3 ms·
The stack was overwritten with 'A's, and thus upon returning from a function the return address consisted entirely of 'A's, which is why EIP is now filled with
by anyfoo 14y ago
The stack was overwritten with 'A's, and thus upon returning from a function the return address consisted entirely of 'A's, which is why EIP is now filled with it.
A clever hacker would use this to jump into some malicious code instead; that's how stack overflow exploits usually work.
So, yes, the actual payload is left as an exercise for the reader, but this shows that there's already everything there to make it possible.
- roel_v 14y agoOh OK, then I did see correctly after all. But still, on many modern systems (e.g. with non-executable stack) it would require fairly sophisticated trickery in the payload to make this do anything. I mean, getting control over EIP is a very good first step, but this isn't 1995.