb and will not be stable in case aslr is enabled. All the above ways assume that your stack is executable of course. Another way is also to use a shell variable that will contain your shellcode and then make eip point to that address. Finally, there are also more advanced methods, like ret2libc, ret2plt, ROP etc..., that do not even use a shellcode to pop a shell and can also help to bypass some security mitigations like aslr and non-executable stack.

  • Also, instruction to jmp to registers if they get overwritten can be used as return address too – Tryna Learn Somethin Aug 20 '18 at 0:14
  • @TrynaLearnSomethin yes, of course I agree, that's the classic example actually that can be found in most blog posts, I just didn't want to get into much detail since I think is out of the answer's scope... – game0ver Aug 20 '18 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.