1

I need to produce a presentation on buffer overflows for a college class. I managed to create a simple buffer overflow where i inject the address of a specific function on the EIP and the function gets executed as expected.

Then, i want to show the more interesting example where i inject shellcode that gets executed. That's when it stops working. I emulated the way people explained it on various websites, but it doesn't work.

Regardless of the shellcode i use (Shellcode), the issue is that the code i injected doesn't get executed. So the program jumps to the correct address, then stops without executing whatever is at the address.

EIP contains 0xbffff2e0 as expected, but the program just stalls and doesn't do anything.

So as you may see in central section of the picture, named "code", the program accesses my nop sled, at address 0xbffff2e0 (shellcode starts 4 bytes below), but nothing happens.

Then, the error output says that it tried to access 0xbffff2e0 but couldn't find anything (see bottom of the image : "0xbffff2e0 in ?? ()" ).

Do you have an idea on what's happening?

What am i missing?

Edit : i'm adding the code used in this exercise, as asked

#include <stdio.h>
#include <string.h>

void secret(){
        printf("This is a secret message : you are Awesome!\n");
}

void denied(){
        printf("You don't have the permission to see the secret.\n");
}

int main(int argc, char *argv[]){
        char buf[20];

        strcpy(buf, argv[1]);
        printf("%s\n",buf);

        if(strcmp(buf, "myPassword") == 0){
                secret();
        }
        else{
                denied();
        }

        return 0;
}
  • Can you share the code that you are trying to overflow? – Limit Dec 8 '16 at 4:02
  • I edited my message to include the code. – Loïc N. Dec 9 '16 at 16:50
2

The stack is probably non-executable. Compile the vulnerable program like this to disable the protection:

gcc -z execstack -o program program.c
  • Thanks for your comment. I'm testing this solution, but i'm encountering new issues, where somehow, the rightmost byte of the address i specified for my shellcode gets modified, pointing the EIP towards a different address. But when i try to put 'BBBB', as an address, i correctly get '42424242'. I don't know what's going on here. – Loïc N. Dec 9 '16 at 22:51
1

Aside from the answers already given here, you might want to check on bad characters. Your shellcode might contain some which could lead to the problem you are encountering. It could also be the reason why your EIP overwrite is not working as intended, where one (or more) byte(s) in the address you are trying to inject is a bad character. For starters, 00, 0d, and 0a are almost always bad characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.