8

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bof(char *str)
{
    char buffer[12];
    strcpy(buffer,str);
    return 1;
}

int main(int argc, char **argv)
{
    char str[517];
    FILE *badfile;

    badfile = fopen("badfile", "r");
    fread(str, sizeof(char), 517, badfile);
    bof(str);
    printf("Returned Properly\n");
    return 1;
}

I understand I need to inject the shell code in "badfile", suppose I create a badfile like this:

char buffer[517];
FILE *badfile;
memset(&buffer, 0x90, 517);
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);

Do I inject it at index 12th of buffer[]? I'm facing a problem with that. But I believe that is because it's not the return position. Do I have to calculate the return position? Thanks.

2
  • IMHO, compiler did not actually allocated 12 bytes for this array, you have to see what is the real offset on stack for this array, and then do what you are planning to do :) maybe some landing pad before ;) Oct 9, 2012 at 6:15
  • 4
    Make a large line full of a few hundred AAAAAAAAAAAAAAAAAAAAAAAA... and watch this code run in a debugger.
    – Polynomial
    Oct 9, 2012 at 6:21

3 Answers 3

9

No, not quite.

There are two things to focus on:

  • Overwriting the return address. You need to figure out what bytes in the file will end up overwriting the return address. Suppose these are bytes 20-23 of the file (for example).

  • The location of the shellcode. You should put your shell code later in the file (say, near the end). Then you need to predict what address your shell code will be loaded into memory at. Suppose A is the address where the shellcode will be loaded into memory. You need to know this address, because this is what you need to use to overwrite the return address.

Once you know both of these, you're good to go. You store the value A into bytes 20-23 of the file, and the shell code later in the file where you decided to put it.

To work out these two things, you'll need to look at the stack layout.

  • First, find the offset between the location where the start of str appears on the stack and the location where return address appears. This offset tells you what bytes in the file will end up overwriting the return address. If this offset is, say, 20 bytes, then bytes 20-23 of the file will end up being written over the return address. To make the attack work, 20 bytes into the file you need to put a value that is where you want the program to jump to (the address of the start of your shell code). This value will overwrite the return address. The value to put there is the address A mentioned above.

  • Second, put the shell code even later in the file, predict what address the shell code will be stored at in memory once the file is read into memory, and use that starting address as the value to overwrite the return address with.

I recommend that you read Smashing The Stack For Fun And Profit by Aleph One. It has an excellent tutorial on learning how to do a stack-smashing buffer overrun exploit. (Hint: on modern systems, make sure to manually disable ASLR and DEP first, so that your exploit will work.)

1
0

It is definitely a vanilla buffer overflow. But you also need to find the exact offset of where the return pointer is stored on the stack. (Hint: it is definitely not 12 bytes, consider the saved EBP that is stored). You are right, you also need to calculate the return address of the shell code you inject into the badfile. Let me warn you though, since the buffer is only 12 bytes here, I believe it is hard to inject a 12 byte shell code in that space. Look around to see if you can find one. But you can put the shell code into the later part of the stack as the buf in main is 517 bytes long. This means the top 12 bytes of your file can be junk.

Tips: http://www.securitytube.net/groups?operation=view&groupId=4

Treat the above video tutorial to buffer overflows as a bible for buffer overflows

Use GDB, trace your code, keep an eye on the stack pointer, the stack itself.

0

Yyour buffer is too small to fit shell code + return address. Make it a bit larger if you plan to test the concept. Also, you can put the shellcode in the ENV.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .