Thirteen Years of Service
Posts: 340
Threads: 6
RE: Buffer overflow on a vulnerable C program. 07-22-2013, 10:35 AM
#13
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
•
Thirteen Years of Service
Posts: 340
Threads: 6
RE: Buffer overflow on a vulnerable C program. 07-22-2013, 10:35 AM
#14
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
•
Thirteen Years of Service
Posts: 340
Threads: 6
RE: Buffer overflow on a vulnerable C program. 07-22-2013, 10:35 AM
#15
Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)
•
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: Buffer overflow on a vulnerable C program. 07-24-2013, 04:18 PM
#16
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
•
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: Buffer overflow on a vulnerable C program. 07-24-2013, 04:18 PM
#17
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
•
Thirteen Years of Service
Posts: 1,185
Threads: 62
RE: Buffer overflow on a vulnerable C program. 07-24-2013, 04:18 PM
#18
This is very interesting and well-made indeed.
Maybe you would like to mention that that code is Perl, some people might think it is PHP as it is now.
•
The explanaition should be about the C gets() vulnerable function
