0

Offsets in buffer overflows I can't seem to get a grasp on. Here is a quote from the book I am reading about this topic.

The address of the variable "i" in main()'s stack frame is used as a point of reference. Then an offset is subtracted from that value; the result is the target return address.

  1. What is an offset?
  2. Why do I need the offset when exploiting?
  3. How does using a nearby stack location as a frame of reference aid my ability in finding an offset?
  4. Explain how the quote above finds the return address using an offset
|improve this question
  • 1
    Have you read sans.org/reading-room/whitepapers/threats/… – Rory Alsop♦ Jul 24 '16 at 23:01
  • @RoryAlsop According to page 16, point 2... An offset is an approximated distance from a variable in stack near the target variable? – Samuel F Jul 24 '16 at 23:10
  • @RoryAlsop As I read this more I don't think my previous comment is the answer. I am clueless. It looks like a random number – Samuel F Jul 25 '16 at 0:39
1

When you are overflowing a buffer to write on the stack in a way which is exploitable you will overwrite the return address on the stack. Ie, sending a long string of AAAAAAAAAAAAAAAAAAAAAAAAAAA.....AAAAAAAAA will result in EIP containing the value 0x41414141 when the application crashes.

The reasons for this is all well documented in lots of places on the internet. Aleph1's smashing the stack for fun and profit or the Corelan tutorials are great places to read more information, but on to the question at hand.

While having control of EIP is great it doesn't instantly lead to running code of your choosing. When the function epilogue pops the return address of the stack it will continue to execute the instructions at that memory location. So you will need to supply a different value than 0x41414141. The first problem is that you don't know which 4 A's in your string are the one located in EIP. This distance from the first A to the 4 A's that overwrite EIP is commonly called the offset. You can work this out manually by swapping between values suc as AAAABBBBCCCCDDDD....etc or you can use one of the pattern generators that can calculate the offset for you.

Once you know the offset you can hardcode the address where your shellcode should sit on the stack (easiest for beginners) or find a gadget that will land you back on the stack where your shell code is (f.ex: jmp esp) and write that memory location to EIP.

|improve this answer
  • Everything makes perfect sense, until the manual part. I can swap those value til the end of time but how will I know I've hit it? Also, do you know how the method that the author uses works? I am also confused on it – Samuel F Jul 25 '16 at 2:12
  • Use a debugger and set a break point, then step through and watch how the stack changes. Maybe take notes so you can compare points in time. It's one of those things where it suddenly clicks and you get it. The step by step approach may help that alot. – wireghoul Jul 25 '16 at 2:22
  • Okay, when going through gdb until the crash I see that my eip is four "L"s. Fantastic! But, as I went through gdb my return address never changed until the crash. I even set a breakpoint during the execution of the outside function to see if the return address changed, no dice. Why does it take until the end to receive a change? Also, you didn't answer on how the subtraction method works... I'm still puzzled on that. – Samuel F Jul 27 '16 at 2:42
  • Yes, the memory address of i on the stack minus the offset will equal the address on the stack where your eip overwrite value is located. For your breakpoint, set it before the strcpy/whatever and step into. Then you can see how it overwrites the return value on the stack. – wireghoul Jul 27 '16 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.