BO Attacks

Goals

• To exploit BO
• Good ref: https://reboare.github.io/htb/htb-jail.html

What to look for

• Source code with array[xx]

To compile without stack protection

• gcc -o jail jail.c -m32 -z execstack
• service jail stop
• cp jail /usr/local/bin/jail
• service jail start

To debug for Linux executable

In Kali, to use the below mode in GDB to make the process debug the forked process

• (gdb) set follow-fork-mode child
• (gdb) set detach-on-fork off

Socket reuse

In case the firewall blocks outgoing connection

• https://d3fa1t.ninja/2017/09/17/linux-x86-one-way-shellcode-socket-reuse/

Exploit payload framework

To write payload program fast

• https://github.com/lethanhtung01011980/pwntools