Low Level Exploits - Packet Storm

More documents

Recommendations

Info

Creating Shellcode objdump -d ./exit 08048f14 : 8048f14: 55 push %ebp 8048f15: 89 e5 mov %esp,%ebp 8048f17: 83 e4 f0 and $0xfffffff0,%esp 8048f1a: 83 ec 10 sub $0x10,%esp 8048f1d: c7 04 24 00 00 00 00 movl $0x0,(%esp) 8048f24: e8 77 08 00 00 call 80497a0 8048f29: 66 90 xchg %ax,%ax 8048f2b: 66 90 xchg %ax,%ax 8048f2d: 66 90 xchg %ax,%ax 8048f2f: 90 nop 08053a0c : 8053a0c: 8b 5c 24 04 mov 0x4(%esp),%ebx 8053a10: b8 fc 00 00 00 mov $0xfc,%eax 8053a15: ff 15 a4 f5 0e 08 call *0x80ef5a4 8053a1b: b8 01 00 00 00 mov $0x1,%eax 8053a20: cd 80 int $0x80 8053a22: f4 hlt 8053a23: 90 nop 8053a24: 66 90 xchg %ax,%ax 8053a26: 66 90 xchg %ax,%ax 8053a28: 66 90 xchg %ax,%ax 8053a2a: 66 90 xchg %ax,%ax 8053a2c: 66 90 xchg %ax,%ax 8053a2e: 66 90 xchg %ax,%ax
Creating Shellcode The output of the "objdump" command has three columns. Virtual addresses, Op-codes and Mnemonics. We want the opcodes to create our payload. We will be storing our shellcode inside a character array. This means we cannot have null values. Also sometimes endianness can be a problem.
Page 1 and 2: Low Level Exploits Email: hughpears
Page 3 and 4: Creating Shellcode
Page 5 and 6: Creating Shellcode The ELF file typ
Page 7: Creating Shellcode Let us write an
Page 11 and 12: Creating Shellcode Our op-codes sho
Page 13 and 14: Buffer Overflows On the Stack
Page 15 and 16: Buffer Overflows On the Stack Stack
Page 17 and 18: Buffer Overflows On the Stack //exa
Page 19 and 20: Return to Stack
Page 21 and 22: Return to Stack As you can see in t
Page 23 and 24: Format String Vulnerabilities What
Page 25 and 26: Format String Vulnerabilities But t
Page 27 and 28: Format String Vulnerabilities Lets
Page 29 and 30: Return to LibC
Page 31 and 32: Return to LibC (Linux) Now we can s
Page 33 and 34: Return to SEH (Windows) Stack cooki
Page 35 and 36: Return to Heap
Page 37 and 38: Heap Overflows
Page 39 and 40: unlink() Technique by w00w00 When m
Page 41 and 42: unlink() Technique by w00w00 How a
Page 43 and 44: unlink() Technique by w00w00 Heap o
Page 45 and 46: unlink() Technique by w00w00 We can
Page 47 and 48: Integer Overflows
Page 49 and 50: Integer Overflows Signed 16 bit int
Page 51 and 52: Null Pointers
Page 53 and 54: Null Pointers Address space switchi
Page 55 and 56: Null Pointers Disable OS security e
Page 57 and 58: Null Pointers This works for 2 reas
Page 59 and 60:
Return Oriented Programming Chains
Page 61 and 62:
ROP Chains Scan executable memory r
Page 63 and 64:
ROP Chains Using a stack pivot, the
Page 65 and 66:
Questions Questions
show all

Low Level Exploits - Packet Storm

Create successful ePaper yourself

Delete template?

Save as template?