Stack-based buffer overflow exploitation techniques

From: Carlos Eduardo Santiviago <segfault_at_brturbo.com>
Date: 12 Jan 2004 18:28:13 -0000

('binary' encoding is not supported, stored as-is) Hello,

supposing this simple vuln code:

int main(int argc, char *argv[])
{
   char buf[128];

   strcpy(buf, argv[1]);
   return 0;
}

I am doing a research about stack-based exploitation techniques and i know 4 ways to do it (to help me overwrite saved eip/ebp):

1. using nop sled (P49-14)
2. using environment variables (murat, netric.org)
3. using ptrace() (RaiSe's linuxconfig exploit)
4. returning-into-libc

The question is: is there any other way to exploit it?

thanks,
--
/sf
Received on Jan 13 2004