>_
ASLR Bypass via ret2libc Brute Force
When you can't leak an address, you can still win by guessing it. Defeating 32-bit ASLR by hammering a fixed ret2libc payload in a loop until the libc base lines up.
2022-03-14$ filter --tag ine
9 posts tagged #ine.
Lab 1 — Hidden Function (SUID Privesc)
Exploiting a SUID binary by overflowing into EIP and redirecting execution to a hidden getshell() function — no shellcode required.
2022-03-14
Linux Buffer Overflow Foundation
Buffer overflow fundamentals on Linux: overriding EIP, generating shellcode with msfvenom, finding the buffer address and landing a shell.
2022-03-14
Lab 2 — Linux Stack Overflow with Shellcode
Shellcode injection through an argv overflow on a SUID binary: offset calculation, buffer address discovery and a NOP sled for reliability.
2022-03-14
NX Bit Bypass with ret2libc
Defeating the NX bit by returning into libc: chaining system() + exit() + /bin/sh instead of executing injected shellcode.
2022-03-14
Lab 3 — ret2libc + ASLR Bypass via Info Leak
Combining NX and ASLR bypass: leak puts@GOT to recover the libc base, recompute offsets at runtime, then ret2system for a shell.
2022-03-14>_
Shellcode Reference — Compile, Extract, Test
A practical reference: assembling x86/x64 Linux shellcode with NASM, extracting opcodes with objdump and testing them with a C harness.
2022-03-14
Stack Canary Bypass via Format String Leak
Leaking the stack canary through a format-string information disclosure, then overwriting the return address while keeping the canary intact.
2022-03-14
Windows Stack Smashing — ASXtoMP3Converter
Classic Windows stack overflow in ASXtoMP3Converter via a malicious .m3u file: cyclic offset, EIP control and a reverse shell through a NOP sled.
2022-03-14