2

I have a assignment where i must exploit a buffer overflow vulnerability on a remote machine. I have only execute permission on the program, so i cant use gdb. I managed to take control of the rip and i can successfully overflow and write my own address. My shellcode is ready (it has executable stack and ASLR disabled) but i cant find the right address to return. It is a 64bit machine so nop padding is not an option. The main goal is to access a log file which the executable updates every time it runs. (it's a university assignment do not worry about illegal actions)

What can i do? Is there a way to calculate the memory address of the buffer, or another way? Any help would be appreciated

  • Do you really need the buffer's address ? Can't you inject your data in the executable when he ask for some inputs ? – Walfrat May 29 '17 at 8:46
  • This is what I do, but i need to return to this data so my shellcode executes. I am not sure i understood your question. I inject my shellcode, pad with garbage and then overwrite the return address. Are you suggesting something different? – George Sp May 29 '17 at 8:59
  • The return address is not usually address of the shell code directly. It is usually address of some jump (far or relative, depends what is better in actual case) instruction in main program or one of libraries (usually system libraries) loaded. You have to find such instruction (only with ASLR off it will be always on the same address in memory) then you force CPU to return to this instruction (by filling the stack with appropriate data) then this instruction is supposed to run your code stored using stack overflow method. – Fis May 29 '17 at 9:06
  • To achieve this you usually need the software you are trying to hack and same kernel + library versions installed on your computer. Also, you need to have some good debugger. Doing this blindly will cause you headache. – Fis May 29 '17 at 9:08
  • I have the source code and i have compiled it with the right flags so it matches the real. Where can i find the system libraries? Also, i have an idea. What will happen if i store my shellcode in environment variables, find it's address and return to it? – George Sp May 29 '17 at 9:28
3

If you fimilar with gdb and can control rip, then you are one step away from the solution.

Let's make a small example

void main() {
  char* buff = "asdf";
}

compile it

$ gcc test.c

and then use debugger

$ gdb a.out
 (gdb) set disassembly-flavor intel
(gdb) disassemble main
Dump of assembler code for function main:
 0x00000000004004d6 <+0>:   push   rbp
 0x00000000004004d7 <+1>:   mov    rbp,rsp
 0x00000000004004da <+4>:   mov    QWORD PTR [rbp-0x8],0x400574
 0x00000000004004e2 <+12>:  nop
 0x00000000004004e3 <+13>:  pop    rbp
 0x00000000004004e4 <+14>:  ret    
End of assembler dump.

So our variable buff is at rbp-0x8 on the stack. If ASLR disabled - the address is always the same. You can get it with:

(gdb) break *0x00000000004004e2
Breakpoint 1 at 0x4004e2
(gdb) r
Starting program: ./a.out 
Breakpoint 1, 0x00000000004004e2 in main ()
(gdb) p $rbp-0x8
$1 = (void *) 0x7fffffffdbd8
  • I am not sure i understand you. But in my case the program is more complicated. There is a function in main which returns another functions exit code and inside the last is strcpy where i overflow the buffer. So i dont know how to calculate the buffer address like you did. – George Sp May 29 '17 at 10:42
  • 1
    Then you need to run (gdb) disassemble <name of the function where strcpy is>. If you post its output here we can look into it. – ATetereb May 30 '17 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.