Questions tagged [stack-overflow]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4
votes
1answer
67 views

How are stack canaries padded by unmapped pages?

I was reading the wikipedia article on this subject and it states that when a program starts, the canary is calculated at random, stored in a local variable(which I presume was introduced by the ...
1
vote
2answers
109 views

In Return-Oriented Programming how can the machine execute unaligned instructions?

I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)". The author claims that x86 code is like English written without punctuation or spaces, ...
2
votes
1answer
212 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
1
vote
1answer
122 views

What is Return-Oriented Programming? [closed]

With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack ...
0
votes
0answers
24 views

Stack overwriting/overflow protection using memory page flags

In a stack overflow/overwriting attack(which primarily either executes code written to stack or changes flow of program by changing return address), the defenses seem to be marking stack code as "data"...
1
vote
0answers
84 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
2
votes
2answers
674 views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
3
votes
1answer
128 views

Smashing stack in x86_64

Exploiting functions like strcpy() relies on the fact that the payload string must not contain zero bytes that would terminate the copy function. If the payload contains x86_64 addresses (e.g. in ...
4
votes
2answers
473 views

How does gcc compiler guard stack for stack overflow?

When we compile c program with gcc, we have to inlude "-z execstack" option to enable stack overflow attack. The question I want to ask is how does gcc implement this . Without this option, how does ...
2
votes
2answers
871 views

Why do we need to remove null bytes from shell code?

I'm studying the basics of making shell codes. I have a question about it. In my textbook, the author stores his shell code in an environment variable, and injects the address of it using strcpy() ...
1
vote
2answers
400 views

Buffer Overflow Stack Attack Exercise Help

So I am trying to complete a buffer overflow exercise. The code I am trying to exploit is below. What I want to be able to do is to insert my own print statement through the overflow attack. What I ...
2
votes
1answer
431 views

How do I bypass a return address overwrite not doing anything?

This is main: (gdb) disass main Dump of assembler code for function main: 0x000000000040057c <+0>: push rbp 0x000000000040057d <+1>: mov rbp,rsp 0x0000000000400580 <+4&...
2
votes
2answers
505 views

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

General Background: I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such: // .... including the corresponding libraries depending ...
2
votes
1answer
87 views

Understanding a crash

Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash. My normal steps are: load application into a debugger ...
1
vote
1answer
244 views

Why do registers get overwritten upon overflow?

I know that upon a overflow, the stack gets partially overwritten, but I do not understand why registers such as EIP or RIP get changed in this process. How come some registers are modified by such ...
2
votes
1answer
829 views

Stackpivoting techniques

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that. The question is, during the writing ...
1
vote
1answer
844 views

Bufferoverflow - jmp esp. Do I need nops sled? Does call esp also work?

I'm learning about stack buffer overflow and I'd appreciate help. I'm exploiting simple web server containing this log function. Argument s1 is the input that I supply via HTTP. Server is running on ...
2
votes
2answers
117 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
0
votes
2answers
2k views

some vulnerable projects in C or C++ for a lecture

I'm looking for some real projects which have stack overflow vulnerabilities. The important thing is, I am going to teach finding the vulnerabilities and the way of fixing them by these examples. So, ...
3
votes
2answers
513 views

Hard-wired vs relative addresses in shellcode

This question is primarily in the context of arbitrary command execution in a buffer (e.g. stack) overflow. I read somewhere recently that hard-wired (absolute) addresses are not good for shellcode e....
6
votes
0answers
163 views

Using instruction set architecture (ISA) to stop stack overflows

I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our ...
6
votes
2answers
10k views

How is the stack protection enforced in a binary?

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. How is this encoded into the binary? (Can I see this info using readelf? ). Is it encoded into every page/...
4
votes
1answer
2k views

Exploit does not work outside GDB

I already tried various solutions provided to other "exploit doesn't work outside gdb" questions (r.sh, invoke.sh, removing environment variables) and at this point I legit have no idea why the ...
38
votes
3answers
11k views

How big is a canary word on Linux, typically?

A canary word is a sequence of bits placed at the boundary between a buffer (such as a stack) and control data in a program, as a way of detecting and reacting to buffer overflows. How many bits long ...
1
vote
1answer
76 views

Restoring the stack frame after payload is executed

Is it possible to restore the stack frame so that the EIP returns to the place that is was at(before the overflow) after a payload has been executed? If a stack frame is overflowed and the payload ...
6
votes
2answers
4k views

Why must a ret2libc attack follow the order "system(),exit(),command?

In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
2
votes
2answers
119 views

Can one prevent stack overflow by storing strings in memory backwards?

Normal use: ------(buffer)------ --(ret)--- DDDDDDDDEEEEEEEEEEEE EEEE FFFF 89ABCDEF0123456789AB CDEF 0123 this is a string\0 bff5 a400 Stack overflowed: ------(buffer)------ --(...
8
votes
4answers
5k views

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

I realize how a buffer overflow works but I have a problem understanding the direction in which the overflow is directed. So if the stack grows downwards, that means that the return address is above ...