+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Buffer overflow on a vulnerable C program. (/Thread-Buffer-overflow-on-a-vulnerable-C-program)
RE: Buffer overflow on a vulnerable C program. - Volatile - 07-22-2013
(07-21-2013, 04:14 PM)lady_godiva Wrote: More over, dll's first instruction is JMP ESP...
Are you sure about that?
On Win7 SP1:
Code:
kernel32: 76BF0000 > D9B6 4177CBB4 FSTENV (28-BYTE) PTR DS:[ESI+B4CB7741]
ntdll: 773D0000 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]I actually wasn't able to find any `JMP ESP` instructions in my entire disassembly. So I guess that is where `CALL ESP` becomes handy.
RE: Buffer overflow on a vulnerable C program. - Volatile - 07-22-2013
(07-21-2013, 04:14 PM)lady_godiva Wrote: More over, dll's first instruction is JMP ESP...
Are you sure about that?
On Win7 SP1:
Code:
kernel32: 76BF0000 > D9B6 4177CBB4 FSTENV (28-BYTE) PTR DS:[ESI+B4CB7741]
ntdll: 773D0000 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]I actually wasn't able to find any `JMP ESP` instructions in my entire disassembly. So I guess that is where `CALL ESP` becomes handy.
RE: Buffer overflow on a vulnerable C program. - lady_godiva - 07-22-2013
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
RE: Buffer overflow on a vulnerable C program. - lady_godiva - 07-22-2013
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
RE: Buffer overflow on a vulnerable C program. - lady_godiva - 07-22-2013
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
RE: Buffer overflow on a vulnerable C program. - noize - 07-24-2013
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
RE: Buffer overflow on a vulnerable C program. - noize - 07-24-2013
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
RE: Buffer overflow on a vulnerable C program. - noize - 07-24-2013
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
RE: Buffer overflow on a vulnerable C program. - lady_godiva - 07-24-2013
That could be a little bit confusing to tell the truth
The explanaition should be about the C gets() vulnerable function
RE: Buffer overflow on a vulnerable C program. - lady_godiva - 07-24-2013
That could be a little bit confusing to tell the truth
The explanaition should be about the C gets() vulnerable function