0

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on Windows XP.

I have success when I sent a shellcode of ~15 bytes to attack my own TCP home server. (Designed by myself). The attacked buffer is 20 bytes length.

I have taken precaution to send trash bytes to fill spaces and to override EBP, and attach a hardcoded address reversed to little endian.

But when I sent the same shellcode, but for attack a more bigger buffer above 20-30 bytes, It fails, jumping to a unknown ret addr.

Is compiler changing stack variables order??? I have write first small buffer, and after it a larger buffer. I have changed with a constant proportion the two to be able to fit shellcode.

Is compiler changing order, putting EIP or EBP in another place of stack?? I have disable compiler protections of TCC compiler and siabled system protection such DEP and ASLR.

I can provide more info if it's necessary, including short code fragments, if you ask me for them.

EDIT 1:

Here my target TCP server code in pastebin-like site:

http://tny.cz/57f36e2e

Here my exploit:

http://tny.cz/dc9295ba

EDIT 2:

Can aligment affect my exploit??? I have no many skills in this area. I have choosed values multiply of 4 (32 bits). I think that it could no affect, can somebody clarify me???

EDIT 3: I have discovered than a slighly modified shellcode doesn't work, but a smaller do it. FASM.

THIS NOT WORK:

use32

mov eax, 0xDEADBEEF
mov ebx, 0xDEADBEEF
mov ecx, 0xDEADBEEF
mov edx, 0xDEADBEEF
int3

THIS WORK:

mov eax, 0xDEADBEEF
mov ebx, 0xDEADBEEF
mov ecx, 0xDEADBEEF
int3

Why the first, doesn't work??? I have filled remainder space in buffer with trash. It doesn't look to have null bytes.

  • 2
    I'm not sure how we can possibly answer your question with the info you have provided. – schroeder Jan 4 '15 at 1:16
  • @schroeder I am rewriting my question. Please look it. – Dean Winchester Jan 5 '15 at 1:28
  • 1
    You might need to adjust esp before execution your shell code. Try putting a \xCC as the first byte of your shellcode and exectu the exploit with the debugger attached. It should let you validate your shellcode in memory and step through the execution – wireghoul Jan 5 '15 at 4:52
  • Providing pastes of the code you're using for your example server and your exploit would probably be the most helpful thing for us to understand what you're trying to ask. – Jeff Ferland Jan 5 '15 at 5:28
  • to wireghoul: Is int3 a char value?? Can it cause me problems?? I have exploiting using strcpy. @JeffFerland Please, look my question again, I have updated it with links to my code in pastebin-like sites. – Dean Winchester Jan 5 '15 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.