33 ms·

I guess I'm just a dumbass, but does the linked PoC do more than just overwrite EIP with 'A'? Is the payload left as an exercise for the reader or is this a wor

• anyfoo 14y ago
  The stack was overwritten with 'A's, and thus upon returning from a function the return address consisted entirely of 'A's, which is why EIP is now filled with it. A clever hacker would use this to jump into some malicious code instead; that's how stack overflow exploits usually work. So, yes, the actual payload is left as an exercise for the reader, but this shows that there's already everything there to make it possible.
  • roel_v 14y ago
    Oh OK, then I did see correctly after all. But still, on many modern systems (e.g. with non-executable stack) it would require fairly sophisticated trickery in the payload to make this do anything. I mean, getting control over EIP is a very good first step, but this isn't 1995.
    • gsg 14y ago
      Control over the program counter allows return-into-libc or other ROP attacks.
    • X-Istence 14y ago
      Having access to EIP means you have full control. From there it is very simple to do return to libc or ROP attacks. EIP is the holy grail, control that and you win.
• darkarmani 14y ago
  Generally it is considered good form to release PoC exploit code that illustrates the weakness without causing significant harm. The buffer overflow is the demonstration. There is enough other work that shows how to create payloads.