# CSC 472 • Week 5 • September 22 and 24, 2026

Dr. Si Chen • West Chester University

These classroom demonstrations continue directly from Week 4's shellcode.
Use your WolfCTF Lab 2 terminal (GDB + GEF included). All commands below
run inside the Linux terminal, not in macOS/Windows. They create a
separate ~/csc472-week05 directory and do not edit Lab 1 or Lab 2 files.

## Get the files

```sh
cd ~
curl -fLO https://wcu.ninja/files/CSC472_Week05_code.tar.gz
tar -xzf CSC472_Week05_code.tar.gz
cd ~/csc472-week05
```

## Class 8: Stack overflow — return hijack (Tuesday, September 22)

```sh
cd ~/csc472-week05/class08
make
echo "set disassembly-flavor intel" >> ~/.gdbinit
gdb -q ./overflow
```

In GDB (GEF loads automatically):

```text
gef> pattern create 100 pattern100.txt
gef> r < pattern100.txt
gef> pattern offset $eip
quit
```

`pattern offset` reports how many bytes of padding land before EIP. Then
find where `hacked()` lives in the binary:

```sh
objdump -d overflow | grep '<hacked>:'
```

Build a payload of that many padding bytes followed by `hacked()`'s
address in little-endian order (`p32()` in pwntools does this for you),
and send it to `./overflow`. `hacked()` runs even though `main()` never
calls it — you have redirected execution to code that already exists in
the binary.

## Class 9: Stack overflow — return to shellcode (Thursday, September 24)

```sh
cd ~/csc472-week05/class09
make
gdb -q ./overflow2
```

This time there is no function to jump to on purpose. Instead, reuse the
`execve_stack.asm` shellcode from Week 4 (also copied into this folder):
assemble it, extract the raw bytes exactly as you did for Class 7, and
place a NOP sled ahead of it inside the overflow buffer. Overwrite the
return address with an address that lands anywhere in the NOP sled —
execution slides forward until it reaches your shellcode.

```text
gef> r < your_payload
gef> x/8xw $esp
```

Use the address you find there (or nearby) as the return address in your
exploit script. A working payload lands an interactive shell; run `id`
or `whoami` inside it to prove it is a real shell, not just printed text.

## Why both attacks still work this week

Both `overflow` and `overflow2` are compiled with
`-fno-stack-protector -z execstack -no-pie` — no stack canary, an
executable stack, and no address randomization. That is deliberate: it
isolates the core idea (control EIP, then decide where it goes) before
Week 6 turns every one of these protections back on and shows exactly
how each one changes the attack.

## Practice (not a new graded submission)

1. Class 8: change `hacked()`'s message, rebuild, and confirm the
   address you found with `objdump` changed too.
2. Class 9: shorten the NOP sled to 5 bytes and see how much more
   precise your guessed address has to be before the exploit still works.
3. Explain in your own words why the return-hijack payload from Class 8
   cannot simply be reused for Class 9 without changes.

Lab 2 (Stack Overflow) opens after Class 9 and covers both attacks.
Instructions will be posted separately (D2L / course site).

## References

Linux syscall / execve: https://man7.org/linux/man-pages/man2/execve.2.html
GEF pattern plugin: https://gef.readthedocs.io/
pwntools: https://docs.pwntools.com/