Shellcode Injection
dhavalkapil.com
Shellcode Injection
1–10 of 17 posts
Re: Shellcode Injection
#2I must be missing something. If you can create an executable which is suid you already have root...
Re: Shellcode Injection
#3I must be missing something. If you can create an executable which is suid you already have root...
The scenario is someone else has set setuid on an executable which is vulnerable to buffer overflows.
Re: Shellcode Injection
#4Why "echo 0 | dd of=foo" and not simply "echo 0 > foo"?
Re: Shellcode Injection
#5The same author refers to another article of him, in which he explains the basics of buffer overflows quite nice.
https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/
Re: Shellcode Injection
#6Why "echo 0 | dd of=foo" and not simply "echo 0 > foo"?
echo 0 > foo //wont work with sudo ..
sudo echo 0 > foo //will fail ...
sudo sh -c 'echo 0 > file' //If you want echo with sudo
Re: Shellcode Injection
#7> ... -fno-stack-protector -z execstack
Does anyone know how common stack protector is in the wild?
Re: Shellcode Injection
#8> ... -fno-stack-protector -z execstack Does anyone know how common stack protector is in the wild?
Depends on which distributions patch gcc to enable it by default. From what I'm aware, a lot of them do, though.
Re: Shellcode Injection
#9> ... -fno-stack-protector -z execstack Does anyone know how common stack protector is in the wild?
Fedora 20 comes with fstack-protector-strong .. so does ubuntu arch openbsd/freebsd etc .
Re: Shellcode Injection
#10Almost every program nowadays is compiled with W^X (--no_execstack) by default which means the memory is not executable and writable at once (Windows equivalent is DEP). Still a good example of how a basic overflow can lead to arbitrary code execution. A follow-up post using ROP or return-to-libc would be interesting, with W^X enabled.