<P> If the address of the user - supplied data used to affect the stack buffer overflow is unpredictable , exploiting a stack buffer overflow to cause remote code execution becomes much more difficult . One technique that can be used to exploit such a buffer overflow is called `` trampolining '' . In that technique , an attacker will find a pointer to the vulnerable stack buffer , and compute the location of their shellcode relative to that pointer . Then , they will use the overwrite to jump to an instruction already in memory which will make a second jump , this time relative to the pointer ; that second jump will branch execution into the shellcode . Suitable instructions are often present in large code . The Metasploit Project , for example , maintains a database of suitable opcodes , though it lists only those found in the Windows operating system . </P>
<P> If the address of the user - supplied data used to affect the stack buffer overflow is unpredictable , exploiting a stack buffer overflow to cause remote code execution becomes much more difficult . One technique that can be used to exploit such a buffer overflow is called `` trampolining '' . In that technique , an attacker will find a pointer to the vulnerable stack buffer , and compute the location of their shellcode relative to that pointer . Then , they will use the overwrite to jump to an instruction already in memory which will make a second jump , this time relative to the pointer ; that second jump will branch execution into the shellcode . Suitable instructions are often present in large code . The Metasploit Project , for example , maintains a database of suitable opcodes , though it lists only those found in the Windows operating system . </P>
by manipulating a buffer overflow an attacker can jump
by manipulating a buffer overflow an attacker can jump
to an instruction already in memory which will make a second jump , this time relative to the pointer ; that second jump will branch execution into the shellcode
to an instruction already in memory which will make a second jump , this time relative to the pointer ; that second jump will branch execution into the shellcode