bufferoverflow ????
Posted: Sun Jun 06, 2010 7:16 pm
OK , I am still not successful in setting up my buffer overflow demo.
this is exploit.c
I am trying to pass ./exploit something that will return it to printitifyoucan() which should print the message "exploit has occured"
What I have done is
turn off randomization
compile/link exploit.c
then used objdump to find the printitifyoucan() function by disassembling
which gives
so the stack must be overflowed so as to have the return address be 08048465 so it will return to the printitifyoucan()
However no matter what string I give it it just returns fine and displays the two strings
Got here!got to end of program? but it doesn't display mine let alone crash at all (no segment fault or nothing ????)
I have been using stuff like perl to pass larger strings to ./exploit but no combo works ?
I can add some NOP \x90 to it if it is a shifting issue... not I am not trying to execute shellcode just overflow the return address so I can see it print my exploit message ....etc
Anybody see something I am overlooking (maybe I forgot to turn something else off with secuity in gcc that I am not aware of? )
I am pretty sure the address needs to be in little endian form. I am on ubuntu intel x86 machine.
Thanks for any help I would really like this to work.
this is exploit.c
Code: Select all
#include <stdio.h>
#include <string.h>
void bufferoverflow( char * ) ;
void printitifyoucan() ;
int main(int argc, char** argv) {
bufferoverflow( argv[0]) ;
printf("got to end of program?") ;
return 0;
}
void bufferoverflow( char *str)
{
printf("Got here!") ;
char buffer[20] ;
strcpy(buffer,str) ;
return ;
}
void printitifyoucan()
{
printf("exploit has occured" ) ;
}
I am trying to pass ./exploit something that will return it to printitifyoucan() which should print the message "exploit has occured"
What I have done is
turn off randomization
Code: Select all
sysctl -w kernel.randomize_va_space=0
Code: Select all
gcc -fno-stack-protector -z execstack -c exploit.c
gcc -fno-stack-protector -z execstack -o exploit exploit.o
Code: Select all
objdump -d exploitCode: Select all
....
08048465 <printitifyoucan>:
8048465: 55 push %ebp
8048466: 89 e5 mov %esp,%ebp
8048468: 83 ec 18 sub $0x18,%esp
804846b: b8 61 85 04 08 mov $0x8048561,%eax
8048470: 89 04 24 mov %eax,(%esp)
8048473: e8 d8 fe ff ff call 8048350 <printf@plt>
8048478: c9 leave
8048479: c3 ret
804847a: 90 nop
804847b: 90 nop
804847c: 90 nop
804847d: 90 nop
804847e: 90 nop
804847f: 90 nop
....
However no matter what string I give it it just returns fine and displays the two strings
Got here!got to end of program? but it doesn't display mine let alone crash at all (no segment fault or nothing ????)
I have been using stuff like perl to pass larger strings to ./exploit but no combo works ?
Code: Select all
./exploit `perl -e 'print "\x65\x84\x04\x08" x 202;' `
I can add some NOP \x90 to it if it is a shifting issue... not I am not trying to execute shellcode just overflow the return address so I can see it print my exploit message ....etc
Anybody see something I am overlooking (maybe I forgot to turn something else off with secuity in gcc that I am not aware of? )
I am pretty sure the address needs to be in little endian form. I am on ubuntu intel x86 machine.
Thanks for any help I would really like this to work.