First Exploit! Buffer Overflow with Shellcode - bin 0x0E

preview_player
Показать описание


-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#BufferOverflow #BinaryExploitation #Shellcode
Рекомендации по теме
Комментарии
Автор

This guy is one of those guys I listen to in normal speed

enesozdemir
Автор

Hahaha you just broke my brain with the NOP Slide vine and the comment: "Riiight, a NOP-Slide." It's like you injected an INT3 into my brain's stack. I can't process stuff anymore. Perfect comedic timing, Hahaha

boomfist
Автор

0:56 so do i put on two wizard's hats?

luckyluke
Автор

This episode was pretty hard for me. I always firstly watch episode and make notes, and after that I try it for myself. I had big difficulties executing shellcode outside gdb, after like 1h putting it on different positions, I had finally got it work by making more nops and picking deeper address. What a nice feeling when it finally put me in root privileges.

ChuZZZta
Автор

Just a little reminder, at 8:18 he's adding 30 as a decimal value to the address. I was wondering why I still got an 'illegal instruction' message, until I checked in dbg only to see that it added 30 as a decimal value and not as hex. This resulted in my offset being to small and not hitting in the NOPs. Using 'eip = struct.pack("I", <address> + 0x30)' resolved this issue and I got the 'Trace/breakpoint trap'. When you get your head around this stuff it's really fascinating. Thanks for the great videos!

MyTokyodrift
Автор

Implemented the exploit on the buffer and got stuck for longer than I'd like to admit. One thing I learned the hard way: Make sure that your exploit instructions don't start overwriting themselves through stack "push" shortening the noop-slide and adding more padding after the exploit instructions fixed things.
I now understand why @LiveOverflow chose to traverse the stack in the "opposite" direction. That made things considerably easier. Long noop-slide, no worries about shell-code-self-destruction and generally less space-restriction for the exploit.


Absolutely great content!

eXecue
Автор

Instructions unclear, ran out of wizard hats!

LQ
Автор

After watching this i have been discouraged to want to learn about computers. This intimidated the shit out of me, the level of understanding and knowledge you guys have is incredible!

racoonrotary
Автор

As you mentioned, the stack can be unreliable, and even though you use "unset env" in gdb, you can have some trouble.
You can use set exec-wrapper in gdb to ensure that the program run with env -i.

(gdb) set exec-wrapper /usr/bin/env -i

Thanks a lot for all your work, I'm learning a lot.

MrEzork
Автор

@10:55 you absolute legend, that's same thing has been stumping me for weeks. I tried similar commands but didn't think of putting in brackets. Thanks!

Escarii
Автор

That last 30 seconds is very tricky/clever. Thanks for including it. I would have been stuck for a long time... :)

JohnSmith-hexg
Автор

Holy crap, took me 2 tries (messed up my nop slide) but the feeling when I typed "whoami" > root was SO worth it!
Thanks man, thanks a lot.

redgek
Автор

This was a great intro to buffer overflows. It was a bit little challenging to get working on modern 64bit Linux system, but finally figured it out. It would be really cool to see an updated video on this. Keep up the good work man!

xOoOverflw
Автор

I was shocked that my left speakers stopped working after hearing your intro. Damn they are my new ones :O

drtyharry
Автор

I think I just fried my brain, this was so intense for me, but I got it working in the end, so worth!

sweet-sinner
Автор

Wow, I’ve been following your channel for quite a while and just stumbled upon this vid now. Have to say this is a great companion for my current course in x86 asm since the content ties everything I learned so far together and from a very practical POV too. Thanks for the great content as always!

aaaaanh
Автор

INFORMATION OVERFLOW



too much info and stuff happening. i will watch again few days later after doing some googling

silverzero
Автор

I like your pronunciation is very clear to understand and how you explain is awesome.

alegerminal
Автор

I had a different memory address and had to add 64 to my stack for me to get Trace/breakpoint trap to work

alexsepelenco
Автор

3:37 op code "\xCC" (INT3)
8:09 NOP sled
9:03 shellcode database
10:27 shell without input

helloworld