Stack Buffer Overflows
Understand stack layout, overflow EIP/RIP, write a working exploit for a vulnerable C binary.
Stack Buffer Overflows is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a Buffer Overflow?
A buffer overflow occurs when more data is written to a buffer than it can hold. The excess data overwrites adjacent memory, potentially corrupting control structures and redirecting program execution.
Stack Memory Layout
The call stack holds: local variables (buffers), saved frame pointer (SFP), and the return address (RIP/EIP) — where execution continues after the function returns. Overflowing a local buffer can overwrite the return address.
Classic Stack Smashing
If a program calls gets() or strcpy() without length checking, an attacker can input enough bytes to fill the buffer and overwrite the return address with the address of shellcode or a useful gadget.
// Vulnerable C code:
void vuln() {
char buf[64];
gets(buf); // No bounds checking!
}Finding the Offset
Determine how many bytes reach the return address using pattern generation:
# Generate a cyclic pattern:
python3 -c "from pwn import *; print(cyclic(200))" | ./vuln
# After crash, find offset:
python3 -c "from pwn import *; print(cyclic_find(0x61616166))"Protections: Stack Canaries
A stack canary is a random value placed between local variables and the saved return address. Before returning, the canary is checked — if overwritten, the program terminates. Must be bypassed for classic overflow exploitation.
Protections: ASLR
Address Space Layout Randomization (ASLR) randomizes the base address of stack, heap, and libraries on each execution. Without a leak of a current address, guessing where to jump is infeasible on 64-bit systems.
Protections: NX/DEP
NX (No-Execute) / DEP (Data Execution Prevention) marks the stack as non-executable. Shellcode injected into the buffer cannot be executed directly. This forces attackers to use Return-Oriented Programming (ROP).
Leaking Addresses
To defeat ASLR, attackers need an information leak: format string vulnerabilities, heap over-reads (like Heartbleed), or a readable pointer in the exploited function. One leaked address reveals the offset and allows calculating other addresses.
Writing a Basic Exploit
A basic 32-bit stack overflow with no protections:
# Python exploit skeleton (pwntools):
from pwn import *
p = process("./vuln")
offset = 76
shellcode = asm(shellcraft.sh())
payload = shellcode + b"A" * (offset - len(shellcode)) + p32(stack_addr)
p.sendline(payload)
p.interactive()ret2libc Technique
ret2libc bypasses NX by returning into libc functions (like system()) rather than shellcode. The attacker overwrites the return address with the address of system and passes "/bin/sh" as an argument.
Tools for Exploit Development
Essential tools:
- pwntools — Python exploit library
- GDB + pwndbg/peda — debugger with exploit helpers
- checksec — shows binary protections
- ROPgadget / ropper — find ROP chains
checksec --file=./vulnQuick Check: Stack Overflow
Which mitigation places a random value between local variables and the saved return address, terminating the program if it is overwritten?
Lesson Recap
Stack buffer overflows overwrite the return address by filling a buffer past its bounds. Protections include stack canaries (detect overwrites), ASLR (randomize addresses), and NX/DEP (non-executable stack). ret2libc bypasses NX. Information leaks defeat ASLR. pwntools streamlines exploit development.
Frequently asked questions
Is the “Stack Buffer Overflows” lesson free?
Yes — the full text of “Stack Buffer Overflows” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Stack Buffer Overflows”?
Understand stack layout, overflow EIP/RIP, write a working exploit for a vulnerable C binary. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Stack Buffer Overflows” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.