Tie-In: Lab 2 (Return-to-Shellcode Bonus)
- Lab 2's bonus is a controlled, NX-disabled target so you can see the classic technique end to end.
- Your workflow:
checksecthe binary; confirm NX is off for the bonus target.- Generate shellcode (e.g.,
asm(shellcraft.sh())). - Find the offset to the saved return address.
- Place the shellcode and overwrite the return address to jump into it (a NOP sled helps).
- This is a historical exercise: it demonstrates why NX exists and sets up the need for ROP next.
Key Takeaway
Return-to-shellcode works only because the lab target intentionally lacks NX. Real modern targets force code reuse instead.