1

I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code:

Code that I need help with::

#include <stdio.h>
int main(int argc, char * argv[]) {
    char buf[256];
    if(argc == 1) {
        printf("Usage: %s input\n", argv[0]);
        exit(0);
    }
    strcpy(buf,argv[1]);
    printf("%s", buf);
}

I compile this code with gcc -z exestack -fno-no-stack-protector

Questions:

  1. I understand that the general technique is to write to a buffer such that I overwrite where the next instruction register looks in memory. So my question is, where do I insert a breakpoint in this code to figure out where to overwrite? If I do disas main I get:

    0x080497b1 <+60>: add $0x10,%esp

    0x080497b4 <+63>: sub $0xc,%esp

    0x080497b7 <+66>: push $0x0

    0x080497b9 <+68>: call 0x804fd50

    0x080497be <+73>: mov 0x4(%eax),%eax

    0x080497c1 <+76>: add $0x4,%eax

    0x080497c4 <+79>: mov (%eax),%eax

    0x080497c6 <+81>: sub $0x8,%esp

    0x080497c9 <+84>: push %eax

    0x080497ca <+85>: lea -0x108(%ebp),%eax

    0x080497d0 <+91>: push %eax

    0x080497d1 <+92>: call 0x8049028

    0x080497d6 <+97>: add $0x10,%esp

    0x080497d9 <+100>: sub $0x8,%esp 0x080497dc <+103>: lea -0x108(%ebp),%eax

If I add a breakpoint at *main+97, and then run AAAAAA I get the following:

Breakpoint 1, 0x080497d6 in main ()
(gdb) info registers
eax            0xbffff1f0   -1073745424
ecx            0xbffff575   -1073744523
edx            0xbffff1f0   -1073745424
ebx            0x80da000    135110656
esp            0xbffff1e0   0xbffff1e0
ebp            0xbffff2f8   0xbffff2f8
esi            0x80da000    135110656
edi            0x80481e8    134513128
eip            0x80497d6    0x80497d6 <main+97>
eflags         0x246    [ PF ZF IF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

Am I putting the breakpoint in the right place to help with this overflow? Right after the call to strcpy? Also, I see that ebp is at 0xbffff2f8. Does this mean that I want to overwrite the address right next to this at 0xbffff2fc to point back inside the buffer and I will be done? Because that does not appear to work: my buffer is a NOP sled and shell code.

Thanks for any help!

1

Correction.. I’ll look again but in order to overwrite EIP you’d need to input a buffer that is buf +whateverIsAboveItOnStack + EBP (4bytes) + whateverYouWantEIPtoBe . Run the program in gdb and type disass strcpy() the you’ll be able to see where the overflow happens and where your buffers are located. Hope this helps.

    (gdb) run $(python -c 'print "a" * 270')
Starting program: /home/bob/C/Disassembler_Fun/SE_Vuln/se_vuln $(python -c 'print "a" * 270')

Program received signal SIGSEGV, Segmentation fault.
0x0040068b in main (argc=<error reading variable: Cannot access memory at address 0x61616161>, 
    argv=<error reading variable: Cannot access memory at address 0x61616165>) at se_vuln.c:10
10  }
(gdb) i r
eax            0x0  0
ecx            0x61616161   1633771873
edx            0xb7fbc870   -1208235920
ebx            0x61616161   1633771873
esp            0x6161615d   0x6161615d
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x40068b 0x40068b <main+139>
eflags         0x10286  [ PF SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

If I overflow a buffer in a program with a vulnerable function that returns execution somewhere (main()) I can overwrite EIP

    #include <string.h>

void vuln(char *arg) {
    char buffer[10];
    strcpy(buffer, arg);
}  

int main( int argc, char** argv ) {
    vuln(argv[1]);
    return 0; 
}

    (gdb) run $(python -c "print ('a' * 22) + ('b' * 4)")
Starting program: /home/bob/C/Disassembler_Fun/overflow $(python -c "print ('a' * 22) + ('b' * 4)")

Program received signal SIGSEGV, Segmentation fault.
0x62626262 in ?? ()
(gdb) i r
eax            0xbffff286   -1073745274
ecx            0xbffff520   -1073744608
edx            0xbffff296   -1073745258
ebx            0x61616161   1633771873
esp            0xbffff2a0   0xbffff2a0
ebp            0x61616161   0x61616161
esi            0x2  2
edi            0xb7fbb000   -1208242176
eip            0x62626262   0x62626262
eflags         0x10282  [ SF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51
(gdb) 

Note the B's (0x42 is the hex for b) overwriting EIP. I guess this is the kind of overflow in your example can be used for a DOS attack but not necessarily code execution. I'd suggest enlarging the buffer in my example if you want to use it for tests involving storing a nop sled and shellcode in the buffer. Good luck have fun! Hope this helped.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.