For some time, I’ve been reading blogs about exploiting that seems now at last my time has come to change the role. In this blog I will publish posts as a workshop “from scratch” the exploiting, and additionally I try often bring examples of vulnerabilities (hereaf...
Project financed by the European Regional Development Fund (FEDER) of the European Union and the Junta de Castilla y León, through the Institute for Business Competitiveness of Castilla y León (ICE), with the aim of promoting the development of Information and Comm...
In principle it is already clear how we get control program flow leveraging a script out of bounds. Let’s see how the stack is for a function like yesterday
#include
Since 2000, operating systems began to support the NX bit and emulators of it. The PaX patch for Linux (who also includes ASLR), ExecShield (RedHat), W^X (OpenBSD and macOS) and DEP appear (from Windows to WinXP SP2). This protection is to distinguish memory pages ...
Today’s post is almost a continuation of a previous post. Because today we will bring the widespread ret2libc. Before starting, give a brief explanation of what is ASLR (_Address Space Layout Randomization_). It is a simple protection method that randomizes the ad...
Good afternoon, evening, or whatever it may be. Finally comes the awaited (?) Episode on attack base / frame pointer (EBP). Without further ado, let’s start function, even with two-way XDD (this is not in itself another preamble also???). So far, we have studied t...
Very good, this post is dedicated to a couple of, I think “techniques” might call, which can be interesting. The first is really important. This is the [**_integer overflow_**](http://phrack.org/issues/60/10.html). #### Methods 0x9c90928f939a929a918b9e8d96908c Fi...
This beautiful morning (I do not know what time you will read this) we will see in more depth the ASLR. ASLR (not ASMR) attends the words _Address Space Layout Randomization_. Is a technique that was designed at the beginning of the century with DEP/NX/W^X/ etc wh...
