1

I am having trouble figuring out the right address to use a buffer overflow script against to gain access to the admin menu. I have found what the address is but when using a perl script with the address it still won't let me access the menu.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
{
// define to allow administrative access, undef to restrict
#undef ADMINISTRATIVE 
//#define ADMINISTRATIVE

// function prototypes for "main.c" functions

int main (int argc, char *argv[]);
void list(void);
void add(void);
void quit(void);
void delete(void);
void deleteall(void);
void normal(char *user);
void administrative(char *nothing);
void debug(char *nothing);
void rot13(char *user, char *rot13pwd);

typedef void (*menufunctype)(char *);
typedef void (*userfunctype)(void);
typedef void (*adminfunctype)(void);

// jump table for non-administrative functions
userfunctype userfunc[3] = {add, list, quit};

// jump table for administrative functions
adminfunctype adminfunc[5] = {delete, deleteall, add, list, quit};


int main (int argc, char *argv[]) {

  menufunctype menufunc[3]={debug, administrative, normal};
  char rot13pwd[20];
  char user[20];
  char pwd[20];

  printf("Enter authorization code: "); fflush(stdout);
  gets(pwd);
  printf("Enter username or \"admin\" for admin functions: "); fflush(stdout);
  gets(user);

  // authenticate user
  rot13(user, rot13pwd);

  if (strcmp(pwd, rot13pwd)) {
    puts("Authentication FAILED.  Access denied.\n");
    exit(1);
  }


  if (! strncmp("debug", user, 5)) {
    (*menufunc[0])(user);
  }
  else if (! strncmp("admin", user, 5)) {
#if defined(ADMINISTRATIVE)
    (*menufunc[1])(0);
#else
    puts("NO ADMINSTRATIVE ACCESS AVAILABLE--SEE YOUR SYSTEMS ADMINISTRATOR.");
#endif
  }
  else {
    (*menufunc[2])(user);
  }
}

// menu for users with non-administrative access
void normal(char *user) {
  char buf[40];
  char normalaccessfile[20]=".normal_access";
  char choice[2];
  int ch;

  // audit trail
  sprintf(buf, "echo %s >> %s", user, normalaccessfile);
  system(buf);

  while (1) {
    puts("\n##### MENU ######\n");
    puts("[0] Add a record");
    puts("[1] List all records");
    puts("[2] Exit\n");
    printf("Choice: "); fflush(stdout);
    gets(choice);

    // audit trail
    sprintf(buf, "echo %c >> %s", choice[0], normalaccessfile);
    system(buf);

    ch = atoi(choice);
    if (ch < 0 || ch > 2) {
      puts("Invalid choice.\n");
    }
    else {
      (*userfunc[ch])();
    }
  }
}

// menu for administrators
void administrative(char *nothing) {
  char buf[80];
  char administrativeaccessfile[80]=".admin_access";
  char choice[2];
  int ch;

  while (1) {
    puts("\n----- RESTRICTED ADMIN MENU -----\n");
    puts("[0] Delete a record");
    puts("[1] Delete all records");
    puts("[2] Add a record");
    puts("[3] List all records");
    puts("[4] Exit\n");

    printf("Choice: "); fflush(stdout);
    gets(choice);

    // audit trail
    sprintf(buf, "echo %c >> %s", choice[0], administrativeaccessfile);
    system(buf);

    ch = atoi(choice);
    if (ch < 0 || ch > 4) {
      puts("Invalid choice.\n");
    }
    else {
      (*adminfunc[ch])();
    }

  }
}


// menu for debug account
void debug(char *nothing) {


  system(nothing);
}


// USER FUNCTIONS

// list all records
void list() {
  puts("*** LIST ***");
}

// add a record
void add() {
  puts("*** ADD ***");
}


// ADMINISTRATIVE FUNCTIONS

// delete a record
void delete() {
  puts("*** ADMIN: DELETE ***");
}

// delete all record
void deleteall() {
  puts("*** ADMIN: DELETE ALL ***");
}


// UNRESTRICTED

// quit
void quit() {
  puts("*** BYE ***");
  exit(1);
}


// ROT13 calculation
void  rot13(char *user, char *rot13pwd) {
  int i;
  char cap;

  for (i=0; i < 20; i++) {
    rot13pwd[i] = user[i];
    cap = rot13pwd[i] & 32;
    rot13pwd[i] &= ~cap;
    rot13pwd[i] = ((rot13pwd[i] >= 'A') && (rot13pwd[i] <= 'Z') ? 
           ((rot13pwd[i] - 'A' + 13) % 26 + 'A') : rot13pwd[i]) | cap;
  }
  rot13pwd[20]=0;
}

}

closed as off-topic by Xander, grochmal, schroeder Nov 22 '16 at 7:45

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Hi, and welcome to security.stackexchange.com! Unfortunately, the format of your post made it unreadable, so I used the editor to mark it as "code" (the tool button identified by the "{}" symbols.) Next time you're posting code, please look at the preview of your work and use the built-in editor tools to help you. – John Deters Nov 21 '16 at 22:47
  • 1
    Moreover, the question is off-topic because it is not a small verifiable example. Even If I compile the given code, the address override will depend on my compiler, code optimisation and even on hardware used. Without that information the question isn't answerable. – grochmal Nov 22 '16 at 0:21

Browse other questions tagged or ask your own question.