Let's say I found a vulnerability in some application and managed to exploit it on my machine. How do I make that exploit work against other machines when the stack layout and memory addresses are different?
Add a comment
|
1 Answer
Generally you have three options:
- use the the stuff that stays the same (maybe main executable is not ASLRed, maybe some DLL isn‘t. Maybe some register always points to the same X)
- find out where‘s what before you jump. you need some memory disclosure bug and a vuln you can exploit interactively, like over the network or from within the browser.
- guess. This means either heap spraying or a vuln that you can attack over and over again until you succeed, like a web server.
