How to pass parameters with a Buffer Overflow?

Question

I'm experimenting with Buffer overflow basics, I'm trying to call the shell function without modifying the code. So far I've managed to call it but I can't find a way to give it the right parameter (which is exec_string)

Here is the code :

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/*
* compiled with:
* gcc -O0 -fno-stack-protector lab2B.c -o lab2B -m32
*/

char* exec_string = "/bin/sh";

void shell(char* cmd)
{
    system(cmd);
}

void print_name(char* input)
{
    char buf[15];
    strcpy(buf, input);
    printf("Hello %s\n", buf);
}

int main(int argc, char** argv)
{
    if(argc != 2)
    {
        printf("usage:\n%s string\n", argv[0]);
        return EXIT_FAILURE;
    }

    print_name(argv[1]);

    return EXIT_SUCCESS;
}

I run it with./lab2B $(python -c 'print "A"*27 + "\x8D\x55\x55\x56"') which seems to enable me to get into shell, according to gdb.

Thanks in advance for your help

Answer 1

When you overwrite the return address with the address of your shell function, try to think of this as a call instruction for shell.

As shown below, when a function is called a stack frame is formed and the parameters for it are pushed onto the stack, followed by the return address(EIP) of your previous function along with your Stack Pointers(ebp, esp). with you Stack Pointer being on top of the frame.

Essentially, after you overwrite the return pointer with "\x8D\x55\x55\x56" you are going to need to add on another address, being return pointer for the new function, as well as the address of your exec_string pointer, that being a parameter for your new function.

To understand how to exploit this I would recommend learning more about Return Oriented Programming, this is a good source for understanding that as well as how the stack looks when a function is called.