The "House of G.E.T.S." Technical Deep-Dive The "House of G.E.T.S." Technical Deep-Dive In today’s article, we’ll take a look at the first "Wall" most offensive security students hit: The Null-Terminator Constraint. I don’t blame the students for hitting it; it’s the first wall that many instructors also gloss over. I’m not just talking about the standard “identification of bad characters”—though they are interrelated. I'm talking about the fundamental logic that gets lost in translation. The Null-Terminator Constraint. Have I piqued your interest? Let’s get after it. The "Gluten" of Modern Mitigations The "Gluten" of Modern Mitigations In the industry, most exploit development courses start with a "naked" buffer overflow—zero mitigations, local attack vector. The goal is to show the vulnerability without the noise. This is logical; you can’t fix a vulnerability if you don’t understand the underlying weakness that made it exploitable in the first place. However, as we move into intermediate and advanced territory, we encounter the "Walls." For this lecture, we’ll categorize these mitigations in the order they are encountered (BLR): BLR Build-Time Walls: Baked into the binary during compilation (e.g., Stack Canaries, SafeSEH, CFG).
Load-Time Walls: Applied by the OS loader when the program maps to memory (e.g., ASLR, PIE).
Run-Time Walls: Enforced by the CPU and Kernel during execution (e.g., DEP/NX, Sandboxing). Build-Time Walls: Baked into the binary during compilation (e.g., Stack Canaries, SafeSEH, CFG). Build-Time Walls: Load-Time Walls: Applied by the OS loader when the program maps to memory (e.g., ASLR, PIE). Load-Time Walls: Run-Time Walls: Enforced by the CPU and Kernel during execution (e.g., DEP/NX, Sandboxing). Run-Time Walls: Note: I’d also include security products (EDR/AV) operating in user or kernel land here, but in the interest of keeping the SANS SEC660 diagram purists happy, we'll stick to these three. Note: I’d also include security products (EDR/AV) operating in user or kernel land here, but in the interest of keeping the SANS SEC660 diagram purists happy, we'll stick to these three. The Classic Setup The Classic Setup Let’s look at a classic C/C++ snippet using the infamous strcpy() function. No input validation, no sanitization—just a direct copy to a buffer. In a classroom setting, you'd be told to strip all protections to see the "pure" overflow. strcpy() #include <stdio.h>
#include <string.h>

void vuln_func(char *input); 

int main(int argc, char *argv[]) {
    if(argc > 1) {
        vuln_func(argv[1]);
    }
    return 0;
}

void vuln_func(char *input) {
    char buffer[256];
    // The "Sweet" User-land UI meets the "Sour" logic of strcpy
    strcpy(buffer, input);
} #include <stdio.h>
#include <string.h>

void vuln_func(char *input); 

int main(int argc, char *argv[]) {
    if(argc > 1) {
        vuln_func(argv[1]);
    }
    return 0;
}

