In famous buffer overflow tutorial by Corelan Team (part 2) a technique called "blind return" is mentioned.

So if you overwrite EIP with the address that will perform a RET instruction, you will load the value stored at ESP into EIP.

and further down

Overwrite EIP with an address pointing to a ret instruction
Hardcode the address of the shellcode at the first 4 bytes of ESP

I don't get the advantage of this approach. You need to hardcode the address XXXX at the start of the shellcode (ESP). Wouldn't it be easier just to overwrite EIP with XXXX directly to get the same effect?


By overwriting eip do you mean to directly overwrite ret address or fill the stack with some buffer

Because usually when there is a stack without canary and a bof present you can basically fill the buffer with nop+shellcode+addrof buff (generally on stack or some writable memory)

So the eip points to the address of the buffer on stack and hence the shellcode in buffer would be executed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.