0

I just don't understand how ESP points to the shellcode

let's say we've sent this string

string = 100 * 'A' + 'BBBB' + 'CCCC'

I have filled the stack with 'AAAA..' and overwritten the EIP value and set it to 'BBBB' and I got the segmentation fault as expected, what I don't understand is when debugging the ESP points directly to 'CCCC', isn't the ESP pointing to the top of the stack, and we have already filled the stack with 'AAAA', shouldn't be ESP pointing to these AAAA?

2

The stack pointer (ESP on x86) moves up and down as the stack grows and shrinks. While you are correct that it likely should point to the beginning of your payload at time of overflow, it is possible that the stack is shrunk by the time you observe ESP pointing to your C's.

Specifically, during the function prologue (or leave instruction) before returning, the saved stack pointer from the previous frame is popped into ESP. It is likely that the tail of your payload overwrote this saved value and could explain what you are seeing if you are debugging at return-time.

4
  • I'm sorry but that still did not make any sense to me, though when executing the ret instruction can we pop the EIP even though the buffer is full with AAA? – oussama mater Sep 5 '20 at 20:35
  • @oussamamater yes, you can still pop the return address. This is the principal way you gain control of execution in a traditional buffer overflow, before stack protections were introduced. If you write enough AAAA bytes you’d hope to see EIP corrupted when the function returns. – David Sep 5 '20 at 21:04
  • @oussamamater your follow up question doesn't make much sense to me; I just answered why the ESP is pointing where it is but this shouldn't affect your exploit. – multithr3at3d Sep 5 '20 at 21:05
  • 1
    If the concept is hard to wrap your head around I recommend two actions, 1) read up on stack frames. 2) set a breakpoint in the debugger just before the call to the vulnerable function (strcat,coy,whatever), then step through the call. Take note of the ESP value before the call, once inside the call and as you step through the strcpy or whatever you can inspect how the stack is corrupted, however the control of EIP does not occur until after a ret and you can then compare the ESP address to the before the vulnerable strcpy call. – wireghoul Sep 7 '20 at 2:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.