1
votes

I am taking the Penetration Testing with Backtrack class from offensive-security.com and am working on a buffer overflow exploit for Ability Server. I can successfully over write EIP and jump to my shellcode. However, when I start going through the shellcode in the debugger, it breaks from the shellcode. I am almost 100% sure I have eliminated bad characters.I have even compared the shellcode before I sent it to the shellcode in the debugger after I have sent it and they are the identical.

I apologize for having to post the pictures via imgur album. Since I am new to stackoverflow.com, they won't allow me to post picture until I get some street cred.

Picture are here in the buffer overflow album. (The only album) http://edwardmcfellon.imgur.com/

{Picture 1}Here, I have a break point set at EIP. All is good so far.

{Picture 2}I let the program continue and it jumps to my shell code. All is still good.

{Picture 3}When the program executes POP EBX, my shellcode breaks and this is my problem.

{Picture 4}This is where the it ends up after breaking.

Any help would be appreciated. FYI I am very new to writing buffer overflows and am looking to understand why this is happening and how to prevent it in the future. Thanks in advance.

2

2 Answers

0
votes

Make sure you include a NOP slide. It increases the stability of your exploit

0
votes

Probably ESP is pointing outside the stack, so the POP EBX instruction ends up trying to read from invalid memory.