0

I'm trying to exploit some buffer overflow through linux terminal of a program I've written for self education. I'm inputting a string usnig scanf("%s") and my goal is to overrwrite the return address over the stack frame my problem is the following, I need to overwrite the return address to become the value of 0x08048934 hence when taking a consideration of the endianity within my computer I need to enter the sequence of byte hex value of

0x34 0x89 0x04 0x08 

and this is where I'm finding difficulty.... It appears to me that I can't enter directly into the ubuntu terminal the values of extended-ascii characters, such as the one with the value of 0x89 or 137 in decimal which is an extended value...

How do I overcome this difficulty and create a string that contains the following values and allows me to create the desired address

p.s. When using ctrl + shift + u and the hex value 0x89 the character gets coded as a c1 utf-8 character hence the literal I get it \xc2\x89 also this may be unclear, I may be dependent on some output prints of the program such as address or etc hence I must type in the manipulated value during runtime of the program (After it has started executing) and not before

closed as off-topic by crovers, Steve, Xander, Xiong Chiamiov, Marcus Müller Jan 17 '17 at 21:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Marcus Müller
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Well, this doesn't really have anything to do with security. The question is just about inputting non-ascii (or non-your-current-locale) character. Buffer overflow is irrelevant to it. – domen Jan 17 '17 at 14:17
  • 1
    I agree with @domen. Just for your idea, you need to parse Hex to a string and then input that string into the program. You can do a simple output redirection from hex to string converter to your program – Limit Jan 17 '17 at 14:24
  • technically yes it isn't yet it is more likely that people whom are familiar with computer security would know techniques that allows to overcome such difficulties – DrPrItay Jan 17 '17 at 14:30
1
echo -en '\x34\x89\x04\x08' | your_program
  • what if I'm dependent on some output of the program? and cant do it ahead of it running (which is my actual problem ) – DrPrItay Jan 17 '17 at 14:30
  • echo -en "\x${a0}\x${a1}..."? – domen Jan 17 '17 at 14:33
  • But surely it's not way much work than typing, which you were trying to do originally :P – domen Jan 17 '17 at 14:33
  • ehhh sorry I didn't quiet get the last one... just to make things more clear, e.g I'm somehow getting the output of the stack base address and I need to overwrite another thing regardless the return address hence I can't do it ahead of execution... – DrPrItay Jan 17 '17 at 14:36
  • Ah, I misunderstood. Maybe you can make a script interact with your software (or a script that waits for your input, and then transforms it into binary?). Or maybe you could use one of /proc/<pid>/fd/, to feed data directly there. – domen Jan 17 '17 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.