void vuln_func(char *input) {
    char buffer[256];
    // The "Sweet" User-land UI meets the "Sour" logic of strcpy
    strcpy(buffer, input);
} The "Common" Advice vs. The IHOP Reality The "Common" Advice vs. The IHOP Reality After the first successful exploitation in a lab, the next step is usually enabling NX/DEP. But here is what irks me the most: #WhyDoTheyAlwaysChangeTheCode? #WhyDoTheyAlwaysChangeTheCode? In the industry, we’re taught that certain functions like strcpy() are "legacy" and "easily fixed." We’re told that if we can't inject a null byte, the exploit is dead. That is the Gluten—the filler that makes the process heavy and leads researchers to give up before they've even begun. strcpy() Gluten The common advice says: "Switch to a different function." The IHOP advice says: "Understand why the function thinks it's safe, and use that confidence against it." The IHOP advice says: Instructors often swap out “strcpy()” for “gets()” in labs because they want to avoid the "null-byte" terminating the payload prematurely. But where did the original code go? Did you actually learn to bypass the mitigations for the binary you'll “actually” encounter in the wild? Or did you just learn how to exploit a function that no one uses anymore? strcpy() gets() Most courses skip the basics, leading to an improper adversarial mindset. They treat "bad characters" as a late-stage nuisance rather than the very first barrier. The Zero’ed Wall (Wall 0) The Zero’ed Wall (Wall 0) These functions have unintended characteristics that act as Stream Pipeline Terminators. That is why the first "Wall" isn't a Build-Time Wall. It’s the Stream Terminator Wall. Stream Pipeline Terminators Stream Terminator Wall Note: Sorry to the SANS SEC660 purists—I just added a layer. But since it’s an invisible wall, let’s call it the Zero’ed Wall. Just place it at the bottom of the diagram circling the entire diagram and problem-solved (Wink-wink). Note: Sorry to the SANS SEC660 purists—I just added a layer. But since it’s an invisible wall, let’s call it the Zero’ed Wall. Just place it at the bottom of the diagram circling the entire diagram and problem-solved (Wink-wink). Zero’ed Wall The Modern IHOP Hierarchy of Walls The Modern IHOP Hierarchy of Walls To reach that perfect, golden-brown, Gluten-freE Tropical Strawberry pancake, you have to scale them in this order:0. Stream Terminator Wall (The Null-Byte Barrier)1. Build-Time Walls (Canaries, SafeSEH)2. Load-Time Walls (ASLR, PIE)3. Run-Time Walls (DEP/NX, Sandboxing) The Flavor Reveal: Gluten-freE Tropical Strawberry (G.E.T.S.) The Flavor Reveal: Gluten-freE Tropical Strawberry (G.E.T.S.) Introducing the Gets()Buster Maneuver: Introducing the Gets()Buster Maneuver: You’ve been taught that encountering a null terminator while injecting code into “strcpy()” renders the exploit useless. But have you actually tested what happens under the hood? strcpy() On x64 Linux, “strcpy()” performs a “partial overwrite” as it encounters the null byte terminator (\x00) on the stream. When the Instruction Pointer (RIP) pulls from the stack, it uses the high-order bits and zeroes out the rest. You end up with one specific, truncated address stored in the register when the callee function returns. strcpy() partial overwrite \x00 RIP Simple Adversarial Mindset Question: Simple Adversarial Mindset Question: For the purpose of this exercise, assume your attack vector is local or physical. If you only have one shot at one specific memory address, and you only have one shot at one specific memory address, perhaps pointing to the start of a libc function, to save the exploit from dying, who are you going to call? Ghostbusters? Well, sort of, if they are into that sort of thing. The answer is: The gets() function. The gets() function. The "Gets()Buster" Maneuver The "Gets()Buster" Maneuver Instructors have shown it to you in every "Introduction to Exploit Dev" course, but in reality, you don't get (pun intended) to change the code to “gets()” and recompile the program to your liking... you load “gets()” dynamically from the existing binary to circumvent the restriction instead. gets() you load “gets()” dynamically from the existing binary to circumvent the restriction instead. It is the perfect function to turn your "no null-byte" nightmares into dreams. Granted, your exploit is no longer a "single-level" drop; It becomes a surgical multi-stage operation. But in real-world Red Team engagements, complex exploits are rarely a single shot—they are a choreographed set of stages working toward a singular goal. Picture the following scenario, you’ve gained initial access to a Linux box. You need to escalate privileges. You identify a binary with setuid for the root account, but it’s protected by a strcpy() buffer vulnerability. Who are you going to call? The "Gets()Buster". strcpy() "Gets()Buster". Making the Stack Great Again Making the Stack Great Again Here’s how it works: Stage 1 (The Trigger): Fill the buffer up to the RIP offset. Use the partial overwrite to load the address of gets(). Because strcpy() stops at the null, the transition is clean. Avoid any sort of shellcode at this buffer, random string data would help, to keep it as stealthier as possible.
The Pause: The application pauses at gets(), waiting for input. The "Wall" is now gone.
Stage 2 (The Payload): You feed the full ROP chain/shellcode into the waiting gets() call. This payload performs for example an mprotect syscall to make the stack executable, then returns to the stack to trigger for example a reverse shell or a local shell with root privileges, your call. Stage 1 (The Trigger): Fill the buffer up to the RIP offset. Use the partial overwrite to load the address of gets(). Because strcpy() stops at the null, the transition is clean. Avoid any sort of shellcode at this buffer, random string data would help, to keep it as stealthier as possible. Stage 1 (The Trigger): gets() strcpy() The Pause: The application pauses at gets(), waiting for input. The "Wall" is now gone. The Pause: gets() Stage 2 (The Payload): You feed the full ROP chain/shellcode into the waiting gets() call. This payload performs for example an mprotect syscall to make the stack executable, then returns to the stack to trigger for example a reverse shell or a local shell with root privileges, your call. Stage 2 (The Payload): gets() The "Linux-Fu" execution: ./vulnerablebinary $(cat level1payload) < level2payload The "Linux-Fu" execution: Mission Accomplished. You’ve Scaled Wall 0, bypassed the "Gluten", and escalated to root. Mission Accomplished. Note: The final payload is a custom-engineered chain designed to bypass specific EDR hooks—details are reserved for EDR Evasion clients. Note: The final payload is a custom-engineered chain designed to bypass specific EDR hooks—details are reserved for EDR Evasion clients. A Note On