« first day (4422 days earlier)      last day (519 days later) » 

12:27 AM
What I’m doing these two days (Actual site picture).
 
 
8 hours later…
nwp
 
 
13 hours later…
9:13 PM
To me it looks like the main challenges pentesters might face when trying to execute malicious code via either stack based buffer overflow or heap based overflows is ASLR and even the mere fact that
code on the stack is not even executable
nobody would ever compile an application with "-fno-stack-protector" let alone "-z execstack"
wrt I am assuming in this particular case that they are for instance injecting machine code straight into a buffer on the stack. Otherwise alternatives are possible such as overwriting function pointers and what not, so that you can try to execute a specific function which is at a specific address you know
But all of this is also made very easy if the application got compiled with debug information, Which usually is not the case
You'd otherwise have to be very motivated to disassemble a binary and go through all the Asm code to try to find such vulnerabilities...
Actually... ghidra is able to disassemble up to C code IIRC. But IIRC the symbols it assigns are an absolute nightmare "func1, func2, var3243, var4354, ..."
 
 
2 hours later…
11:29 PM
@LandonZeKepitelOfGreytBritn ROP gadgets get around execution bit restrictions.
 

« first day (4422 days earlier)      last day (519 days later) »