0

When Compiling with:

gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32

I am able to overwrite the return address with just about any value except a valid return address. Successful overwrite of EIP with 4bytes A's

When I try to use a Valid return address the last byte gets overwritten with something differentsuch as 0xffffd8fe I get bad address..

Failure to Fully overwrite EIP

So what I am asking is even though I have shut off stack protection, shutoff pie, and enabled execution of the stack, also set kernel ASLR to 0, is there any other reasons why this would cause failure to completely control EIP?

Here is the Code I am not asking you to solve this for me, I am just asking for some advice as to why this acts the way it does!

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void validate(char *pass) {
    if (strcmp(pass, "[REDACTED]") == 0) {
        printf("ACCESS GRANTED!");
        printf("Oh that's just idio... Oh my god!\n");
    } else {
        printf("Damn it, I had something for this...\n");
    }
}

int main(int argc, char** argv) {
    char password[200];
    printf("C:/ENTER PASSWORD: ");
    scanf("%s", password);
    validate(password);
    return 0;
}

Note: in case this matters my system is x86_64 and i compiled the binary as x86, this program does have badchars which are "\x09 \x0a \x0b \x0c \x0d \x20", and the payload structure is as follows. payload = "A"*132+ret+28byteshellcode+"A"*44 .

1

Your second example dies due to 0xffffd8fe pointing to an illegal instruction. It seems a poor address for a blind ret or jump esp pivot into your shell code (should be in the binary 0x0804xxxx). It also seem like a poor address for your shellcode as it should be located somewhere closer to 0xbfff0000. Try putting a breakpoint on the address you are overwriting EIP with before running the payload. That way you can confirm execution (breakpoint hit) and inspect the instructions.

  • ok thanks, Just to be clear since I am new to asm and bof's. I should set a break at the scanf vuln function and see where I should tell it to return to and execute the payload?? – zeroskilz Feb 12 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.