When Compiling with:
gcc -m32 -fno-pie -no-pie -g bof.c -fno-stack-protector -z execstack -o bof32
I am able to overwrite the return address with just about any value except a valid return address.
When I try to use a Valid return address the last byte gets overwritten with something differentsuch as 0xffffd8fe I get bad address..
So what I am asking is even though I have shut off stack protection, shutoff pie, and enabled execution of the stack, also set kernel ASLR to 0, is there any other reasons why this would cause failure to completely control EIP?
Here is the Code I am not asking you to solve this for me, I am just asking for some advice as to why this acts the way it does!
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void validate(char *pass) {
if (strcmp(pass, "[REDACTED]") == 0) {
printf("ACCESS GRANTED!");
printf("Oh that's just idio... Oh my god!\n");
} else {
printf("Damn it, I had something for this...\n");
}
}
int main(int argc, char** argv) {
char password[200];
printf("C:/ENTER PASSWORD: ");
scanf("%s", password);
validate(password);
return 0;
}
Note: in case this matters my system is x86_64 and i compiled the binary as x86, this program does have badchars which are "\x09 \x0a \x0b \x0c \x0d \x20", and the payload structure is as follows. payload = "A"*132+ret+28byteshellcode+"A"*44 .