0

In a buffer overflow exploit, when we use a JMP ESP instruction to jump to the ESP, instead of using the address of the JMP ESP, can't we use the opcodes of it?. I generated the opcodes of the JMP ESP instruction with mona in Immunity Debugger.

!mona assemble -s "JMP ESP"

Which was \xff\xe4

In my case, the offset where the program crashes is 204, and my payload looks like this.

payload_size = 4000

payload = b"".join([
    b"A"*204,
    p32(0x62501205),   # JMP ESP
    b'C' * (payload_size - offset - 4)
    ])

Here, instead of using the address where the JMP ESP instruction(0x62501205) is can't we use the instruction itself (\xff\xe4)? My final goal is to know if it is possible to use the opcodes of a function(JMP ESP in this case) instead of using the address of the function itself.

2
  • Did you understand why and how the exploit work with the address of the jump?
    – St0rm
    Sep 24, 2021 at 17:58
  • Yes, I think so. After the JMP ESP is executed, whatever we put at the ESP (C buffer) gets executed. So my question is can we use the opcodes of the JMP ESP instruction instead of the address of it? Sep 24, 2021 at 18:01

1 Answer 1

1

The address 0x62501205 override EIP that's why it works with the address of the instruction JMP ESP.

Using the opcode:

It will not work with the opcode \xff\xe4 as only the two lowers bytes of EIP will be overwritten and the value of EIP will be: 0xXXXXffe4 (XXXX for the 2 High unknown bytes).

If the address exist, the content (instruction) of this address will be executed else the program will crash.

Using the address of JMP ESP:

In this case EIP will be overwritten with the value of ESP (let's suppose that it contain the address of the buffer 'C' * (payload_size - offset - 4) ) which will lead to execute the instructions on the stack: C = 0x43 = INC EBX.

I think that debugging step by step both exploits, with the address of the jump and with the opcode, could help to better understand how it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.