Learn, hack!

Hacking and security documentation: slides, papers, video and audio recordings. All in high-quality, daily updated, avoiding security crap documents. Spreading hacking knowledge, for free, enjoy. Follow on .

Advanced Buffer Overflow Methods [or] Smack the Stack

File name
File size
625.5 KB

A quick review of the standard buffer overflow exploit structure VA Patch, What it is and what it does to prevent buffer overflows. The Concept of Stack Juggling The RET2RET Method The RET2POP Method The RET2EAX Method The RET2ESP Method The Stack Stethoscope Method VA Patch released in the purpose of raise the bar on buffer overflow exploits. It does a very small thing but it's effect is much bigger. To the moment this patch been integrated to the mainstream Linux kernel tree approximately from 2.6.11rc2 and it's activated by default. It is not optional during Kernel Compile but does have a /proc trigger. Stack Juggling concept. Using assembly that already exists within the code in order to travel inside the stack and find a way back to the shellcode. That's includes RETs / POPs / CALLs and etc. RET2RET Method is designed to refactor the upper frame stack for potential return address. It does by constructing a chain of RET's to bridge the gap and the side effect of NULL byte that exists inside C strings to perform a byte-alignment. RET2POP Method is reassembles to RET2RET only focus on buffer overflow within a function. It also based on chain of RET's only to avoid the impact of the NULL byte-alignment it uses POP followed by RET RET2EAX Method shows that when function is kind enough to return back a string pointer (the buffer) back to the program. it's passed through EAX register and the CRT (C Runtime) includes a CALL to EAX and by that provides the perfect solution. RET2ESP Method shows the double meaning. The output of INT A = 58623 can be abused. To due hex value of the number 58623 is 'FFE4' (JMP %ESP) through offset jump into the MOV instruction it's possible to create a perfect start jump. The Stack Stethoscope Method shows that exploit that's locally attacks a daemon can predict the exact return address. This thanks to the /proc entry of the process that exports the 'stack start address' and by calculating the distance between buffer and the stack start address. Makes it possible for the exploit prior to the attack, to calculate the return address.

About us

Secdocs is a project aimed to index high-quality IT security and hacking documents. These are fetched from multiple data sources: events, conferences and generally from interwebs.


Serving 8166 documents and 531.0 GB of hacking knowledge, indexed from 2419 authors from 163 security conferences.


To support this site and keep it alive, you can click on the buttons below. Any help is really appreciated! This service is provided for free, but real money is needed to pay bills.

Flattr this Click here to lend your support to: Keep live SecDocs for an year and make a donation at www.pledgie.com !