Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

so few days ago I started reading a paper about bypassing SSP/ProPolice and after I read it all I tryed that bypasses but they didn't work. The code I used is this:

int f (char ** argv){
    int pipa; // useless variable
    char *p;
    char a[30];

    p=a;

    printf ("p=%x\t -- before 1st strcpy\n",p);
    strcpy(p,argv[1]);        // <== vulnerable strcpy()
    printf ("p=%x\t -- after 1st  strcpy\n",p);
    strncpy(p,argv[2],16);
    printf("After second strcpy ;)\n"); }

void main (int argc, char ** argv){ f(argv); execl("back_to_vul","",0); //<-- The exec that fails printf("End of program\n"); }

And the compile command is: gcc -fstack-protector -z execstack -o f f.c So basically my problem is the reordering variable that place &p and &a above their buffer so that I cannot overwrite p's address by send large buffer. How I could bypass this?

share|improve this question
    
Could you post a link to the paper? –  Michael Jun 6 '13 at 21:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.