Collaborate Disseminate
I am new to structured exception handling based exploits.
Why don’t we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH)
Can anybody explain the reason of using pop pop ret?
I read… Continue reading How does SEH based exploit bypass DEP and ASLR?
Here is some code:
#include <stdio.h>
#include <string.h>
char globalbuf[256];
void function(char *argv) {
char localbuf[256];
strcpy(localbuf, argv);
strcpy(globalbuf, localbuf);
printf(“localbuf a… Continue reading ASLR Randomization BSS
I was wondering if anyone could give me some clues on how “leaking pointers” to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is a situation where a value on the stac… Continue reading How "leaking pointers" to bypass DEP/ASLR works
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?