0

I'm trying to learn binary exploitation, and thought of using online samples to train myself. Here's one that I've found, and I can't see to figure out how to exploit it.

int main(int argc, char** argv[])
{
  uint32_t number = 0;
  uint32_t guess = 0;
  char input[8] = {0};

  FILE* devRand = fopen("/dev/urandom", "rb");
  if(devRand == NULL)
  {
    printf("I can't think of a number");
    return EXIT_FAILURE;
  }

  fread(&number, 1, 4, devRand);
  fclose(devRand);

  printf("What number am I thinking of?\n");
  fflush(stdout);

  bool correct = false;
  do
  {
    fgets(&input[0], 28, stdin);
    guess = strtol(&input[0], NULL, 16);

    if (number == guess)
    {
      correct = true;
      printf("Yes!\n");
      fflush(stdout);
      system("/bin/sh");
    }
    else
    {
      printf("No\n");
      fflush(stdout);
    }

  }
  while(!correct);

  return EXIT_SUCCESS;
}

It would be appreciated if someone can give me a detailed explanation of the exploit, how it works, and how it can be mitigated.

Thanks!

5
  • 1
    Because fgets reads 28 chars onto an 8 char buffer...
    – AstroDan
    Nov 4, 2016 at 14:50
  • You won't get any meaningful feedback if you don't show you did some research yourself. Just asking the community to tell you the solution won't help. The problem with this code is pretty obvious and if you don't see it you should maybe do some research on common coding errors in C related to security...
    – kaidentity
    Nov 4, 2016 at 14:50
  • @kaidentity thanks for pointing that out. I'm aware that it's a buffer overflow exploit, but I was hoping someone could explain it in detail in beginner terms.
    – rashidx
    Nov 4, 2016 at 15:02
  • The book "the art of exploitation" covers stuff like this in detail.
    – kaidentity
    Nov 4, 2016 at 15:10
  • Side note: the input is expected to be in base 16, which seems unusual. Given the fact that the program only prints a yes/no answer (as opposed to lesser/greater), finding the number could take a while... Nov 4, 2016 at 23:15

1 Answer 1

3

fgets can read in up to 28 bytes into an 8 byte array.

char input[8];

...

fgets(&input[0], 28, stdin);

Type in 28 bytes of data when prompted, and you'll overflow the input variable. This means that the both guess and number will be overwritten with the first 8 bytes of data past the 8 bytes the array can hold. Any more data provided will continue to overwrite stack protections, and eventually the return address of the function (and beyond).

You can learn more about buffer overflows in this question.

This can be mitigated by making sure you don't read in more bytes than your buffer is allocated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .