I have been practicing buffer overflows for a little while. However, I came across a solution which works - but I'm not quite sure why. I have tried to read about the different instructions, such as JMP ESP and CALL ESI - but I don't fully understand. So the problem is as followed:

enter image description here

There is a FTP server which crashes while fuzzing. The exact offset value is 2008 bytes (PCman FTP). I am used to execute a buffer overflow as the first example above: Junk + EIP (JMP ESP) + NOP sled + Shellcode. This has usually been done on a Windows XP. It has always worked - and I get my shell.

enter image description here

However, I found an interesting solution from this exploit: https://www.exploit-db.com/exploits/44596

I tried to execute everything according to the image above: and it worked. I got my reverse shell. This is on a Windows 10 machine. The problem is: How exactly does this work? I've been trying to read about CALL ESI and how it "jumps to the beginning of the stack", but I really don't understand how and why this works. Does my payload get executed and then return the stack "back to normal"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.