1

I've been working on Return-to-libc Attack Lab from SEED (Lab Description and Tasks). The environment is Ubuntu 12.04 32 bit. Please consider the following code:

/* This program has a buffer overflow vulnerability. */
/* Our task is to exploit this vulnerability */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(FILE *badfile)
{
    char buffer[12];

    /* The following statement has a buffer overflow problem */
    fread(buffer, sizeof(char), 40, badfile);

    return 1;
}
int main(int argc, char **argv)
{
    FILE *badfile;

    badfile = fopen("badfile", "r");
    bof(badfile);

    printf("Returned Properly\n");

    fclose(badfile);
    return 1;
}

I found the desired addresses, designed badfile so that it changes the content of the stack as in the sketch below and checked it with the debugger (source):

[-] Buffer overflow doing return-to-libc and executing system function
                                                  1             2        3
|---------------------------|------------|--------------|------------|
|           buffer          |   system   |   fake_ret   |  /bin/sh   |
|---------------------------|------------|--------------|------------|
               args              EBP           EIP

I was able to open the shell but for some reason I did not get the privilege of the root:

[02/14/2018 16:22] seed@ubuntu:~/Documents$ gdb -q retlib
Reading symbols from /home/seed/Documents/retlib...done.
(gdb) r
Starting program: /home/seed/Documents/retlib 
$ whoami
seed
$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark)
$ 

I checked the vulnerable program and it was properly compiled (according to the lab's instructions), the program is Set-UID:

[02/14/2018 16:35] seed@ubuntu:~/Documents$ ls -l retlib
-rwsr-xr-x 1 root root 9712 Feb 11 06:41 retlib

Can someone please explain why I did not get the privilege of the root after I opened the shell?

Thank you very much in advance.

0

After a long time of searching, I found out that environment variables have a different address when running the program under GDB. So, the solution to my problem was simply to write a short program in C that prints the address of the environment variable I was looking for. Then, the solution was obvious to me.

  • If you run a suid program from gdb, you will not get the suid privileges. – Dog eat cat world Jul 22 '18 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.