11

I'm trying now buffer overflow exercise from the site pwnable.kr I found the string that should be entered to the gets frunction but got "Stack Smash Detected" then I found a solution in rickgray.me

They suggest (python -c 'print "A" * 52 + "\xbe\xba\xfe\xca"'; cat -) | nc pwnable.kr 9000

which works, Somehow adding the "cat -" command overcomes the canary. I don't understand why is that

Improve this question
1
  • 1
    "cat -" tells the netcat to leave standard in open and allow for further requests if a shell is open, so you can interact with your port-bounded shell on the server. You may already know that. However I don't know why that would stop Stack smash detected.
    – dylan7
    Jan 28, 2016 at 15:49

1 Answer 1

Reset to default
3

This avoids the stack smashing detection because the checking of the stack cookie/canary happens only at the function's epilogue.

Since the challenge you posted requires smashing something on the stack directly that is used in a logic check in the same function, the canary isn't checked by the time you receive your shell.

The canary mainly prevents against stack smashing to overwrite the return address.

The comment on the question about the cat command being present to allow input/output redirection is correct, otherwise the shell opens and is immediately closed.

Improve this answer
2
  • 1
    Just a small comment, I believe "instruction pointer" should be replaced with "return address".
    – RoraΖ
    Feb 4, 2016 at 13:38
  • This should be the accepted answer, as it's right.
    – Michael
    Aug 30, 2016 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .