Stack buffer overflow exploitation
Stack buffer overflow exploitation
This domain tests converting a confirmed stack overflow into reliable EIP control on Win32 x86: finding the exact offset, surviving a restricted character set, and landing execution inside your payload.
Core rules
- Offset to EIP is the distance from buffer start to the saved return address. Find it with a cyclic pattern and its matching lookup, never by guessing.
- After the epilogue runs
leave; ret, ESP points just past the overwritten return address - the classic landing zone for shellcode placed immediately after the address dword. - Prefer a
jmp esporpush esp; retgadget inside a module whose base is stable for the target build, so the address you write is static. - Enumerate bad characters by sending bytes 0x01 through 0xFF through the same input path and diffing the memory dump against what you sent.
Worked example
A strcpy overflow has 268 bytes to EIP. Layout: 268 filler bytes, then the jmp esp address, then shellcode. Reasoning: when ret fires, EIP becomes the gadget address and ESP equals the address of the dword immediately after that slot - so jmp esp transfers control to the bytes following the address. If the jmp esp address contains 0x00, strcpy stops copying there and you never reach the shellcode; pick a gadget in another module. Verify with a breakpoint on the gadget that ESP lands on the first byte of your payload before committing.
Traps that cost marks
- An off-by-one offset from mismatched pattern generation and lookup lengths.
- Forgetting the return address must be null-free for string-based overflows, and newline-free if the path is line-oriented.
- Assuming ESP points at the start of the buffer rather than after the return address.
- Ignoring limited stack space past the gadget; a
sub esp, N; retredirect is only useful when the payload actually fits in the region you jump to.