OSED flashcards
OSED · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- checksec
- A tool that reports binary mitigations: NX/DEP, stack canary, PIE, RELRO, and ASLR status. Run it before analysis to plan the exploit strategy.
- Saved return address offset
- Distance from the start of an overflowed buffer to the saved EIP/RIP. Computed as (saved EBP/RBP - buffer address) + pointer size (4 on x86, 8 on x64).
- Stack canary prologue
- On x64, the canary is loaded from fs:0x28 at function entry and checked before return; a mismatch calls __stack_chk_fail and aborts. On x86 it is gs:0x14.
- Cross-reference (xref)
- A reverse-engineering view showing all locations that call or reference a function or data address. Used to trace user input to a vulnerable sink.
- Dangerous string functions
- Functions like strcpy, strcat, sprintf, gets, and scanf %s copy unbounded input. Their presence in a binary is a strong indicator of a stack or heap overflow.
- Cyclic pattern offset
- A non-repeating byte pattern (e.g., De Bruijn sequence) placed in the input; after a crash, the value in EIP/RIP maps to the exact offset in the pattern.
- ret2win
- Overwriting a saved return address with the address of an existing function (e.g., a flag printer or win function) to redirect execution without shellcode.
- ret2libc chain
- A ROP chain that calls system('/bin/sh') by returning into libc. On x64: pop rdi; ret; binsh; system. Requires a libc base leak to defeat ASLR.
- Stack alignment (x64)
- The System V ABI requires RSP % 16 == 0 at a call instruction. Misalignment causes movaps crashes; insert a single ret gadget before the call to fix it.
- Off-by-one overflow
- A copy that writes one byte past the buffer, often a null terminator. Can corrupt the low byte of a saved frame pointer, enabling a stack pivot via leave; ret.
- NOP sled
- A sequence of no-operation bytes before shellcode. It increases the landing zone so a return address does not need to be exact, improving reliability.
- GOT overwrite
- Overwriting a function's entry in the Global Offset Table with a controlled address, hijacking execution when that function is called. Works when RELRO is partial or disabled.
- Call-pop shellcode
- A position-independent technique: call $+5 pushes the next instruction address, then pop reg retrieves it. Used to reference embedded strings without hardcoded addresses.
- Null-byte-free shellcode
- Shellcode with no 0x00 bytes, required when input is treated as a C string. Achieved via xor reg,reg; mov al,imm; push/pop sequences and tested with an encoder.
- Linux x86 execve shellcode
- Sets eax=11, ebx=pointer to '/bin/sh', ecx=0, edx=0, then int 0x80. The string is pushed onto the stack in little-endian order.
- Linux x64 execve shellcode
- Sets rax=59, rdi=pointer to '/bin/sh', rsi=0, rdx=0, then syscall. The string is pushed as a 64-bit immediate in little-endian order.
- PEB shellcode (Windows)
- Windows shellcode resolves API addresses by reading the Process Environment Block, walking the module list (Ldr), and parsing each module's export table for function names or hashes.
- Staged shellcode
- A small first stage that allocates executable memory and reads a larger second stage into it, then jumps to it. Keeps the initial payload small for size-limited inputs.
- Alphanumeric encoder
- Transforms shellcode so every byte is in [0-9A-Za-z]. Used when input filtering rejects non-alphanumeric bytes; adds a decoder stub at the start.
- Shellcode test harness
- A small C program that mmaps RWX memory, copies the shellcode bytes, and calls the buffer. Verifies shellcode independently before embedding it in an exploit.
- DEP/NX
- A mitigation marking stack and heap non-executable. Bypassed with ROP, ret2libc, or mprotect/VirtualProtect calls that re-enable execute permission on a buffer.
- ASLR
- Address Space Layout Randomization randomizes base addresses of stack, heap, libraries, and PIE binaries. Defeated by an information leak or partial overwrite.
- Partial overwrite
- Overwriting only the low 1-2 bytes of a saved return address to redirect within the same 4KB/64KB region. Bypasses ASLR without needing a leak.
- ret2plt
- Returning into a PLT stub to call a library function without knowing its absolute address. Useful when the binary is non-PIE but libc is randomized.
- ret2dlresolve
- A technique that abuses the dynamic linker to resolve an arbitrary symbol at runtime, avoiding the need for a libc base leak. Requires a writable memory region.
- Canary leak
- Disclosing the stack canary value via format string or out-of-bounds read, then including it in the payload so the check passes after overwriting the return address.
- Full RELRO
- Makes the GOT read-only after relocation, preventing GOT overwrite attacks. Partial RELRO leaves .got.plt writable and is exploitable.
- PIE
- Position-Independent Executable: the main binary base is randomized like a library. Requires a code leak to compute gadget addresses; without one, target non-PIE libraries.
- %n format specifier
- Writes the number of bytes printed so far to the address pointed to by the corresponding argument. %hn writes 2 bytes, %hhn writes 1 byte.
- Direct parameter access
- Syntax %N$p or %N$s reads the Nth argument directly. %N$s dereferences it as a char* and prints the string at that address, forming a read primitive.
- Format string offset discovery
- Send AAAA%p.%p.%p... and locate 0x41414141 in the output. The index where it appears is the stack argument position of your buffer, used for %N$n writes.
- GOT leak via %s
- Use %s with a pointer to a GOT entry (e.g., printf@got) to print the resolved libc address. libc base = leaked address - known symbol offset.