2

I am new to buffer overflow attacks and I am trying to do the same on a sample c code which I have.

  • I have three variables a, b and buffer.
  • a and b have values assigned to them in the code itself. buffer interactively takes user input. The value of 'buffer' is not taken from the argument.
  • My intention is to overflow buffer such that it will overwrite b with a desired value. Overwriting EIP or ESP is not the intention here.
  • With gdb I was able to figure out that if I pass on a certain number of values it would overwrite the value of variable b.
  • However I am stuck here as gdb doesn't allow me to type or paste the ASCII characters which corresponds to the desired value of b. For example consider 1356 is the desired value. The hex for the same is 0x0000054C. So to overwrite b, I should give in the ASCII of 4C, 05, 00 and 00 in gdb as the last four bytes of the input respectively. Unfortunately this is not possible.
  • Another way which I found on web is to pass the hex values using perl. However this method pipes the perl output to the code argument. The variable which I am overflowing here takes it's value from user input while executing the program interactively and not the from the program argument.

Is there a way to pass hex values to non-argument parameters to perform stack based buffer overflow?

  • Did you try converting the hex to string, store it in a file and then passing that string as an input to the program by: ./my_program < my_file – Limit Nov 12 '16 at 17:06
  • That worked for me in a college assignment. – Limit Nov 12 '16 at 17:06
3

A few techniques to achieve this is discussed over here

Methods 1 and 2 should work outside gdb as well.

Edit: (The techniques are copy-pasted below to preserve them)

Method #1:

perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/input
gdb ./a.out
(gdb) run < /tmp/input   # voila: GDB reads terminal,
                         # your program reads /tmp/input

Or outside gdb:

$ perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/input
$ ./foo < /tmp/input

Method #2:

mkfifo /tmp/pipe
perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/pipe &
# perl will block, waiting for someone to read the pipe
gdb ./a.out
(gdb) run < /tmp/pipe

This is also usable outside gdb in the manner described before.

  • 1
    Hi arman! On Stack Exchange, it's generally recommended to quote the most important parts of a link just in case it later goes off-line - that can happen with SO links, too, as posts get deleted or edited. – Xiong Chiamiov Nov 12 '16 at 17:18
1

The solution to this was simple. I had to find a way to type the ASCII corresponding to 4C, 05, 00 and 00 hex values in the prompt. After a little bit of googling I figured the following

4C - L

05 - ctrl + E

00 - ctrl + @

Source : http://academic.evergreen.edu/projects/biophysics/technotes/program/ascii_ctrl.htm

  • While this works, isn't it a bit hectic? You would need to check the corresponding ASCII mapping every time you wanted to enter a hex value. That would become cumbersome over large inputs. – rhodeo Nov 13 '16 at 9:01
0

Here's some C code that overflows three non-argument parameters.

int main()
{
   char s[8];
   int x, y, z;

   strcpy(s, "This is some text");
   return(0);
}

"this is " will go into s, x will get "some", y will get " tex" and z will get "t followed by a null character.

You'll probably get a warning (error?) from the compiler that s is going to overflow.

  • Oops, make that four parameters. – Swashbuckler Aug 14 '16 at 2:18
  • I will try to explain my issue in the context of your comment. s isn't hard coded in my case as it is in the program you have given. Rather it uses read() from STDIN to take user input. In this user input how can I give the desired hexadecimal characters? – hax Aug 14 '16 at 2:22
  • @hax: with python you can do something like python -c "print '\xAB\xED\x0a" | yourprogram – kaidentity Aug 14 '16 at 15:26
  • @kaidentity Yes we can. But using python would pass the value to the argument if the C program. I won't be able to interactively provide input to the C program. – hax Aug 14 '16 at 15:28
  • Why does it need to be interactive? – kaidentity Aug 14 '16 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.