Take control of EIP

• when the EIP (instruction pointer) is under control, we can tell it to which address it should jump.
• this will make the EIP point to the address where our shellcode starts & causes the CPU to execute it.
  • usually to corrupt the return address to include our shellcode address and manipulate the eip to go there.

Steps

get segmentation fault

• our buffer is 1024 char long
• send an input far higher than that to cause a segmentation fault in gdb
• run $(python -c "print '\x41'*1200 ")
• info registers
  • we see that eip and ebp values are overwritten

Finding the offset

• now we find the offset where we can control the return address and send it to our shellcode.
• we will know this when we find the eip value as it will point to the return address that we want to overwrite.

create a unique pattern to find the offset

old way

• /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 1200 in gdb
• run $(python -c print "<above_unique_output_string>" )
• copy the eip value (0x69423569) terminal
• /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 0x69423569

new way

in gdb - cyclic 1200 - run <outputfromabove> - copy eip value - cyclic -l <eip_value> - will return Found at offset 1036

---

PWNDBG

• check BACKTRACE
• the first instance of None with random variables/address should be your offset
  • ![[../../../../attachments/Pasted image 20251017161007.png]]
  • RBP is also being overwritten in this case