Revisiting Address Space Randomization - Information Security and Cryptology-ICISC 2010 - page 221

14. Shacham, H.: The geometry of innocent flesh on the bone: return-into-libc with-
out function calls (on the x86). In: Proceedings of the 14th ACM conference on
Computer and Communications Security, CCS 2007 (2007)
15. Shacham, H., Page, M., Pfaff, B., Goh, E., Modadugu, N., Boneh, D.: On the
effectiveness of address-space randomization. In: Proceedings of the 11th ACM
Conference on Computer and Communications Security, CCS 2004 (2004)
16. Scut/team teso. Exploiting format string vulnerabilities (2001),
http://team-teso.net
17. Xu, J., Kalbarczyk, Z., Iyer, R.K.: Transparent runtime randomization for security.
In: Symposium on Reliable and Distributed Systems, SRDS (2003)
18. Zalewski, M.: Remote vulnerability in ssh daemon crc32 compensation attack de-
tector (2001) (Bindview)

A Shell Code of Our Attack

00000000 e8 01 05 08 d0 85 0b 08 3d fe 06 08 bf bf bf bf

00000010 3d fe 06 08 bf bf bf bf ac c6 0c 08 ac c6 0c 08

00000020 3d fe 06 08 bf bf bf bf 3d fe 06 08 bf bf bf bf

00000030 ac c6 0c 08 ac c6 0c 08 ac c6 0c 08 ac c6 0c 08

00000040 ac c6 0c 08 ac c6 0c 08 ac c6 0c 08 ac c6 0c 08

00000050 51 63 0a 08 e8 01 05 08 58 f4 ff bf 51 63 0a 08

00000060 66 b4 08 08 bf bf bf bf e8 01 05 08 08 80 04 08

00000070 3d fe 06 08 bf bf bf bf 51 63 0a 08 e8 01 05 08

00000080 60 f4 ff bf 51 63 0a 08 66 b4 08 08 bf bf bf bf

00000090 e8 01 05 08 60 f4 ff bf 51 63 0a 08 a8 02 05 08

000000a0 5c f4 ff bf c2 85 06 08 64 f4 ff bf bf bf bf bf

000000b0 e8 01 05 08 5c 82 04 08 3d fe 06 08 bf bf bf bf

000000c0 bf bf bf bf 64 f4 ff bf bf bf bf bf 2f 62 69 6e

000000d0 2f 73 68 00