This is for a Computer and Network Security class. I am not asking for the solution, rather just a pointer in the right direction.
The target program has an off-by-one vulnerability and is compiled such that
ebp is not pushed on the stack. By attacking the vulnerability, I am able to change the last byte of the
eip and effectively send the program to any instruction in the program.
My question is, if I place some malicious code in the exploit program (that calls the target program via an
execve), can I change the
eip to point to this malicious code, or is the runtime smart enough to know that I am attempting to execute code that is located outside the bounds of the target program and thus, not allow it?
The environment is a stripped down Debian Etch VM with no ASLR etc. The target program has
setuid set to root, so my goal is to get the target program to execute instructions that pull up a shell (giving me root shell).