Discover Top Posts Tagged with #buffer-overflow

すごいC言語、たのしく壊そう

素行の悪いCプログラミング入門

世の中にはひどい人もいたものである。素行の悪いCプログラマーがどのようなコードを書くか、その邪悪さの片鱗をご覧にいれようと思う。

Memory Address to Little Endian

This is just a little code snippet (in Python) to convert a memory address to little endian format.

#!/usr/bin/python import sys,struct,binascii,re,os script = os.path.basename(__file__) if len(sys.argv) < 2: print "Usage: ./%s <mem addr>\n ./%s 0x41424344" % (script, script) sys.exit(1) eip = int(sys.argv[1],0) # e.g. 0x41424344 def format_eip(i): return struct.pack('<L', i) reversed = format_eip(eip) # This is just to pretty print the hex in the terminal (i.e. # print as '41 41' instead of auto-formatting as ASCII 'A A'). # Just use 'reversed' directly in buffers reversed_bin = binascii.hexlify(reversed) print "\nin little-endian: %s" % reversed_bin # Print again, this time as a shellcode ready string with \x's formatted_split = "" split = re.findall('..',reversed_bin) for i in split: i=r'\x'+i formatted_split += i print " shellcode ready: %s \n" % formatted_split

This is what it looks like when it runs:

Most of this code is just there for formatting it correctly for view from the terminal as you run the script. If you were using the returned value directly in your payload, you'd need only do something such as:

#!/usr/bin/python ...snip... import struct import binascii def format_eip(i): return struct.pack('<L', i) eip = 0x41424344 buffer = "A"*4000 buffer += format_eip(eip) ...snip...

#buffer-overflow #exploit-development #little-endian #python

OSCE Exam Prep

It’s nearly time..! In just a few days I’ll be attempting the Offensive Security Certified Expert (OSCE) exam. Yikes. I’m already certain that this is going to be the single most difficult challenge I’ve undertaken personally, professionally, and academically, to date.

Given the above, and that the exam goes for 72 hours (48 hours + 24 hours reporting), I’ve been developing a series of scripts and cheatsheets so that I can make the most of my exam time, and maybe even prevent a few little mistakes caused by sleep deprivation.

This is one of the cheatsheets. I find that I commonly look for many of these commands and opcodes during exploit development.

#osce #ctp #exploit-development #ollydbg #buffer-overflow #bof #cheatsheet #hacking