Tutorial Demonstrates Custom Shellcode Execution via a Stack Pivot

Summary

A tutorial demonstrates a file-based stack buffer overflow in a 512-byte buffer, overwrites the return address to pivot execution to the stack, and runs custom shellcode with DEP, stack cookies, and ASLR disabled.

Key points

• The demonstration program reads a file into a fixed 512-byte buffer using the file size as the read length, allowing an oversized input to overflow the buffer.
• The presenter uses IDA to inspect the stack layout and calculates a 524-byte offset to reach the return address; a Python script builds the payload.
• DEP, stack-cookie protection, and ASLR are disabled to simplify the demonstration.
• The payload overwrites the return address with a jump ESP instruction at 0x40100C, redirecting execution to the stack; a NOP sled is included.
• The custom shellcode calls WinExec with the string "calc" and then exits the process.
• The presenter assembles shellcode with NASM and uses CyberChef to convert the output into bytes for the payload, noting that LLM-generated opcode documentation contained errors that needed correction.
• The video introduces return-oriented programming (ROP) as a possible next step for working around a non-executable stack, but does not demonstrate a ROP exploit.

Products

Tools

Related Articles

• Yarden Shafir Discusses Windows AI Agent Isolation and Security ResearchJohn HammondIDA · Microsoft Windows
• Possible Pakistan-Linked Backdoor Targets Afghanistandmpdump.github.ioIDA · Microsoft Windows
• Fortinet Details Evooo1Bot, a Modular Linux Botnet Targeting Internet-Facing Devicesfeeds.fortinet.comIDA · Microsoft Windows
• eSentire Details TAG-150’s ClickFix Chain Delivering DinDoor, DenoRAT and NightshadeC2esentire.comCyberChef · Microsoft Windows
• Amatera Stealer Adds Evasion Features and Expands Credential and Wallet Theftesentire.comCyberChef · Microsoft Windows