I’d consider myself technical, but I’ve seen some of what others can do, so I’ll just call myself a dabbler.

  • 0 Posts
  • 3 Comments
Joined 11 months ago
cake
Cake day: December 6th, 2023

help-circle

  • @LainTrain The simplest case is overwriting the return address on the stack. If your stack layout looks like this (B for buffer, R for return address, A for function arguments):
    BBBBBBBBRRRRAAAA
    and you give a pointer to the first B byte to gets(), the input can overwrite the bytes of R.
    You can try this with a 32-bit program complied with disabled mitigations. Run the program in a debugger, break in the function, inspect the stack pointer value. With ASLR disabled the addresses will remain the same for every program execution assuming the call graph at this point doesn’t change. You can then overwrite the bytes of R with the buffer address (assuming no stack canary), and overwrite the buffer bytes with machine code instructions. When the function attempts to return, it instead jumps to the instructions you left in the buffer, and executes them (assuming no W^X).