New answers tagged

2

I think the standard, at least back in the 90's was "Smashing the stack for fun and profit" from phrack magazine.


44

Douglas gives a correct answer. Not all buffer overflows give code execution. However, I felt it was missing a very important caution. Even if a buffer overflow does not allow arbitrary code execution, that does not mean that it is safe. A write buffer overflow lets you write to data that you are not supposed to. That data being a function address is just ...


68

No, a buffer overflow might: Be against a buffer on the heap not the stack. This might still lead to code execution but will be much more complicated to exploit. Be limited in size, so not able to overwrite return pointers. (e.g. be able to only write 1 byte beyond the buffer) Be restricted in which bytes can be written, preventing suitable pointers to be ...


1

The issue you are having could also be because of a bad character in your exploit code. For instance, null\x00, line feed \x0A, carriage return \x0D, and form feed \xFF can make an exploit fail. It will be easy to spot in your debugger when you watch the stack, if this is the cause.


1

Example if we examine the location of a function which prints the secret we want to leak: (gdb) p &print_secret $2 = (void (*)()) 0x55555555473a <print_secret> (gdb) Quit In the above scenario we are lucky that the hexadecimal location (55555555473a) can be written as UUUUG: and backwards because it is little-endian computer: $ ./main $(python -...


0

Your assumption is correct. The issue is with the logic in the for() loop. if you run the following code you will find it runs beyond the value of C in the exercise provided. I have added notes for you in the requirements of the exercise. main() { unsigned char b[1500]; unsigned char a[50]; unsigned char C; int i; bzero( (char *)b , 1500); /* lets fill ...


2

1) m s +-----------------+-------------------------------------+ |AAAAAAAAAAAAAAAAA| | +-------------------------------------------------------+ ^ ^ | | + + src dest If m contains exactly 100 bytes and is not null-...


0

If you've disabled ASLR (and checked that it's really disabled), you may be running into a canary. Disable it using the -fno-stack-protector flag: gcc my.c -o my -fno-stack-protector


Top 50 recent answers are included