2

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; enter image description here

I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this possible if the stack is not executable? enter image description here

1

That's surely because you are not executing anything in the stack. Without the binary in question, I will try to guess what is happening here.

With the first print "A"*268 + '\x68\x96\x04\x08' you are probably overwriting a pointer to point to 0x08049668. This address is probably a GOT entry for a function called later like printf() or exit().

Then, in the second argument you specify the value that the pointer is pointing to. In other words, you overwrite that GOT entry (0x08049668) with your shell code address (0xbffff891).

So, when the program calls that shared library function (exit(), printf(), whatever(), ...), your shell code will be called instead, because it has been overwritten.

In this process, no code is put in the stack. A pointer in the stack is overwritten. That's all. Then you use that overwritten pointer to overwrite a shared library function address with the shell code address.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.