The "Outside The Box" Mentality A Note On The "Outside The Box" Mentality My late grandfather used to say that any training or course you can get is important. However, I’ve been discouraged by the outraging prices of some "standard" certifications. I've found that the "Try Harder" mentality only goes so far—what we need is the "Think Outside the Box" mentality. I want to shout out CyberWarFare Labs, Hack The Box and Trainsec for providing accessible, high-level training with realistic pricing and/or discounts. They are helping keep the adversarial mindset alive for everyone, not just those with corporate-backed wallets. Scaling the Zero’ed Wall: The House of G.E.T.S. Pivot Scaling the Zero’ed Wall: The House of G.E.T.S. Pivot Technical Considerations & Constraints Technical Considerations & Constraints As any Principal Engineer knows, there is no such thing as "magic." For this TTP to land successfully, a few environmental conditions must be met: Symbol Availability: The target function (gets) must be resolvable in the binary's PLT or accessible via a known libc offset.
Stack Alignment: On x64 systems, the stack must be 16-byte aligned before the pivot call. A simple ret gadget in the first stage often solves this.
Register Integrity: The argument register (RDI) must point to a valid writable memory region at the moment of the jump. Symbol Availability: The target function (gets) must be resolvable in the binary's PLT or accessible via a known libc offset. Symbol Availability: gets PLT libc Stack Alignment: On x64 systems, the stack must be 16-byte aligned before the pivot call. A simple ret gadget in the first stage often solves this. Stack Alignment: 16-byte aligned ret gadget Register Integrity: The argument register (RDI) must point to a valid writable memory region at the moment of the jump. Register Integrity: RDI The Adversarial Takeaway The Adversarial Takeaway Why "Tropical Strawberry"? It’s sweet because it’s simple. It’s tropical because it’s outside the "temperate" zone of standard training. When you see it work, you realize the META (Most Effective Tactics Available) was there all along. "Tropical Strawberry"? META For Defenders: Don’t just patch the function—understand the full logic path. NGFWs often inspect only a limited number of bytes, depending on configuration. As data becomes increasingly obfuscated or encrypted, multi-stage pivots can slip straight past them. And just because an attack vector starts local or physical doesn’t mean it can’t be expanded; today, that’s more true than ever.
For Attackers: The CPU doesn't care about the function name; it only cares about the instructions it’s given. If the code is in memory, it belongs to the person who controls the Instruction Pointer.
For the Juniors: It’s a wake-up call that the "lab rules" (changing code to gets, recompile) are training wheels you need to take off.
For the Seniors: Don’t you love Little-Endian surgical overwrites? For Defenders: Don’t just patch the function—understand the full logic path. NGFWs often inspect only a limited number of bytes, depending on configuration. As data becomes increasingly obfuscated or encrypted, multi-stage pivots can slip straight past them. And just because an attack vector starts local or physical doesn’t mean it can’t be expanded; today, that’s more true than ever. For Defenders: For Attackers: The CPU doesn't care about the function name; it only cares about the instructions it’s given. If the code is in memory, it belongs to the person who controls the Instruction Pointer. For Attackers: Instruction Pointer For the Juniors: It’s a wake-up call that the "lab rules" (changing code to gets, recompile) are training wheels you need to take off. For the Juniors: gets For the Seniors: Don’t you love Little-Endian surgical overwrites? For the Seniors: For everyone, never skip over the basics. The same lessons and mindset can be applied in real life, don't let the constraints of a single obstacle (function, stone, obstruction, issues, etc.) stop you. Keep your focus and treat every "wall" as a pivot point. For everyone I hope you've enjoyed this series. I’ll leave it to your creativity to find new ways to make the stack even greater. Just remember to tag the #IHOP so I know that you know. #IHOP Let’s Work Together to Secure Your Architecture Let’s Work Together to Secure Your Architecture Are you looking to validate your enterprise defenses against advanced adversarial emulation? With over 20 years of experience in systems engineering and offensive research, I help organizations move beyond "compliance" and into true security readiness. Are you looking to validate your enterprise defenses against advanced adversarial emulation? Whether it's EDR/XDR evasion testing, vulnerability research, or hardening your Windows/Linux internals, the House of G.E.T.S. is open for high-impact consulting. EDR/XDR evasion testing vulnerability research hardening your Windows/Linux internals House of G.E.T.S. Connect with me on LinkedIn to discuss securing your architecture or to book a consultation for your next Red Team engagement. Connect with me on LinkedIn to discuss securing your architecture or to book a consultation for your next Red Team engagement. Connect with me on LinkedIn Happy exploiting! Cheers! This is a House of G.E.T.S. "Season 1 - Grand Finale”. Special thanks to CyberWarfare Labs’ Evasion and Exploitation Paths and HackTheBox CPTS and Exploitation Labs for the spark to complement this article. And last but not least, Gem & Perple (and their respective devs), you all rock, keep up the great work! This is a House of G.E.T.S. "Season 1 - Grand Finale”. Special thanks to CyberWarfare Labs’ Evasion and Exploitation Paths and HackTheBox CPTS and Exploitation Labs for the spark to complement this article. And last but not least, Gem & Perple (and their respective devs), you all rock, keep up the great work!

This story contains new, firsthand information uncovered by the writer.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

The House of G.E.T.S.: A Practical Bypass for the Null-Byte Barrier

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Escaping a Python sandbox with a memory corruption bug

How to Join the Offensive Security Highs (Part 1 of the Journey)

How to Prepare Against Sophisticated Cyber Attacks

Installing KALI LINUX on a Virtual Machine [A Step by Step Guide]

5 Popular Professions in Cybersecurity

A Guide to Examining & Modifying Executable Code

Escaping a Python sandbox with a memory corruption bug

How to Join the Offensive Security Highs (Part 1 of the Journey)

How to Prepare Against Sophisticated Cyber Attacks

Installing KALI LINUX on a Virtual Machine [A Step by Step Guide]

5 Popular Professions in Cybersecurity

A Guide to Examining & Modifying Executable Code

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps