Category Archives: buffer overflow

Given extensive protections in modern operating systems that make buffer overflow exploits unfeasible, should I even bother studying these?

Posted on by

I’ve been diving into the world of buffer overflow vulnerabilities and their exploitation, which has been both challenging and fascinating. However, I’ve recently hit a mental roadblock and would love to get your insights.
With modern oper… Continue reading Given extensive protections in modern operating systems that make buffer overflow exploits unfeasible, should I even bother studying these?→

How should be set an unprotect environment on modern linux to test an old buffer overflow example?

Posted on by

Reading a technical paper on the issue I wanted to test it on my computer.
The idea is to provoke privilege escalation (change on the whoami output from peter to root) through a buffer overflow.
The example is quite old, so I guess actual … Continue reading How should be set an unprotect environment on modern linux to test an old buffer overflow example?→

Segmentation fault without rip even getting overwritten Buffer Overflow

Posted on by

I was trying to overflow the return pointer of a simple program. I have asrl disabled and I compiled like this gcc returnexp.c -o returnexp -fno-stack-protector.
(I would disable noexecstack later on when I could overwrite the pointer)
Bu… Continue reading Segmentation fault without rip even getting overwritten Buffer Overflow→

Jump-Oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another?

Posted on by

Jump-oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another functional gadget?
My understanding of JOP:
In jump-oriented programming (as described in e.g. … Continue reading Jump-Oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another?→

Jump-Oriented Programming: Harder than ROP because the registers need to be prepared individually? + Turing complete, but large overhead/slow?

Posted on by

Full title: Jump-Oriented Programming: Is it harder than traditional return-oriented programming because you need to manually prepare all the addresses and registers or is there a different reason?
And does that mean that a large percentag… Continue reading Jump-Oriented Programming: Harder than ROP because the registers need to be prepared individually? + Turing complete, but large overhead/slow?→

When gets reads a string, it does not read \x00, which is the NULL character. So how to separate two different addresses to complete ROP?

Posted on by

First I used ROPgadget to find two assembly instructions:
xor rax; ret and pop rcx; ret,
They are at 0x401270 and 0x40133b.
Then I tried to put them at the top of the stack, but because the gets instruction does not read the \x00 character… Continue reading When gets reads a string, it does not read \x00, which is the NULL character. So how to separate two different addresses to complete ROP?→