1
Tutorials / Re: Easy intro to (local) exploitation
« on: February 04, 2014, 11:41:30 am »The example was done on a 32-bit intel architecture and you are on a 64-bit version. eip is rip on 64-bit.I think the more logical way to circumvent this difference, for this tutorial, would be to 'gcc -m32'
Also prior to attempting the example, issue the following command:
"echo 0 > /proc/sys/kernel/randomize_va_space"
Compile the vulnerable program with these flag also:
" gcc -fno-stack-protector -z execstack"
If you would rather follow the example like it is (in 32-bit environment) use this option also when compiling the vulnerable program :
"gcc -m32"
Since..this
echo 0 > /proc/sys/kernel/randomize_va_space
sounds like a setting being set for this specific example file
and
gcc -fno-stack-protector -z execstack
hmm... sounds too easy to just disable the stack-protector
By the way, from this example it seems to me that 64bit programs do have a stack protector while 32bit ones do not? This sounds weird, so I ask you. I sorta intend to know what's happening, in addition to learn commands.
Thanks!