Module: Ronin::Exploits::Mixins::StackOverflow

Includes:
Binary, NOPS, Text
Included in:
StackOverflow
Defined in:
lib/ronin/exploits/mixins/stack_overflow.rb

Overview

Methods for building Stack Overflow buffers.

Example

include Mixins::StackOverflow

def build
  ebp = 0x06eb9090
  eip = 0x1001ae86

  buffer = buffer_overflow(length: 1024, nops: 16, payload: payload, bp: ebp, ip: eip)
  # ...
end

If you want more control over how the buffer is constructed:

include Mixins::StackOverflow

def build
  ebp = 0x06eb9090
  eip = 0x1001ae86

  buffer = junk(1024) + nops(16) + payload + stack_frame(ebp,eip)
  # ...
end

Since:

  • 1.0.0

Constant Summary

Constants included from NOPS

NOPS::NOPS

Instance Method Summary collapse

Methods included from Text

#junk

Methods included from NOPS

#nop, #nops, #perform_validate

Methods included from Binary

#pack, #perform_validate, #platform

Instance Method Details

#buffer_overflow(length:, nops: nil, payload:, bp:, ip:) ⇒ String

Builds the stack overflow buffer containing the payload, nops, and a stack frame.

Examples:

ebp = 0x06eb9090 # short jump 6 bytes
eip = 0x1001ae86 # pop pop ret 1001AE86 SSLEAY32.DLL

buffer = buffer_overflow(length: 1024, nops: 16, payload: payload, bp: ebp, ip: eip)

Parameters:

  • length (Integer) —

    The desired total length of the buffer.

  • nops (Integer, nil) (defaults to: nil) —

    The amount of NOP padding before the payload.

  • payload (#to_s) —

    The payload to add to the buffer.

  • bp (Integer) —

    The stack base pointer address.

  • ip (Integer) —

    The instruction pointer address.

Returns:

  • (String) —

    The built buffer.

Since:

  • 1.0.0



109
110
111
112
113
114
115
116
117
118
119
120
121
 
# File 'lib/ronin/exploits/mixins/stack_overflow.rb', line 109

def buffer_overflow(length: , nops: nil, payload: , bp: , ip: )
  payload = payload.to_s
  payload = self.nops(nops) + payload if nops

  stack_frame = self.stack_frame(bp,ip)

  buffer = String.new(encoding: Encoding::ASCII_8BIT)
  buffer << junk(length - payload.bytesize - stack_frame.bytesize)
  buffer << payload
  buffer << stack_frame

  return buffer
end

#stack_frame(bp, ip) ⇒ String

Creates a new stack frame.

Parameters:

  • bp (Integer) —

    The stack base pointer address.

  • ip (Integer) —

    The instruction pointer address.

Returns:

  • (String) —

    The new stack frame.

Since:

  • 1.0.0



77
78
79
 
# File 'lib/ronin/exploits/mixins/stack_overflow.rb', line 77

def stack_frame(bp,ip)
  pack(:machine_word,bp) + pack(:machine_word,ip)
end