Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to implement return-to-libc,
here's the code

void func(const char *str) {
    char buf[4];
    strcpy(buf,str);
    printf("you entered [%s]\n",buf);
}

int main(int argc, char *argv[]) {
    if(argc != 2) {
        printf("Need an argument\n");
        return 0;
    }
    func(argv[1]);
    return 0;
}

Now the problem is, the address of the system function that my pc gives me is of 6 hex digits instead of 8 hex digits (which means the front two digits are zeros), but I use strcpy to copy the string, which terminates copying the string as soon as it encounters null character.

Any ideas how to copy the whole string I pass including the null character ?
Or anything that you feel will help me with this, is appreciated.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Short Answer : It's not possible directly in strcpy.


Answer : Null character is end of string in strcpy ! and you can't inject directly null character .

But you can use to shellcode encoders/encryptors/compressor for removing your shellcode null character or you can use other functions with other string terminator. for example gets (in gets string terminator is, 0A)

share|improve this answer
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void func(const char *str) {
    char buf[4];
    strcpy(buf,str);
    printf("you entered [%s]\n",buf);
}

int main(int argc, char *argv[]) {
    if(argc != 2) {
        printf("Need an argument\n");
        return 0;
    }
    func(argv[1]);
    return 0;
}

I compiled your code with the following command.

gcc blah.c -o blah

Cracked open gdb.

[ayrx@localhost ~]$ gdb -q blah 
Reading symbols from /home/ayrx/blah...(no debugging symbols found)...done.
(gdb) run AAAAAAAAAAAAAAAABBBB
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/fedora/blah AAAAAAAAAAAAAAAABBBB
you entered [AAAAAAAAAAAAAAAABBBB]

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()

Here is the register dump from gdb.

(gdb) info registers
eax            0x23 35
ecx            0x7fffffde   2147483614 
edx            0x0  0
ebx            0x4e735000   1316179968
esp            0xbffff160   0xbffff160
ebp            0x41414141   0x41414141 
esi            0x0  0
edi            0x0  0
eip            0x42424242   0x42424242
eflags         0x10286  [ PF SF IF RF ]
cs             0x73         115
ss             0x7b         123
ds             0x7b         123
es             0x7b         123
fs             0x0          0
gs             0x33         51

As you can see, the eip register has been overwritten with the last 4 Bs from my input.

The final step will be to overwrite the eip register to point to the location of your shellcode. Since your buffer is small, you will have to find some other memory location to stash the shellcode. Overwrite the eip register to point to that location and you have won. I'll leave that part to you.

share|improve this answer

So you can't jump directly to system in this case. You might consider looking for some other library function that you can jump to that will do something useful for you. Or you can extend this to a generic return oriented programming attack, and jump to a series of code fragments.

In this case, you would look for some (position dependent) code fragments that give you the ability to derive the address of system and jump to it. You might look for a gadget which performs the and instruction and use and 0xcc 0x33 to get 0x00 or whatever. You will then need a gadget that then lets you jump to your derived address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.