OSEE flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

EIP offset calculation

Send a cyclic pattern of unique 4-byte values; the value found in EIP at crash reveals the byte offset. Verify by placing a known marker at that offset and re-triggering the crash.

Bad character enumeration

Send all 256 byte values to the target, then compare the memory dump against the sent sequence. Bytes that are missing, truncated, or altered are excluded from the final payload.

JMP ESP technique

Overwrite EIP with the address of a JMP ESP instruction so execution returns into the buffer containing shellcode. Requires a non-ASLR module with executable and stable address.

Egghunter

A small position-independent routine that scans process memory page by page for a unique 8-byte tag, then jumps to the tagged shellcode. Used when the overflow buffer is too small for the payload.

SEH overwrite

Overwrite the structured exception handler pointer on the stack. Place a short jump in the next-SEH field, overwrite the handler with a POP POP RET gadget, then trigger an exception.

Stack pivot gadget

A gadget such as leave;ret or xchg esp,eax that moves the stack pointer into attacker-controlled memory. Enables exploitation when the direct overflow space is too small.

Return-to-libc

Overwrite the saved return address with the address of system(), followed by a fake return address and a pointer to the string /bin/sh. Defeats non-executable stack without ROP.

ROP chain construction

Chain gadgets that each end in ret; each gadget consumes stack slots in order. Use pop rdi;ret and similar to set arguments, and ret2csu when no pop gadget exists.

ASLR and PIE defeat

Leak a libc or module address via an info leak, subtract the known offset to obtain the base, then compute system, one_gadget, or gadget addresses. PIE requires a separate code-base leak.

Heap overflow

Corrupt adjacent chunk metadata such as the size field or fd/bk pointers in the unsorted bin to gain arbitrary write via unlink or tcache poisoning. Modern glibc adds safe-linking.

Format string exploitation

The %n specifier writes the number of bytes printed to a pointer argument. Positional specifiers like %<n>$n and %<n>$s read and write arbitrary memory from the stack.

Integer overflow

A signed/unsigned mismatch or truncation in a length check, such as malloc(len+1) with len=0xFFFFFFFF, produces an undersized allocation followed by an oversized copy.

Off-by-one null byte

Overwrite the low byte of an adjacent chunk's size field with a null byte to extend a chunk into the next, creating overlapping chunks and controlled writes.

Shellcode encoding

Alphanumeric or XOR-encoded payloads bypass bad-character filters. The decoder stub must be position-independent and must not contain the forbidden bytes itself.

Mitigation check order

Identify stack canary, NX, PIE, RELRO, ASLR, and CFG before choosing a technique. A canary leak requires a format-string or info-leak primitive.

Kernel exploitation

Ring-0 code execution via commit_creds(prepare_kernel_creds(0)) in a ROP chain, or by overwriting modprobe_path to execute an attacker-controlled binary.

Crash triage

EIP control indicates a stack overflow; EAX or ECX control indicates an indirect call or write-what-where primitive; heap corruption often appears as an abort in malloc or free.

Symbol resolution in gdb

Use info proc mappings, vmmap, and x/i $eip to find module base and gadget offsets. Rebase static addresses by adding the runtime module base.

Fuzzing workflow

Mutate inputs with AFL++ or libFuzzer and triage with ASan and UBSan to catch memory errors before they become exploitable crashes. Crashes feed back into offset calculation.

Patch diffing

Compare vulnerable and patched binaries with BinDiff or Diaphora to locate the fix. The changed condition reveals the vulnerable input path and the exact check to bypass.

x86-64 calling convention

Arguments are passed in rdi, rsi, rdx, rcx, r8, r9. The return address is at rsp, the canary sits before the saved rbp, and rsp must be 16-byte aligned at call.

Exploit reliability

Account for ASLR entropy, stack alignment, and environment size shifts when computing offsets. Local and remote targets often differ in environment length and library versions.

ret2dlresolve

Forge a fake Elf64_Rela and symbol table entry to resolve system() at runtime without a libc leak. Requires writable memory and a known PLT0 address.

GOT overwrite

Partially or fully overwrite a GOT entry such as printf@got with a gadget or system address. Requires a write primitive and known addresses; full RELRO blocks it.

Stack canary bypass

Leak the canary via format string or partial overwrite. On a forking server the canary is stable across connections, so one leak enables repeated exploitation.

SROP

Sigreturn-oriented programming sets rax=15 and triggers a syscall with a fake sigframe on the stack. The kernel restores all registers, including rip, from the frame.

CET and shadow stack

Hardware-enforced shadow stack detects return address tampering, breaking ret-based ROP. Use call-oriented programming, JOP, or data-only attacks instead.

Payload staging

A small stage-1 reads a larger stage-2 into memory, then jumps to it. Needed when the overflow buffer is too small to hold the full payload.

ROPgadget and ropper

Tools that search binaries for gadget sequences such as pop rdi;ret, syscall, leave;ret, and mov [reg],reg. Filter results by module and address range.

Pwntools workflow

pwn.cyclic computes offsets, pwn.remote connects to targets, pwn.ELF resolves symbols, and pwn.ROP builds chains automatically. Set pwn.context.arch to control endianness and packing.

Full RELRO constraint

Full RELRO makes the GOT read-only after relocation. Redirect exploitation to __free_hook, __malloc_hook, or FSOP targets such as _IO_2_1_stdout_ instead.

Tcache poisoning

Overwrite tcache_entry->next with a target address to return an arbitrary pointer from malloc. glibc 2.32+ safe-linking encodes the pointer as ptr ^ (chunk>>12), requiring a heap leak.

House of Force

Overwrite the top chunk size with -1, then request a chunk whose size moves top to target-0x10. Requires a heap overflow reaching the top chunk header.