Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
dostackbufferoverflowgood_tutorial.pdf: dostackbufferoverflowgood_tutorial.md
pandoc --latex-engine=xelatex $< -o $@
pandoc --pdf-engine=xelatex $< -o $@

all: dostackbufferoverflowgood_tutorial.pdf

Expand Down
78 changes: 63 additions & 15 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,53 @@
# The Presentation and Tutorial for Cross-Site Scripters Who Can't Stack Buffer Overflow Good and Want to Do Other Stuff Good Too
```
____ ___ ____ _____ _ ____ _ ______ _ _ _____ _____ _____ ____
| _ \ / _ \/ ___|_ _|/ \ / ___| |/ / __ )| | | | ___| ___| ____| _ \
| | | | | | \___ \ | | / _ \| | | ' /| _ \| | | | |_ | |_ | _| | |_) |
| |_| | |_| |___) || |/ ___ \ |___| . \| |_) | |_| | _| | _| | |___| _ <
|____/ \___/|____/ |_/_/ \_\____|_|\_\____/ \___/|_| |_| |_____|_| \_\
_____ _______ ____ _____ _ _____ ______ ___ ___ ____
/ _ \ \ / / ____| _ \| ___| | / _ \ \ / / ___|/ _ \ / _ \| _ \
| | | \ \ / /| _| | |_) | |_ | | | | | \ \ /\ / / | _| | | | | | | | | |
| |_| |\ V / | |___| _ <| _| | |__| |_| |\ V V /| |_| | |_| | |_| | |_| |
\___/ \_/ |_____|_| \_\_| |_____\___/ \_/\_/ \____|\___/ \___/|____/
```

CrikeyCon 3, 2016-02-20
Created for CrikeyCon 3, 20 February 2016

## tl; dr

If you're in a hurry, you're almost certainly looking for the following resources:

* [`dostackbufferoverflowgood.exe`](/dostackbufferoverflowgood.exe) - an intentionally vulnerable Windows program
* [`dostackbufferoveflowgood_tutorial.pdf`](/dostackbufferoverflowgood_tutorial.pdf) - A PDF tutorial that explains how to exploit the above program

## A brief history

The resources in this repo were created for a talk at
[Crikeycon](https://www.crikeycon.com) in 2016. A recording of that talk is
available at <https://www.youtube.com/watch?v=renR0Aj2YzI>.

## How you can support me

Please share these resources with your friends. They are freely licensed, so
you are even welcome to present them at your local hacker meetup or in your
company. All I ask is that you credit me as the original author.

You can [Follow me on Twitter](https://twitter.com/justinsteven) and let me
know that you popped calc.

If you want to see more of my content, please subscribe to my [Youtube
channel](https://youtube.com/justinsteven) and follow me on
[Twitch](https://twitch.tv/justinsteven)

Finally, if these resources brought you joy or helped you on your journey to
OSCP and you would feel awesome about supporting me financially, you can buy
me a coffee. If it wouldn't make you feel awesome, please don't feel obliged.
This content will always be 100% free for you to enjoy, modify and distribute
:heart:

<a href='https://ko-fi.com/K3K51B01A' target='_blank'>
<img height='36' style='border:0px;height:36px;' src='https://az743702.vo.msecnd.net/cdn/kofi4.png?v=2' border='0' alt='Buy Me a Coffee at ko-fi.com' />
</a>

## Abstract

Expand All @@ -11,27 +58,28 @@ buffer overflow exploitation.

We'll cover assembly, registers, the stack, function call and return mechanics,
triggering stack buffer overflows, taking advantage of saved return pointer
overwrites, generating shellcode, and some other weird tricks (software devs
hate him!)
overwrites, generating shellcode, and some other weird tricks.

This is not new stuff, and modern mitigations (ASLR, DEP and stack canaries)
totally harsh its mellow. If you're a stack savant who has a handle on the heap
and ROPs relentlessly then I dunno go grab a beer or something.

tl;dr pop calc not alert(1)
totally harsh its mellow. If you're a stack savant who has a handle on the
heap and ROPs relentlessly then this content isn't for you. For everyone
else, may you learn to pop calc not alert(1)

## The good stuff
## Contents of this repo

* `dostackbufferoverflowgood` - Visual Studio solution for `dostackbufferoverflow.exe`
* `dostackbufferoverflowgood.exe` - Intentionally vulnerable binary, compiled without ASLR, DEP or Stack Canaries
* `dostackbufferoverflowgood.pdb` - Debug symbols for `dostackbufferoverflowgood.exe`
* `dostackbufferoverflowgood_slides.pdf` - Presentation slides
* `dostackbufferoverflowgood_tutorial.pdf` - A tutorial for `dostackbufferoverflowgood.exe`
* [`dostackbufferoverflowgood.exe`](/dostackbufferoverflowgood.exe) - Intentionally vulnerable binary. Compiled without ASLR, DEP or Stack Canaries.
* [`dostackbufferoverflowgood_tutorial.pdf`](/dostackbufferoverflowgood_tutorial.pdf) - A tutorial for the above binary
* [`dostackbufferoverflowgood_slides.pdf`](/dostackbufferoverflowgood_slides.pdf) - Presentation slides
* [`dostackbufferoverflowgood`](/dostackbufferoverflowgood) - **Optional** Visual Studio solution for `dostackbufferoverflow.exe`
* [`dostackbufferoverflowgood.pdb`](/dostackbufferoverflowgood.pdb) - **Optional** Debug symbols for `dostackbufferoverflowgood.exe`

## License

The code for `dostackbufferoverflowgood.exe` is licensed under Apache License
Version 2.0

Slides and tutorial are licensed under a Creative Commons Attribution 4.0
The slides and tutorial are licensed under a Creative Commons Attribution 4.0
International License.

You are welcome to modify and redistribute this material, provided you credit
me as the original author.
Loading