[RST] Stack Based Buffer Overflows on x86 (Windows) – Part II

[Nytro]

Stack Based Buffer Overflows on x86 (Windows) – Part II

In the first part of this article, we discussed about the basics that we need to have in order to properly understand this type of vulnerability. As we went through how the compiling process works, how assembly looks like and how the stack works, we can go further and explore how a Stack Based Buffer Overflow vulnerability can be exploited.

Introduction

We previously discussed that the stack (during a function call) contains the following (in the below order, where the “local variables” are stored at the “smallest address” and “function parameters” are stored at the highest address):

• Local variables of the function (for example 20 bytes)
• Previous EBP value (to create the stack frame, saved with PUSH EBP)
• Return address (placed on the stack by the CALL instruction)
• Parameters of the function (placed on the stack using PUSH instructions)

 

Sursa: https://nytrosecurity.com/2017/12/20/stack-based-buffer-overflows-on-x86-windows-part-ii/