Skip to content

Commit 0cf46a4

Browse files
committed
Improved README
1 parent 77c4676 commit 0cf46a4

File tree

1 file changed

+22
-5
lines changed

1 file changed

+22
-5
lines changed

README.md

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
11
# Buffer Overflow methodology
22

3-
[![GitHub last commit (branch)](https://img.shields.io/github/last-commit/3isenHeiM/OSCP-BoF/master)](https://github.com/3isenHeiM/OSCP-BoF/commits)
4-
[![GitHub stars](https://img.shields.io/github/stars/3isenHeiM/OSCP-BoF)](https://github.com/3isenHeiM/OSCP-BoF/stargazers)
3+
![GitHub Repo stars](https://img.shields.io/github/stars/3isenHeiM/OSCP-BoF?style=social) [![GitHub last commit (branch)](https://img.shields.io/github/last-commit/3isenHeiM/OSCP-BoF/master)](https://github.com/3isenHeiM/OSCP-BoF/commits) [![GitHub stars](https://img.shields.io/github/stars/3isenHeiM/OSCP-BoF)](https://github.com/3isenHeiM/OSCP-BoF/stargazers) ![Language](https://img.shields.io/badge/-python-3776AB?logo=python&logoColor=white)
4+
5+
6+
![GitHub](https://img.shields.io/github/license/3isenHeiM/OSCP-BoF)
7+
58

69
[![Twitter Follow](https://img.shields.io/twitter/follow/3isenHeiM?style=social)](https://twitter.com/3isenHeiM)
710

811

912
## Introduction
1013

11-
These are 7 simple python scripts + a methodology easing the exploitation.
14+
These are 7 simple python scripts and a methodology **to ease** (not *automate* !) the exploitation.
1215
Each script targets a phase of the exploitation :
1316

1417
1. Trigger the BoF (this is facultative for OSCP since they give you a code snippet)
@@ -23,13 +26,27 @@ It's based on the [do stack buffer overflow good](https://github.com/justinsteve
2326

2427
## How to use
2528

26-
Follow each step and you'll be able to craft a working example of a BoF exploitation
29+
Follow each step and you'll be able to craft a working example of a BoF exploitation.
30+
31+
All the specific variable are stored in [1 single resource file](PARAMETERS.py),
32+
to avoid any confusion during the exam.
33+
34+
After each step, fill the proper variables with values found and they'll be re-used for the next step
2735

2836
Note: If after each debug operation performed, the application has become unresponsive; Immunity Debugger should be closed first, then the "vulnapp.exe" application should be restarted, and Attach and Run should be done on Immunity Debugger.
2937

38+
## 0. Pre-start
39+
40+
Fill in the following variables in the [resource file](PARAMETERS.py) depending on the host to attack :
41+
* ``RHOST`` : the IP address of the host
42+
* ``RPORT`` : the port on which to access the application to exploit
43+
3044
## 1. Segmentation fault : [1_segfault.py](1_segfault.py)
3145

32-
Send enough length string for victim system crash
46+
Send enough length string for victim system crash.
47+
48+
Please note that the total length to input is often given in the exmaple they
49+
provide in the exam.
3350

3451
Note the offeset in ``PARAMETERS.py``, in the variable ``offset_eip``.
3552

0 commit comments

Comments
 (0)