Practical Buffer Overflows for OSCP

Explore fuzzing as a dynamic, black-box testing technique that sends crafted inputs to a server to reveal vulnerabilities. Learn how static analysis differs, and review fuzzing frameworks and Python-based tooling.

Learn to build a simple Python fuzzer to fuzz a network service, send crafted packets over a socket, observe crashes and memory behavior, and identify buffer overflow risks.

Learn to use the boofuzz framework in python to fuzz a target application by configuring a socket target, building a template, and launching a fuzzing campaign.

Fuzz an ftp server using the woofers framework, run and debug the ftp server, issue commands, parse the socket connection and port 21, and analyze server responses for vulnerability testing.

Generate a unique, non-repeating pattern for buffer overflow analysis with a Python script, using random characters and user input to define pattern length and search for matches.

Learn to generate and use unique patterns with metasploit's pattern tools, including pattern grid and pattern offset, and build custom patterns with ruby scripts when needed.

Learn to determine available buffer size by inspecting the stack and memory addresses, tracing ESP offsets, and reading hex values to estimate how many bytes are free (e.g., 256 bytes).

Examine the Mona Python module in Immunity Debugger, learn to run commands, set breakpoints, and create cyclic patterns to identify injection points and useful addresses for buffer overflow practice.

Identify the eip offset by generating a unique pattern with Python, sending it via a socket to the target application, and decoding responses to locate the overflow point.

Determine and remove bad characters in buffer overflow experiments using Mona, including null bytes, carriage return, and newline, by generating character sets and validating memory to prevent corruption.

Discover how to find jmp esp addresses with Mona, filter out bad characters, and verify a clean ESP address using view logs for safe exploitation.

Discover how to find jmp addresses with Immunity Debugger by opening the binary, searching for jump instructions, and identifying candidate addresses.

Generate shellcode using msfvenom, select architecture and encoding options to avoid bad characters, and format payloads in C format, then export the resulting shellcode for use in a buffer overflow.

Exploit a buffer overflow to gain a shell on a Windows XP target, using crafted addresses, a no-operation sequence, and an ESP jump to execute code.

Introduces egghunters, small code that searches memory for a unique tag and redirects execution to the found region. Explains tagging, memory scanning, and ensuring a single occurrence.

Solve small buffer sizes with egghunters to locate data in memory and exploit buffer overflows, while manipulating ESP and handling bad characters in the process.

The lecture demonstrates how a pop pop ret sequence manipulates the top of the stack and ESP to control program flow, using return instructions and PSP jumps with practical steps.

Explore practical memory jumping techniques for buffer overflows, using ESP values and precise offsets to skip instructions, jump forward or backward, and execute code at targeted points.

Walk through a vulnserver TRUN exploit, showing how to enumerate the server, craft and encode a payload, identify bad characters, and test buffer overflow techniques on a Windows XP target.

This lecture demonstrates an egghunter exploit on vulnserver trun, detailing bad characters, junk data and tag alignment, and how to trigger the egghunter to run the payload.

Solve the TryHackMe OSCP prep room with a buffer overflow workflow: pattern generation, ESP offset discovery, bad character handling, and payload delivery via Python sockets.