$ filter --tag intermediate

4 posts tagged #intermediate.

ASLR Bypass intermediate

ASLR Bypass via ret2libc Brute Force

When you can't leak an address, you can still win by guessing it. Defeating 32-bit ASLR by hammering a fixed ret2libc payload in a loop until the libc base lines up.

2022-03-14

Buffer Overflow intermediate

Lab 1 — Hidden Function (SUID Privesc)

Exploiting a SUID binary by overflowing into EIP and redirecting execution to a hidden getshell() function — no shellcode required.

2022-03-14

Buffer Overflow intermediate

Lab 2 — Linux Stack Overflow with Shellcode

Shellcode injection through an argv overflow on a SUID binary: offset calculation, buffer address discovery and a NOP sled for reliability.

2022-03-14

Windows Exploitation intermediate

Windows Stack Smashing — ASXtoMP3Converter

Classic Windows stack overflow in ASXtoMP3Converter via a malicious .m3u file: cyclic offset, EIP control and a reverse shell through a NOP sled.

2022-03-14