0

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn't run at that moment.

For example;

    #include<stdio.h>

    void ath_secuss()
    {
        printf("You have successfully logged in\n");
    }
    int main()
    {
         char password[10];
         gets(password);
         if(password=="password")
         {
             ath_secuss();
         }
    }

Can the hacker edit the return address to ath_sucess()? Also, does the return address allays in the end so we can check the data that coming in is not bigger then the ebx-1 register?

1

That code is a classic example of a buffer overflow vulnerability. Memory corruption is certainly possible in this case, but whether or not it's exploitable for remote code execution or arbitrary function calls depends on which exploitation mitigations are enabled within the binary and on the system, but generally it should be considered vulnerable code.

NX/DEP do not prevent ROP, since ROP relies on executing code that already exists in the program/libraries instead of attacker-supplied data on the stack/heap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.