CODEWITHSUNDEEP
assemblyx86stack-overflowshellcode
Kooi Nam Ng
Kooi Nam Ng

Reputation: 309

Do we overwrite EIP (return address) with an opcode or memory address?

char shellcode[] =        "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00"        "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"        "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff"        "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";

void main() {
   int *ret;  
   ret = (int *)&ret + 2;  
   (*ret) = (int)shellcode;
}

to my knowledge, shellcode[] is hex opcode for spawning a shell and the last line of the code overwrite the ret with the opcode. Do we insert opcode or memory address into RET ?

Upvotes: 0

Views: 820

Answers (3)

Ben Jackson
Ben Jackson

Reputation: 93930

It doesn't overwrite the return opcode, it overwrites the return address on the stack (by assuming it's near a variable declared on the stack) so that when main() returns it doesn't go back to _start+n but instead to shellcode.

Upvotes: 2

Jerry Coffin
Jerry Coffin

Reputation: 490768

As it stands, it's inserting the address the address into the string. I suppose in this case, it's kind of a waste of time to point out that it's completely non-portable and almost certainly a really bad idea...

Upvotes: 0

Arelius
Arelius

Reputation: 1216

The ret register on the stack is a location that code gets returned to, putting an opcode there wouldn't be of much help. I suspect an address to code you want to run is the most likely candidate. Yay! It's probably best overall to consider what the items you are interacting with are used for, and how they get used rather then trying to blindly dump data into them.

Upvotes: 0

Related Questions