x64 ret2win - LINUX Buffer Overflow (PicoCTF 2022 #41 'x-sixty-what')

[@MrToast72]

"Don't forget guys, don't blindly trust any old code on the internet. That being said, I'm going to blindly trust this code on the internet." I had a real good laugh at this, thank you for your great humor John!

[@TheH2OWeb]

You're really good at explaining how this works ! Thank you John for sharing your knowledge !

[@HAGSLAB]

I have watched all your earlier binary exploitation videos and this video definitely adds a bit more context and knowledge that I was missing when it comes to x64 and the IP differences. The canonical address stuff makes sense now. Thank you :) I also love that you effed up with the print statement, I do similar stupid stuff all the time 🤦🏻‍♂️😆

[@DaniSpeh]

Very nice. Made me understand 64 bit a lot better

[@maesse]

Thanks for these videos! My GDB crashed on printf, and googling the error revealed that the issue was that the flag string was not 16 byte aligned. Skipping the opcode "0x40123a push rbp" happens to keep the stack pointer aligned and that's why it worked 🤓

[@viv_2489]

This is brilliant and very clear explanation...thanks for sharing

[@AntonioSouza]

I love yours vídeos. Made me understand 64 bit still more.

[@nuridincersaygili]

This is pure gold... thx so much!

[@thedailysenior]

Thank you John!!

[@joeborders]

Jeff is the real MVP

[@lordspacecake5565]

Very great information!!!

[@herrpez]

"A gimmick is a novel device or idea designed primarily to attract attention or increase appeal, often with little intrinsic value."

[@mellowgeekstudio]

Hardly anything to do with the meaning seemed to be intended in this video.

[@herrpez]

@@mellowgeekstudio Exactly.

[@grover-]

I'd have liked to see you use r2 for this ctf.

[@beebakrizzle]

Very cool! I was struggling with this one and the video was very clearly explained. Quick question: what do you use to run Kali in a VM? My VirtualBox instance is very slow and I have a super beefy computer (32GB RAM, i7 CPU, RTX3080 graphics). I enabled 3D acceleration and put half of the resources available for the box (16GB memory, 8 cpus, max video memory) but it's super slow. Virtualization is enabled in bios. PS: I prefer to use `echo -e "AAAA...\x3b\x12\x40"` for piping input into the binary, I think the python makes it confusing.

[@__someone__3141]

maybe ur using hdd instead of SSD? it's a very huge difference make sure to put the VM files on SSD

[@lfcbpro]

I have no idea if this is something that might be significant, I am new to all this, but what I did notice was that my VirtualBox instance ran a lot slower than my VMware instance, I don't know if it is worth a try changing to the VMware?

[@Ken-cj1in]

Hey man!!

[@parthghughriwala6799]

Awesome!!!

[@jraymundotunortiz9138]

I saw that the buffer overflow 3 has less than 500 solves, I hope we can get a video about it

[@taylor8294]

32:05 ColdFusion's post says "Examining RSP... so RIP is at offset 120" and John does the same. Why does matching the pattern at RSP give us the offset for RIP? Is it because RSP comes immediately after RIP in memory, and because its a non-canonical address RIP "gets skipped"? If so, is RSP always immediately after RIP in memory? Thanks

[@rabiaawasmi1554]

When you hit the leave instruction the rsp will point on the return address the same that will be poped into the rip

[@rabiaawasmi1554]

Also ret seems to not pop that adress if its not canonical

[@taylor8294]

@@rabiaawasmi1554 I see, thank you!

[@mellowgeekstudio]

Video did a terrible job at making that clear.

[@AwesomeLazyNinja]

We need a "gimmick" counter 😂

[@bhagyalakshmi1053]

Gdb ? Pro? Structured data in structured data

[@rimantasri4578]

Hello, I did exactly the same as it was done in this video, but my attack failed and I don't know why. The only difference between my attack and Hammond's was the flag function's address. In this video it was 0x0000000000401236. Mine was 0x0000000000001191. When I enter an overflow string into my program, it gets a segmentation fault, but the flag function is not called. When I check the changed RIP, it is something different than I have actually inputted, it is something like 0x555555bf-something, but I didn't put these numbers anywhere. Am I missing something?

[@bhagyalakshmi1053]

R15?

[@shivasijwali6779]

Can someone please explain me what is

[@drewzilla1263]

makes it fill the bytes to be the size of QWORD (8 bytes)

[@georgehammond867]

How long are you in this business ....6 years or more?

[@dom1310df]

Given GEF is written in Python, why isn't it just pip installable?

[@drewzilla1263]

pip is for adding code packages to your python development environment

[@xerrion]

​@@drewzilla1263 no, if I for example use pip install black I can use black globally and not just in my development environment

[@AmanPatel-rv2it]

This one is the longest one

[@bhagyalakshmi1053]

What this metta spa

[@bhagyalakshmi1053]

Rax,rcx, explain

[@mauricekyalo9101]

Yt algo things 👍

[@michealsichilongo]

😂 am done with binary exploration 😅

[@Sqwince23]

It's GIF not GIF...