0

I just don't understand how ESP points to the shellcode

let's say we've sent this string

string = 100 * 'A' + 'BBBB' + 'CCCC'

I have filled the stack with 'AAAA..' and overwritten the EIP value and set it to 'BBBB' and I got the segmentation fault as expected, what I don't understand is when debugging the ESP points directly to 'CCCC', isn't the ESP pointing to the top of the stack, and we have already filled the stack with 'AAAA', shouldn't be ESP pointing to these AAAA?

Improve this question

1 Answer 1

Reset to default
2

The stack pointer (ESP on x86) moves up and down as the stack grows and shrinks. While you are correct that it likely should point to the beginning of your payload at time of overflow, it is possible that the stack is shrunk by the time you observe ESP pointing to your C's.

Specifically, during the function prologue (or leave instruction) before returning, the saved stack pointer from the previous frame is popped into ESP. It is likely that the tail of your payload overwrote this saved value and could explain what you are seeing if you are debugging at return-time.

Improve this answer
4
  • I'm sorry but that still did not make any sense to me, though when executing the ret instruction can we pop the EIP even though the buffer is full with AAA?
    – oussama mater
    Sep 5, 2020 at 20:35
  • @oussamamater yes, you can still pop the return address. This is the principal way you gain control of execution in a traditional buffer overflow, before stack protections were introduced. If you write enough AAAA bytes you’d hope to see EIP corrupted when the function returns.
    – David
    Sep 5, 2020 at 21:04
  • @oussamamater your follow up question doesn't make much sense to me; I just answered why the ESP is pointing where it is but this shouldn't affect your exploit.
    – multithr3at3d
    Sep 5, 2020 at 21:05
  • 1
    If the concept is hard to wrap your head around I recommend two actions, 1) read up on stack frames. 2) set a breakpoint in the debugger just before the call to the vulnerable function (strcat,coy,whatever), then step through the call. Take note of the ESP value before the call, once inside the call and as you step through the strcpy or whatever you can inspect how the stack is corrupted, however the control of EIP does not occur until after a ret and you can then compare the ESP address to the before the vulnerable strcpy call.
    – wireghoul
    Sep 7, 2020 at 2:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .