Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG;
I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this possible if the stack is not executable?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
That's surely because you are not executing anything in the stack. Without the binary in question, I will try to guess what is happening here.
With the first
print "A"*268 + '\x68\x96\x04\x08' you are probably overwriting a pointer to point to
0x08049668. This address is probably a GOT entry for a function called later like
Then, in the second argument you specify the value that the pointer is pointing to. In other words, you overwrite that GOT entry (
0x08049668) with your shell code address (
So, when the program calls that shared library function (
whatever(), ...), your shell code will be called instead, because it has been overwritten.
In this process, no code is put in the stack. A pointer in the stack is overwritten. That's all. Then you use that overwritten pointer to overwrite a shared library function address with the shell code address.