1

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by:

./binary $(python -c 'print overflow +shellcode + adressofshellcode')

Above exploit is working and I'm able to exploit the binary successfully. But when I turn off or log off my VM and then try again with exploit string it is not working because adressofshellcode changed and my exploit points to wrong memory location, because every time program buffer is loaded into different memory location.

I'm compiling program with -fno-stack-protector -z execstack flags of gcc and my ASLR is also disabled.

Is there any way so my return address always point to shellcode?

Umer
  • 11
  • 2
  • The [traditional way](http://insecure.org/stf/smashstack.html) to handle this is using NOP sleds. See also https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966 and https://reverseengineering.stackexchange.com/questions/16706/what-causes-the-need-for-nop-sleds – julian Nov 13 '17 at 00:21

0 Answers0