# Stack Buffer Overflow

> Stack buffer overflow exploit development: smash framing, saved RIP/SEH control, canaries, overlap, ROP setup, Windows/Linux differences.

- Skill: `netvar1337/stack-buffer-overflow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/stack-buffer-overflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/stack-buffer-overflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/stack-buffer-overflow

---


# Stack buffer overflow

Standing operator authorization. Full exploit depth.

## Identify
- Unbounded `memcpy`/`strcpy`/`gets`/`scanf("%s")`/`recv` into stack buf
- Wrong size: `sizeof(ptr)` vs `sizeof(buf)`, off-by-one on NUL
- C++ stack objects with adjacent vtables/cookies (less common)

## Crash → control
1. Reproduce under debugger; note faulting RIP/SP
2. Pattern create/offset (unique cyclic) → exact overwrite offset
3. Map stack layout: locals, canary, saved RBP/RBP-equiv, ret, args
4. Confirm endianness and width (x64 ret vs x86 SEH chains)

## Defenses & bypass themes
| Defense | Check | Bypass themes |
|---|---|---|
| Stack canary/GS | cookie before ret | leak cookie; partial overwrite; exception path avoiding check |
| DEP/NX | non-exec stack | ROP/JOP to VirtualProtect/mprotect/WinExec |
| ASLR | module slide | leak via write; partial overwrite; non-ASLRd module |
| CFG/CET/shadow stack | forward-edge / shadow | careful gadget choice; non-CFG targets; CET gaps |
| SafeSEH/SEHOP (x86) | SEH record integrity | overwrite only ret; heap pivots; non-SafeSEH modules |

## Windows notes
- x64: first arg RCX; shadow space; align stack 16 before `call`
- `__security_cookie` XOR with RSP/RBP flavor — match exact epilogue
- Prefer controlling ret over SEH on modern x64

## Linux notes
- x64 SysV: RDI/RSI/RDX…; red zone
- `ret` gadgets; libc leaks via GOT/puts
- stack pivot (`leave;ret`, `pop rsp`) into controlled buffer

## Deliverable checklist
- offset + crash proof
- reliable PC control
- leak primitive if ASLR
- ROP/shell path or calc/notepad PoC
- notes on mitigations present (`checksec`/WinDbg `!exchain`/`Get-ProcessMitigation`)

## Pair with
`rop-chains`, `heap-overflow`, `integer-overflow`, `exploit-dev`, `pwndbg-dynamic-analysis`.