New answers tagged

1

A simple way to do this is by using an input of the following form 'a'*BUFF_SIZE + 'qwertyuiopasdfghjklzxcvbnm'. The return address will be overwritten by 4(Assuming 32 bit system) consecutive characters from this string. Run your program with this input and it will naturally give a segmentation fault. Use dmesg | tail to find the address where it jumped. ...


0

Here are two methods: 1. strings -t x -a /path/to/libc | grep "/bin/sh"--> this outputs the offset of the string in libc. 2. with pwntools: first define the libc with libc=ELF('/path/to/libc') libc_binsh=libc.search("/bin/sh\x00").next()


1

It worked for me. I was able to plant shellcode into the buffer and then overwrite eip to point to the shellcode within the buffer and execute shell. Hence, I disagree with @ndrix's answer. main() is still a function who's ebp and eip can be overflowed and thereby, control flow can be hijacked. I received multiple requests to share code, so I am happy to ...


1

It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature solutions. The exploit payload generator in Metasploit includes an encoding step which takes care of this: you tell it what characters to avoid and it builds a decoder ...


0

In recent versions of Windows 10, there's an "Exploit Protection" feature that allows controlling DEP on both a per-app and system-wide basis (the former overriding the latter). Use the Start search to find it. Make sure the access violation you're getting is actually due to DEP, and not due to trying to read (or write) memory that is not mapped to the ...


Top 50 recent answers are included