Hot answers tagged

3

Short answer: yes. Long answer: Instructions on x86 processors vary in their length between 1 and many bytes. (This works because no instruction can be a prefix of another instruction. Much like phone numbers. See this guy for the theory behind it.) The CPU sees everything as bytes and does not know what the compiler intended, so if you point the ...


2

You should be able to write to any writable page (unless the address contains some bad byte that the input vector will use as a delimiter or filter out). 0x80e9d60 is one such writable region. There is nothing inherently wrong with the address 0x080ea6a0 (which lies in main_arena) that you are using either. When you are executing int 0x80, the relevant ...


1

In the end, it turns out that I was making an elementary mistake. Prefixing my shellcode with a NOP sled ended up successfully exploiting the remote instance of the vulnerable application.


1

Yes, there is a range, and you can determine that range trivially for any running process. Read a given process' /proc/<pid>/maps to see its memory layout, as well as the type of memory in each address range. This is described in proc(5). A sample from an embedded device: root@UP-7197:~# cat /proc/self/maps 00400000-0044b000 r-xp 00000000 1f:02 944 ...


1

Looks like it was added: https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted as a return.


1

Is there some reason you need to leave the original process alive when your shellcode executes? Just call execve directly (assuming you can control the stack well enough), or one of its helper functions, which will turn the current process into your target process. A trickier approach that might work is to use dlsym to retrieve a pointer to system, which ...


1

Using print 'system@plt' is only valid if the program already has an existing function (called or not) that directly references system(). In your example that's not the case. First, disable library randomization if you haven't done so ulimit -s unlimited In GDB Set a breakpoint at main Run the program. print system That gives you the address for ...


1

There are a few points to note: 1. The strcpy function stops copying stuff into the destination buffer as soon as it encounters a NULL byte. A NULL byte is 0x00 or \x00. In 64-bit machines, the length of an address is 8 bytes. Let us consider pop_rdi_ret = 0x00000000004005cb. This has NULL bytes. So, as soon as strcpy encounters the first NULL byte(the ...


Only top voted, non community-wiki answers of a minimum length are eligible