[Oni]

This is awfully specific, for such a general title. I'd argue that this has little to do with hacking and more with basic Linux usage. Like @misnar I also prefer nano much more. vim does have its benefits, though.

[Alan Turing]

Not really related to hacking like @Oni said, more *nix usage, even that's not too much detail because there's literally a clusterfuck ton of commands that could be helpful for pentesting.

---

Also, for the auditing it'd be cool if it weren't like the same classic buffer overflow with the strcpy() function, seems to be a ton of those.

[Adorapuff]

Not really related to hacking like @Oni said, more *nix usage, even that's not too much detail because there's literally a clusterfuck ton of commands that could be helpful for pentesting.

---

Also, for the auditing it'd be cool if it weren't like the same classic buffer overflow with the strcpy() function, seems to be a ton of those.

memcpy() is cool because you have to avoid null bytes in the attack vector, so you need to to point eip to the address of a jump esp that has no null bytes in a dll and make a payload without null bytes.

[superMAUS]

Not really related to hacking like @Oni said, more *nix usage, even that's not too much detail because there's literally a clusterfuck ton of commands that could be helpful for pentesting.

---

Also, for the auditing it'd be cool if it weren't like the same classic buffer overflow with the strcpy() function, seems to be a ton of those.

Definitely agree, but hacking is very much about programming and *nix usage (any os usage for that matter). If you cant do the above there is not much point `hacking`. Its also just a step for beginners.

Also in regards to the auditing, don't worry because I'm heavily basing it off king copes guide which is great.

---

This is awfully specific, for such a general title. I'd argue that this has little to do with hacking and more with basic Linux usage. Like @misnar I also prefer nano much more. vim does have its benefits, though.

If you cannot program or you cannot utilize Linux outside of hacking then are very unlikely to excel.

[Alan Turing]

memcpy() is cool because you have to avoid null bytes in the attack vector, so you need to to point eip to the address of a jump esp that has no null bytes in a dll and make a payload without null bytes.

You can't have any nullbytes in any payload period. All you do is XOR the registers.

[superMAUS]

memcpy() is cool because you have to avoid null bytes in the attack vector, so you need to to point eip to the address of a jump esp that has no null bytes in a dll and make a payload without null bytes.

you cant ever have null bytes EVER or it will end the execution.

[Adorapuff]

you cant ever have null bytes EVER or it will end the execution.

That depends on the vuln function. Some vuln functions don't use null bytes to mark the end of execution.

[Alan Turing]

That depends on the vuln function. Some vuln functions don't use null bytes to mark the end of execution.

I think you're confused. We're talking about the payload, not the function you're exploiting itself.
Null bytes terminate. How do you expect to successfully exploit a function if only 1/3'd of the payload is sent?

/x94/x84/x00/x84/x34/x29/x94

Only /x94/x84 get sent.


The vuln function doesn't matter. Lets say strcpy() is one vuln function and memcpy() is the other, just because they're different or do different things doesn't mean that the payload can or can't have null bytes in it. That's basic and elementary when learning about payloads.

[3SidedSquare]

That depends on the vuln function. Some vuln functions don't use null bytes to mark the end of execution.

Let my try.

The attack vector is a way to get some code running on another computer

The payload is the actual code that runs.

If the process is going though the instructions, and hits a null byte, it stops.

I think you may have had the two mixed up

[superMAUS]

That depends on the vuln function. Some vuln functions don't use null bytes to mark the end of execution.

functions receive arguments. arguments are variables. variables end with a null byte.