2

I have a assignment where i must exploit a buffer overflow vulnerability on a remote machine. I have only execute permission on the program, so i cant use gdb. I managed to take control of the rip and i can successfully overflow and write my own address. My shellcode is ready (it has executable stack and ASLR disabled) but i cant find the right address to return. It is a 64bit machine so nop padding is not an option. The main goal is to access a log file which the executable updates every time it runs. (it's a university assignment do not worry about illegal actions)

What can i do? Is there a way to calculate the memory address of the buffer, or another way? Any help would be appreciated

Improve this question
16
  • Do you really need the buffer's address ? Can't you inject your data in the executable when he ask for some inputs ?
    – Walfrat
    Commented May 29, 2017 at 8:46
  • This is what I do, but i need to return to this data so my shellcode executes. I am not sure i understood your question. I inject my shellcode, pad with garbage and then overwrite the return address. Are you suggesting something different?
    – George Sp
    Commented May 29, 2017 at 8:59
  • The return address is not usually address of the shell code directly. It is usually address of some jump (far or relative, depends what is better in actual case) instruction in main program or one of libraries (usually system libraries) loaded. You have to find such instruction (only with ASLR off it will be always on the same address in memory) then you force CPU to return to this instruction (by filling the stack with appropriate data) then this instruction is supposed to run your code stored using stack overflow method.
    – Fis
    Commented May 29, 2017 at 9:06
  • To achieve this you usually need the software you are trying to hack and same kernel + library versions installed on your computer. Also, you need to have some good debugger. Doing this blindly will cause you headache.
    – Fis
    Commented May 29, 2017 at 9:08
  • I have the source code and i have compiled it with the right flags so it matches the real. Where can i find the system libraries? Also, i have an idea. What will happen if i store my shellcode in environment variables, find it's address and return to it?
    – George Sp
    Commented May 29, 2017 at 9:28

1 Answer 1

Reset to default
3

If you fimilar with gdb and can control rip, then you are one step away from the solution.

Let's make a small example

void main() {
  char* buff = "asdf";
}

compile it

$ gcc test.c

and then use debugger

$ gdb a.out
 (gdb) set disassembly-flavor intel
(gdb) disassemble main
Dump of assembler code for function main:
 0x00000000004004d6 <+0>:   push   rbp
 0x00000000004004d7 <+1>:   mov    rbp,rsp
 0x00000000004004da <+4>:   mov    QWORD PTR [rbp-0x8],0x400574
 0x00000000004004e2 <+12>:  nop
 0x00000000004004e3 <+13>:  pop    rbp
 0x00000000004004e4 <+14>:  ret    
End of assembler dump.

So our variable buff is at rbp-0x8 on the stack. If ASLR disabled - the address is always the same. You can get it with:

(gdb) break *0x00000000004004e2
Breakpoint 1 at 0x4004e2
(gdb) r
Starting program: ./a.out 
Breakpoint 1, 0x00000000004004e2 in main ()
(gdb) p $rbp-0x8
$1 = (void *) 0x7fffffffdbd8
Improve this answer
2
  • I am not sure i understand you. But in my case the program is more complicated. There is a function in main which returns another functions exit code and inside the last is strcpy where i overflow the buffer. So i dont know how to calculate the buffer address like you did.
    – George Sp
    Commented May 29, 2017 at 10:42
  • 1
    Then you need to run (gdb) disassemble <name of the function where strcpy is>. If you post its output here we can look into it.
    – ATetereb
    Commented May 30, 2017 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .